USE CASE

Detecting Electronic
Power Steering ECU
Firmware Modification

Copyright © 2022 VicOne. All rights reserved.

Bypassing Lane Keeping
Assist System restrictions to control a steering wheel
Lane Keeping Assist System (LKAS) helps steer you back to the marked lane if
you stray away to prevent accidents caused by fatigue or distraction. In January2022, an ethical hacker posted an article that explains how he modified thefirmware of an Electronic Power Steering (EPS) ECU from a 2010 Volkswagen Golf
Mk6 in order to use LKAS without restrictions.
How it’s done

Accessing the ECULocating and modifying firmware

Flashing firmware

1. The hacker obtained the ECU of interest through its part number andestablished diagnostic communication with the ECU. Although the engineer
mode is password protected, it can be accessed using a brute-force attack. 

2. The hacker downloaded an update file containing the firmware he wanted tomodify and reverse engineered the firmware to remove the restrictions ofenabling LKAS: a six-minute timer of checking the steering wheel torque and aminimum speed of 50 km per hour. The relevant checksum in the firmware wasalso updated to pass the integrity check for data corruption. 

3. In the end, the hacker successfully flashed the firmware back to an actual car,allowing him to take control of the steering wheel and use LKAS at any time.

Detecting Electronic Power Steering ECU Firmware Modification 2

How can  
VicOne help?
From the hacking journey, we learned that the researcher was able to make modifications
to the firmware of an EPS ECU. In this section, we describe how VicOne xNexus can detectand alert manufacturers of these events.

xNexus detects unusual activity through vehicle profile comparison.
Although the specification of LKAS varies with the manufacturer, xNexus uses machinelearning technology to compare vehicle profile and identify abnormal activity. In this use
case, xNexus can detect the following issues: The vehicle has turned on LKAS but wasdriving below 50 km per hour, and the six-minute timer of checking the steering wheel
torque has been disabled.

After

detectingabnormalactivity,

xNexuschecksformodifications

totheECU

configuration profile, looks up any connection event to the OBD-II port, and verifies if thefirmware version matches the vehicle's current profile.

xNexus can also detect more in-depth changes to the ECU firmware, such as the numberof

password

retries,firmwareintegrity

check,

andfirmwareflashing,

to

help

manufacturers identify the root cause more effectively.

xNexus displays consolidated findings and violation alerts.
Manufacturers can use the information in further investigations to determine if the vehicle
has been hacked, or if the modifications were due to a software upgrade through a thirdparty vendor.  

xNexus can map the identified activity to the VicOne Automotive Attack Matrix (inspiredby MITRE ATT&CK®), which outlines tactics and techniques commonly used in automotive
cyberattacks. In this use case, understanding the brute-force attack technique helps
manufacturers consider securing the ECU by design, such as having stronger ECUauthentication.

Detecting Electronic Power Steering ECU Firmware Modification

Use case: How to Detect Electronic Power Steering ECU Firmware Modification

3

About VicOne  Automotive Security
Our Automotive Security team offers comprehensive protection against cyberattacks
targeting connected vehicles through xNexus, a cloud-based vehicle security operation
center (VSOC). By leveraging extended detection and response (XDR) capabilities,
automotive threat intelligence, OEM data, and xCarbon in-vehicle sensors, xNexus
ensures compliance with UN Regulation No. 155 (UN R155), maps threats to the ATT&CKMatrix, highlights threats applicable to automotive cyberattacks, and keeps up with thelatest automotive cybersecurity incidents.

Detection
ActionDetection

Receives data or security notifications
from various sourcesAnalysis
xNexusConducts broad-spectrum correlation
analysis of threats

ActionAnalysis

Visualizes analysis results in a unified view
to assist in further investigations ormitigation

For more information:
Website: 
https://www.vicone.com/
Contact:  https://www.vicone.com/contact-us

Copyright © 2022 VicOne. All rights reserved.