Realistic Trends in Vulnerability
based on Hacking into Vehicle
Car Hacking Village, DEF CON 28
Ryosuke Uematsu, Shogo Nakao, Ryoichi Teramura, Tatsuya Katsuhara

NDIAS, Ltd.

Agenda$ whoami
Background
HOW testing
Vulnerability trends in Vehicles

Conclusion & Perspective© NDIAS, Ltd.

1

$ whoami© NDIAS, Ltd.

2

$ whoami

NDIAS is …

The company for automotive cybersecurity services
Specialist group for automotive cybersecurity assessment andconsultation
Jointly established by NRI Secure and DENSO in 2018

Global automotivecomponents manufacturer

IT & IoT Security Services

Don’t worry!
We NEVER share the client info. to DENSO and NRI secure
without the permission!
© NDIAS, Ltd.

3

$ whoami

NDIAS activities

Business
We are working with more than 6 OEMs and some suppliersCompetition
DEFCON Car hacking Village CTF 2019: 4th place as NDIER
NDIER is the joint team with NDIAS and IERAE security

DEFCON Car hacking Village CTF 2018: 5th place as katagaitai© NDIAS, Ltd.

4

$ whoami

We are…
Ryosuke Uematsu
Security engineer

Shogo Nakao
Security engineer@tansokun920

Ryoichi Teramura
Manager@trmr105© NDIAS, Ltd.

Tatsuya Katsuhara
Director@kthrtty

5Background© NDIAS, Ltd.

6

Background

Car Cybersecurity Generation

Jeep Cherokee(BH15)

2015

0 thGen

Before “Cherokee”(aka B.C.)

1stGenSimple mitigations

2016
Tesla Model S(BH17)

2017

Tesla Model X(BH18)

2018

BMW(BH19)

2019

Lexus(CVE-2020-5551)
WP29(officially approved)

Note: it depends on car manufactures.

2ndGenAlmost no mitigation, no regulationIt‘s like “Hack the box”

No changes to the electronic platform

Electronic platform designed withcybersecurity

Defense-in-depth
Not perfect, but moderate

2020

ISO/SAE 21434(scheduled)

・・・2021

3 rd2022© NDIAS, Ltd.

Gen

WP29, ISO/SAE 21434 compliant
Security by design
Cybersecurity for pre/post-production
7

Background

Executive summary
Introduction of our approaches focusing on high-risk
vulnerabilities in the whole “vehicle” perspective

Trends of vulnerabilities found in development phase for actual
2nd Gen cars and ECUs.
Based on more than 40 ECUs and 300 vulnerabilities.

What kinds of mitigations are suit for those vulnerabilities

Hope that this result helps the developers in car manufacturers
and ECU suppliers!
© NDIAS, Ltd.

8

How Testing© NDIAS, Ltd.

9

How Testing

Pen test for “vehicle” and “ECUs”

Car security testing has 2 categories:
Penetration test for vehicles
Penetration test for ECUs

Today’s results are mainly based on the test for ECUs.
Pen test for vehicle

Pen test for ECUs

Check point

Which thereat scenarios
are realized?

Which vulnerabilities areexsit?

Test type

Integration test

Unit test

Num. of vulns found

A few

A lot

© NDIAS, Ltd.

10

How Testing

Trial to find vulnerabilities everywhere

Vulnerabilities are found in everywhere through HW/SW stacke.g., Hardware, Interface driver, Boot strap, OS Kernel, OSS, Application etc.

We will introduce our approaches for finding vulnerabilities
Scope of HW/SW Stack

Test methods
Remote I/F (e.g., Cellular)Interfacetest

Application

IF

OS/OSS/
Off-the-shelf×

Adjacent I/F (e.g., Wi-Fi, Bluetooth, LF/RF, NFC)
Local I/F (e.g., USB, CAN, Ethernet, EV)
Physical I/F (e.g., JTAG, UART, SPI)

Dynamic software analysis

HWSoftware
analysis

Static software analysis© NDIAS, Ltd.

11

How Testing

Interface Test : Remote（Cellular）
Penetrating wireless interface
Check functions and messages over Cellular(2G/3G/4G)
LTE stack test
Port scanAnritsu MD8475A

MITM

Check a lot of things
Authentication bypass

MITM attack
Unintended service remaining
Replay attack

Confidentiality of sensitive data

© NDIAS, Ltd.

