Comprehensive Experimental Analyses of Automotive Attack Surfaces

By Stephen Checkoway, Damon McCoy, Danny Anderson, Brian Kantor, Hovav Shacham, Stefan Savage, Karl Koscher, Alexei Czeskis, Franziska Roesner, and Tadayoshi Kohno.

In Proceedings of USENIX Security 2011. USENIX, August, 2011.

Abstract

Modern automobiles are pervasively computerized, and hence potentially vulnerable to attack. However, while previous research has shown that the internal networks within some modern cars are insecure, the associated threat model—requiring prior physical access—has justifiably been viewed as unrealistic. Thus, it remains an open question if automobiles can also be susceptible to remote compromise. Our work seeks to put this question to rest by systematically analyzing the external attack surface of a modern automobile. We discover that remote exploitation is feasible via a broad range of attack vectors (including mechanics tools, CD players, Bluetooth and cellular radio), and further, that wireless communications channels allow long distance vehicle control, location tracking, in-cabin audio exfiltration and theft. Finally, we discuss the structural characteristics of the automotive ecosystem that give rise to such problems and highlight the practical challenges in mitigating them.

Material

• See the Center for Automotive Embedded Systems Security website for the paper and more.
• Full version, local copy in PDF.
• Slides in PDF.

Reference

@InProceedings{checkoway-et-al:cars-connectivity:usenix11,
  author =    {Stephen Checkoway and Damon McCoy and Danny
              Anderson and Brian Kantor and Hovav Shacham
              and Stefan Savage and Karl Koscher and Alexei
              Czeskis and Franziska Roesner and Tadayoshi
              Kohno},
  title =     {Comprehensive Experimental Analyses of
               Automotive Attack Surfaces},
  booktitle = {Proceedings USENIX Security 2011},
  editor =    {David Wagner},
  publisher = {USENIX},
  year =      2011,
  month =     aug,
  url =       {https://checkoway.net/papers/car2011},
}