Trend Micro discovers 'indefensible' car security/CAN standard flaw

Trend Micro claims to have discovered a hack is found that is not only successful in being able to drastically affect the performance and function of the car, but is also stealthy and vendor neutral. Discovered by researchers at Politecnico di Milano, Linklayer Labs and Trend Micro’s Forward-looking Threat Research (FTR) team, the hack is said to be currently indefensible by modern car security technology and to completely resolve it would require broad, sweeping changes in standards and the ways in-vehi
August 18, 2017 Read time: 3 mins
Trend Micro claims to have discovered a hack is found that is not only successful in being able to drastically affect the performance and function of the car, but is also stealthy and vendor neutral.


Discovered by researchers at Politecnico di Milano, Linklayer Labs and Trend Micro’s Forward-looking Threat Research (FTR) team, the hack is said to be currently indefensible by modern car security technology and to completely resolve it would require broad, sweeping changes in standards and the ways in-vehicle networks and devices are made. Realistically, it would take an entire generation of vehicles for such a vulnerability to be resolved, not just a recall or an OTA (on-the-air) upgrade.

The researchers say it abuses the Controller Area Network, or CAN, network protocol that connects all in-vehicle equipment, parking sensors, airbag, active safety system and infotainment systems and allows them to communicate. The standard for this network is called a Controller Area Network, or CAN.

Trend Micro’s online blog says, “It’s not the car manufacturers’ fault, and it’s not a problem introduced by them. The security issue that we leveraged in our research lies in the standard that specifies how the car device network (i.e., CAN) works. Car manufacturers can only mitigate the attack we demonstrated by adopting specific network countermeasures, but cannot eliminate it entirely. To eliminate the risk entirely, an updated CAN standard should be proposed, adopted, and implemented. This whole process would likely require another generation of vehicles.”

David Barzilai, co-founder and chairman, automotive cyber-security firm 8519 Karamba Security, agrees with Trend Micro that the CAN protocol can be abused, causing it to disable devices on a CAN network, and that 7178 IDS systems will not be able to help against such an attack.
 
However, he says, In order to remotely launch Denial of Service (DoS) CAN attacks, a hacker must compromise an externally-connected electronic control unit (ECU) and interfere with its factory settings. Such interference enables the hackers to start sending CAN messages that generate errors leading to a device DoS.
 
“Instead of changing the legacy CAN protocol in all cars that use it (practically all vehicles), the industry should harden the externally-connected ECUs according to their factory settings, to prevent any unauthorised change to the ECU. Blocking such changes enables the industry to prevent cyber-attacks, including the DoS attack that Trend Micro reported on.”

Location Based Systems

Related Content

  • October 19, 2015
    Tighten up on cyber security before hackers infiltrate ITS infrastructure
    This year’s ITS World Congress in Bordeaux will have three sessions dedicated to cyber security and the issue will also be addressed under connected and automated vehicles categories. Jon Masters finds out why. American security researchers Charlie Miller and Chris Valasek attracted international press coverage recently when they demonstrated how they could hack into and take control of a vehicle from a remote laptop. While the implications are clearly serious for vehicle manufacturers, highway and transpor
    Read More
  • May 10, 2019
    SafeRide: it’s time to act on cyberattacks
    Cyber threats are increasing rapidly and conventional security measures are unable to keep up. Ben Spencer talks to SafeRide’s Gil Reiter about what OEMs can do now As more vehicles become connected, so the potential threats to their security increase. Gil Reiter, vice president of product management for security firm SafeRide, says the biggest ‘attack surface’ for connected cars is their internet connectivity - and the in-vehicle applications that use the internet connection. “The most vulnerable co
    Read More
  • May 14, 2018
    The rise of V2X: it’s time for ITS to put up the shields in cyberspace
    Traffic management has largely been shielded from the sort of malicious hacking that is commonplace in other industries – but with billions of connected devices in the world it won’t stay that way, warn internet experts Keith Golden and Brandon Johnson. Traditionally isolated from networks and the internet over most of its history, the traffic management industry has largely been shielded from malicious hacking and system intrusion that have become commonplace in other industries. However, as the rate of
    Read More
  • May 6, 2020
    Don’t forget security threat, says Econolite
    A new level of communication is helping deliver on the promise of Vision Zero and a more sustainable future. But amid the promise, Econolite’s Sunny Chakravarty suggests we need to be mindful of the potential downsides in an age of mass connectivity
    Read More

Highlighted Content