12

How Testing

Interface Test : Adjacent（wireless LAN, Bluetooth, …）
Penetrating adjacent interface (wireless LAN, Bluetooth, …)
Check functions and messages over adjacent network
Wireless LAN protocol and Bluetooth stack test

Well-known vulnerability
check about BluetoothWell-known vulnerability check
Port scan
MITM
Sniffing（for Bluetooth）

Check a lot of things

BLE Sniffer

Authentication bypass
MITM attack

Unintended service remaining
Replay attack
Confidentiality of sensitive data
Well-known vulnerability remaining

NFC R/W
LF/RF© NDIAS, Ltd.

13

How Testing

Interface Test : Local（USB, CAN, Ethernet, …)
Penetrating local interface
Check functions and messages over local interface

Test bench

Fuzzing
Port scan
Well-known vulnerability check
Using UDS or not?

CAN and Ethernet

Check a lot of things
Unintended service remaining
Replay attack
Security accessMessage Authentication Code
Confidentiality of sensitive data
Well-known vulnerability remaining

USB Analyzer© NDIAS, Ltd.

14

How Testing

Physical Interface Test
Penetrating HW
Check Debug port, Chip-to-chip Communication…
JTAG, SPI, UART, eMMC, UFS etc.
Do you like soldering?

Check a lot of things
Firmware extraction
Insecure credentials

Pin5:UART-4 Tx
Pin6: UART-4 Rx

UART4 Rx

© NDIAS, Ltd.

UART4 Tx

15

How Testing

Dynamic Software analysis

Analyze running processes on ECUs
The dynamic analysis tells us a lot of things
Running processes on ECU
Behavior and logs during service running
Monitoring behavior differences with the config modified© NDIAS, Ltd.

16

How TestingStatic Software analysis
Analyze binary files (Firmware, Software,…)Input: Firmware (or unlocked ECU)
We can extract firmware from unlocked ECU(Sometimes) we can get it from locked ECU

Firmware is good alternative of source codeand debug console
The binary file tells us a lot of things
Well-known vulnerabilities on
OS/OSS/Off-the-shelf products
Better alternative to the vulnerability scannerDebug port and service
Better alternative to the port scanner

Insufficient Security Configuration
Hardcoded key, password, certifications
Supplier’s debug port…
© NDIAS, Ltd.

17

How Testing

Wrap up for test methods
Test method

Target elements

Check points

Remote interface

Cellular etc.

Check functions and packets over cellular
network to find vulnerabilities of cellulardependency.

Adjacent interface

Wireless LAN,Bluetooth etc.

Check functions and packets over cellular
network to find vulnerabilities of wireless
Lan and Bluetooth dependency.

Local interface

USB, CAN,
Ethernet etc.

Check functions and packets over cellular
network to find vulnerabilities of USB,CAN, and ethernet dependency.

Physical interface

JTAG, UART, SPIetc.

Check signal on JTAG, UART, SPI andaccess them to extract firmware andcredentials.

Dynamic analysis

OS/OSS/Off-theshelf, Application

Analyze running processes on ECU toknow behavior and their vulnerabilities.

Static analysis

OS/OSS/Off-theshelf, Application

Analyze binary files to find vulnerabilities

Interface
test

Softwaretest© NDIAS, Ltd.

18

How Testing

How much risks are there from whole “vehicle” perspective
Risk scores we use calculated by “Damage impact” * “Attack feasibility”
Damage impact: The impact for “vehicle” when the vulnerability is exploited
Attack Feasibility: The attack feasibility for “vehicle” when the vulnerability is exploited

Risks of the attack scenarios related to vulnerabilities of internal NW tend to be decreasing
Such vulnerabilities are typically found on ECU and CAN-bus behind GW
Of course, risks related to components are also important in “defense-in-depth” perspective,
however…

Hope to find more high-risk vulnerabilities
Focusing on “vehicle” is one of the approaches to achieve that.

Risk Score Matrix(example)

Damageimpact forvehicle© NDIAS, Ltd.

Attack feasibility
Very easy

Easy

Moderate

DifficultSevereHigh

MediumMediumLow

Major

MediumMediumLow

Low

Moderate

Low

Low

Low

Information

Negligible

Information

Information

Information Information
19

Vulnerability trends in Vehicles© NDIAS, Ltd.

