USE CASE

Protecting a Telematics
Control Unit From
Remote Attacks

Copyright © 2022 VicOne. All rights reserved.

Analyzing a contactless
attack on a telematics
control unit
In 2017, Tencent Keen Security Lab conducted a comprehensive research withvarious BMW car systems, which included performing physical and remoteattacks on the in-vehicle infotainment (IVI) system and telematics control unit
(TCU). After 13 months of in-depth experiments, the researchers discovered 14
exploitable vulnerabilities and published a summary report describing theirfindings.

In this use case, we take a closer look at the experiment that exploited the TCU
via a cellular network and map the activity to the VicOne Automotive Attack
Matrix and the threat categories listed in UN Regulation No. 155 (UN R155).
UN R155 threat category mapping
The attack techniques used in the research can be mapped to the threat
categories defined in UN R155, as illustrated in the following diagram.
Manufacturers can use this information to conduct further investigations andmake necessary mitigation plans.
tmicon-flag-o 4.3.1

tmicon-fflag 4.3.2

tmicon-flag-o 4.3.3

tmicon-flag-o 4.3.4

tmicon-fflag 4.3.5

tmicon-fflag 4.3. 6

tmicon-fflag 4.3. 7

Back-end
servers

Communication channels

Updateprocedures

Unintended
humanactions
facilitating acyber attack

External

Vehicle data/

Potential
vulnerabilities

connectivity
andconnections

code

Protecting Telematics Control Unit From Remote Attacks 2

H

ow it’s done. Establish connection with the victim vehicle
through a cellular network.

1

The researchers built a false cellular basestation with stronger signal strength so that
the TCU in the victim vehicle had a higher
chance of connecting to it.

nce the TCU connected to the false cellularbase station, the researchers suppressed theTSP signals with a signal suppressor to ensurethat the victim vehicle was serviced by theirfalse cellular base station.
O

2. Exploit zero-day vulnerabilities in the TCU.
By sending crafted telematic messages, theresearchers exploited the TCU vulnerabilities(CVE-2018-9311 and CVE-2018-9318) totrigger remote diagnostic services.

tmicon-flaflag- UN R155

4.3.2 Communication channels
4.3.5 External connectivity and connections
Automotive Attack Matrix
tmicon-target Manipulate Environment
tmicon-task-list-o Rogue Cellular Base Station
tmicon-task-list-o Manipulate Device Communication

tmicon-flaflag- UN R155

4.3.2 Communication channels
4.3.7 Potential vulnerabilities
Automotive Attack Matrix
tmicon-target Initial Accesstmicon-task-list-o Exploit via Radio Interface

3. O

btain root privileges to the TCU.

The researchers found a memory corruption
vulnerability in the TCU firmware, allowing
them to bypass signature protection and gain
root access to the TCU via remote code
execution (RCE).

tmicon-flaflag- UN R155

4.3.2 Communication channels
4.3.5 External connectivity and connections
4.3.6 Vehicle data/code
Automotive Attack Matrix
tmicon-target Defense Evasion
tmicon-task-list-o Subvert Trust Control

4.

Take control of the vehicle remotely.
fter compromising the TCU, the researchers
can send crafted Controller Area Network(CAN bus) messages to affect control of otherelectronic control units (ECUs) in the vehicle.
Atmicon-flaflag- UN R155

4.3.2 Communication channels
4.3.5 External connectivity and connections
4.3.6 Vehicle data/code
Automotive Attack Matrix
tmicon-target Affect Vehicle Function
tmicon-task-list-o Manipulation CAN Bus Message

Protecting Telematics Control Unit From Remote Attacks 3

How can VicOne help?
By utilizing the Automotive Attack Matrix, we understand the goal and reason of using aparticular technique in each hacking stage. In this section, we discuss how VicOne canhelp manufacturers prevent this attack and secure their systems throughout a vehicle'slife cycle.

Based on what we learned from this research, the following are some ways that VicOne
can help boost automotive security:

1 . M a n i p u l a t e

Environment

2 . M a n i p u l a t e

Environment

3.

Initial Access

4 . D e f e n s e

EvasionDrive-by Compromise

5 . A f f e c t V e h i c l e Function

Manipulate Environment

Manipulate Environment

Exploit via Radio Interface

Subvert Trust Controls

Unintended Vehicle Control Message

Rogue Cellular Base Station

Rogue Cellular Base Station

Supply Chain Compromise

Abuse Elevation Control Mechanism

Manipulation CAN Bus Message

Rogue Wi-Fi Access Point

Rogue Wi-Fi Access Point

Deliver Malicious App

Bypass Mandatory Access Control

Trigger System Function

Jamming or Denial of Service

Jamming or Denial of Service

Physical Modification

Bypass UDS Security Access Manipulate Device Communication

Manipulate Device Communication

Exploit via UDS

Disable Firewall

Downgrade to Insecure Protocols

Downgrade to Insecure Protocols

Exploit via Removable MediaADAS Sensors Attack

ADAS Sensors Attack

InsiderContext

Vulnerability

violation

management

IDPS: 
Application  CAN bus  anomaly  
detection

control

Identify anomalous vehicle events to protect vehicle function.
By comparing and analyzing vehicle telematics and profile, xNexus can identify anomalousvehicle events, such as disconnection from the telematics server due to connection to afalse cellular base station and injection of malicious CAN bus messages.

Discover vulnerabilities and mitigate risks at an early stage.
xZETA can identify software vulnerabilities in ECUs, allowing manufacturers to mitigate
risks before production.

Prevent privilege escalation with application control.
xCarbon provides application control to restrict the applications that can run in vehicles.
This helps prevent privilege escalation attacks or unauthorized application execution.

Protecting Telematics Control Unit From Remote Attacks
Use case: How to Detect Electronic Power Steering ECU Firmware Modification

4About VicOne  Automotive Security
Our Automotive Security team offers comprehensive protection against cyberattacks
targeting connected vehicles through xNexus, a cloud-based vehicle security operation
center (VSOC). By leveraging extended detection and response (XDR) capabilities,
automotive threat intelligence, OEM data, and xCarbon in-vehicle sensors, xNexus
ensures compliance with UN Regulation No. 155 (UN R155), maps threats to the ATT&CK
Matrix, highlights threats applicable to automotive cyberattacks, and keeps up with thelatest automotive cybersecurity incidents.

Detection
ActionDetection

Receives data or security notifications
from various sources

AnalysisxNexusConducts broad-spectrum correlation
analysis of threats

ActionAnalysis

Visualizes analysis results in a unified view
to assist in further investigations ormitigation

For more information:
Website: 
https://www.vicone.com/
Contact:  https://www.vicone.com/contact-us

Copyright © 2022 VicOne. All rights reserved.