# Communication-Traffic-Assisted Mining and Exploitation of Buffer Overflow Vulnerabilities in ADASs
## 4 Practical Results and Physical World Threats
### Physical World Threats  
CAN is a vehicle bus standard designed to allow microcontrollers and devices to communicate with each other within a vehicle without a host computer. The power control instructions of vehicles are transmitted through CAN. However, the CAN protocol contains no direct support for secure communications [18]. The ADAS system is connected to both the in-car Ethernet and CAN simultaneously. If there is a BOF vulnerability in the ADAS, hackers can use it to access the vehicle's CAN and increase the attack surface of the vehicle. We perform some actions on the vehicle (such as pressing the accelerator pedal) and capture messages on the CAN bus at the same time. Afterward, we use an ADAS device to replay these CAN messages and to observe whether the vehicle triggers the corresponding action while replaying the messages. Suppose the vehicle takes the corresponding actions, which indicates that the ADAS BOF vulnerability can interfere with the vehicle's operation. This attack extends the threat from the digital world to the physical world.  
Figure 12 presents our experimental environments. We connect a PC to the ADAS via an Ethernet interface (shown by the blue line) and use a CAN analyzer to connect the ADAS's CAN interface to our PC. The purpose of the CAN connection is to capture the communication traffic. The ADAS device is connected to the high-speed CAN bus.  
In this research, by studying and analyzing multiple ADAS devices, we found that ADAS devices are often deeply customized based on the Linux system. Most of them use the Socket CAN module to communicate with the vehicle's CAN bus (the corresponding interface can be seen through the ifconfig command, as shown in Figure 13). The application program calls this interface to send and receive CAN data frames.  
We first connect the CAN analyzer to the ADAS's CAN interface and start capturing CAN messages using the corresponding software, as shown in Figure 14. During this process, we perform mechanical operations from the driver's seat, such as stepping on the accelerator pedal. We then export the captured CAN messages and save them as a CSV file during this process.  
Figure 12: Topology diagram of experimental environment.  
Figure 13: ADAS device executing the ifconfig command.  
In Section 4.2, we gained console privileges through ROP and achieved RCE. Additionally, we know that the CAN protocol does not directly support secure communication. In this situation, we exploited the BOF vulnerability on the ADAS to execute a program (as shown in Figure 15) that reads CAN messages from the CSV file and sends them to the vehicle via the SocketCAN module in the ADAS. After running the program to send CAN messages from the CSV file, we observed the vehicle's reaction and confirmed that the wheels turned (as shown in Figure 16).  
This result proves the feasibility of obtaining device control through an ADAS BOF vulnerability and sending CAN messages to a vehicle through an ADAS device. Moreover, this means that hackers can disturb a vehicle's operation with the use of an ADAS with BOF vulnerabilities when the network is reachable. This extends the threat from the digital world to the physical world. Our experiment relies on the assumption that the ADAS has network accessibility. If an attacker connects to the in-car Ethernet using either T-box or Bluetooth, it can result in a privacy breach for the users [19]. By employing the method proposed in Section 4.2 to exploit the BOF vulnerability in the ADAS and gain control privileges, the attacker can use the ADAS to remotely control the vehicle by sending CAN commands. This can be achieved without physical contact with the vehicle and on the basis of the analysis of the CAN protocol.  
Figure 16: Changes in wheel position before and after sending CAN messages.  
Figure 14: Collecting data from the vehicle CAN.  
Figure 15: A program to send CAN frames through SocketCAN.