20

Vulnerability trends in Vehicles

Data set
Our analysis are based onMore than 300 vulnerabilities we foundMore than 40 ECUs developed by more than 10 auto manufacturers and suppliers.

The target ECUs are classified to 4 categories#1. IVI 37% of target ECUs
It has Adjacent I/F (such as WLAN, Bluetooth etc.)#2. TCU 18% of target ECUs
It has Remote I/F (such as Cellular etc.)#3. GW 18% of target ECUs
It has local I/F (such as OBD-II etc.)#4. Others 27%
Including ADAS, Smart key, Charging(EV), V2X…
Telematics

(TCU)

GW

ADAS

ADAS
Infotainment

(IVI)

Smart
Key
V2X
OBD-II© NDIAS, Ltd.

Charging(EV)

CameraPowertrain
HCU

ENG

Smart KeyDoor

Body

ChassisSteerESC

Proportion of target ECUs

21

Vulnerability trends in Vehicles

Around 70% of vulns are in OS (BSW), OSS, Off-the-shelf
Proportion of vulnerability detected locations in the ECU structure

Application 13%

Interface28%

OS(BSW)/OSS/
Off-the-shelf
67%

Hardware 20%© NDIAS, Ltd.

Morethan300vulns
22Vulnerability trends in Vehicles

Most of high risk vulns are in Software (not hardware)
Proportion of vulnerability(only high risk) detected locations in the ECU structure

Application 30%

Interface39%© NDIAS, Ltd.

OS(BSW)/OSS/
Off-the-shelf
70%

Hardware 0%

23

Vulnerability trends in Vehicles

The most often detected is “Insecure OS/OSS settings”
The amount of All Risk Vulnerabilities© NDIAS, Ltd.

24

Vulnerability trends in Vehicles

Authentication & SW Update security are “very” important
The amount of High & Medium Risk Vulnerabilities© NDIAS, Ltd.

25

Vulnerability trends in Vehicles

More complex ECU, more vulns
Average number of vulnerabilities© NDIAS, Ltd.

Proportion of vulnerabilities
per risk score26

Vulnerability trends in Vehicles

Bluetooth vulnerabilities are the most detected in remote attack I/F

Proportion of vulnerabilities we found in remote attack I/F© NDIAS, Ltd.

27

Vulnerability trends in Vehicles

Authentication Bypass Vulnerability (Bluetooth)

Authentication Bypass
PIN Mode (0000,1234,9999,etc…)
CarsBlues
IO Capability:NoInputNoOutput

We can access the vehicle
from near the vehicle.
© NDIAS, Ltd.

28

Vulnerability trends in Vehicles

Authentication Bypass Vulnerability (Cellular I/F)

A very rare case, but a very serious problem.
Using the test code for auth bypass based on srsLTE.

Fake Base Station

What…Really…?!

We can access the vehicle
directly from a remote location.

© NDIAS, Ltd.

29

Vulnerability trends in Vehicles

83% of High & Medium vulnerabilities of local “NW” I/F are related to UDS

Type of Vulnerability
in local “NW” I/F

Vulnerabilities in local I/F

Focus onHigh & Mediumvulnerabilities© NDIAS, Ltd.

30

Vulnerability trends in Vehicles
Broken SecurityAccess protection (CAN/Ethernet)

What matters is “UDS” protocol
2 nd gen cars start to support “Message Authentication Code” to secure messaging via CAN/Ethernet.
By contrast, for UDS, “security access” is still primary countermeasure for security.

Improper specifications or implementations of security access:Lack of entropy for “seed” generation
After resetting ECU, getting same random sequence“Read by ID/Address” is accessible to secrets without security access

Improper protection of credentials:
Underutilized hardware security module

Hardcoded credentials
for security access

Seed of the same value as before

Seed with low entropy
Read confidential info/config

UDS Access© NDIAS, Ltd.

31

Vulnerability trends in Vehicles

Some ECUs are still unlocked - physical debug interfaces

Proportion of ECUs with an unlocked physical debug interface© NDIAS, Ltd.

32

Vulnerability trends in Vehicles

Physical debug interfaces(such as JTAG, UART) are unlocked

Improper flash
protection
configuration

Login to console via UART

Locked, but improper password
use results in firmware extraction
Extract firmware from eMMC
© NDIAS, Ltd.

33

Vulnerability trends in Vehicles

Software analysis is a powerful method to find high-risk vulns
The proportion of nums of vulns
found by each test

The proportion of the risk score of vulns
found by each test“2x” number ofvulnerabilities found!
More likely to findhigh-risk
vulnerabilities!

© NDIAS, Ltd.

34

Vulnerability trends in Vehicles

How to analyze software
1. Identify the target code in huge amount of ECU binary
2. Analyze the data flow and security functions
3. Dig deeper and deeper③Dig deeper

Update process on container

TLS communication
Signature verification
Encryption① Identify② Analyze

Updateprocess
out ofcontainer
2ndsignature
verification

Container

Host OSTLS communication

ProxyCom. busSocket communication

HardwareExample of software arch.

© NDIAS, Ltd.

35

Vulnerability trends in Vehicles

SW analysis example: Insecure key management

The credentials must NOT be hardcoded
HSM is now mandatory to protect your private keys

callcallcallcallrefer© NDIAS, Ltd.

36

Vulnerability trends in Vehicles

SW analysis example: Insecure “SecurityAccess” algorithm
SecurityAccessHandler“Old generation” MCU is known for thelack of TPM feature.

An MCU firmware with improper lockwas successfully extracted
Static analysis results in identifying
vulnerable “SecurityAccess” algorithm
and secret key in the firmware binary.

UDS SID “0x27” = SecurityAccess

GW ECU© NDIAS, Ltd.

Diag Tool

37

Vulnerability trends in Vehicles

Software tells us many many things

TLS’s certificate validation
is disable
Improperimplementation ofauthentication protocol

memcopy() buffer
overflow© NDIAS, Ltd.

Timing attack tobypass thesignaturevalidation

Hardcoded Secretkey

Directory
traversal

Improper error
handling

Older version oflibrary is used

Insufficient entropyof the seed of
PRNG generator

Insecure sensitive
data management38

Vulnerability trends in Vehicles

Does 2nd gen car face the cybersecurity threat?

The answer is “Secure” in most cases.
It is difficult to realize the threat scenarios for 2 nd gen carbecause
2nd gen car has good architecture from the view of defense in depth
2nd gen car has many security functions.
Secure boot, HSM, FOTA, MSG authentications, Good authentication protocol, strictly firewall…

2nd gen car are installed better hardened OS and off-the-shelf software.
2nd gen car’s application has applied a lot of patches
We feel it through software analysis. Developers are good work.

“Unsecure” cases are very rare.
All vulnerabilities we found must be fixed before commercial version.

© NDIAS, Ltd.

39

Vulnerability trends in Vehicles

5 solutions can mitigate 85% of high & medium risk vulns
1. Keep credentials and private keys in secure
element such as Trust Zone, TPM and HSM

High & Medium
risk vulns

2. Verify the signature of firmware data strictly

3. Use appropriate PRNG and cryptography
4. Pay attention to three things about theOS/OSS/off-the-shelf products
Use OSS properlye.g., never skip the server certificate verification for TLS.

Software version control/Managing software composition
Secure configuration of the OS/OSS/off-the-shelfe.g., Firewall, Permissions, etc..

5. Lock the physical debug interfaces such as
JTAG and UART properly© NDIAS, Ltd.

40

Conclusion & Perspective© NDIAS, Ltd.

41

Conclusion & Perspective
Q. Is it easy to hack the car?
A. For 2 nd gen car, answer is “Difficult”.
We can find some vulnerabilities through our work.
However in a lot of cases, they didn’t realize the high-risk threat scenario.

Q. What test is good?
A. Software analysis
But it needs the firmware (of unlocked ECU) and test time
Recommend the combined testQ. What is need to develop secure cars
A. Good relation between OEM, supplier and security service provider.
New security function is definitely good. But relationship is more important.

© NDIAS, Ltd.

42

Thank you !
For more information, visit & ask us
https://ndias.jp/
info@ndias.jp
Follow us on
Ryosuke Uematsu@tansokun920

Shogo Nakao
Ryoichi Teramura@trmr105

Tatsuya Katsuhara@kthrtty© NDIAS, Ltd.