The scope of this research is identifying vulnerabilities in automotive CAN networks, using fuzzing techniques. Automotive Security has gained importance as more automatic features that could potentially be exploited became more common. Examples include automatic parking, radar-driven cruise control and collision prevention, all instances where electronics take control of some elements of the car. In the automotive domain, the CAN protocol is mainly used for the ECUs’ underlying bus network[1]”uri”:[“http://www.mendeley. com/documents/?uuid=56a7c566-e763-49b4-b938-88ac4f51 c499”],”itemData”:{“DOI”:”10.1109/SIES.2012.6356590”,”ISBN”:”9781467326841”,”abstract”:”Controller Area Network (CAN. While research on automotive security has been performed, the use of fuzzing in this area is still an area of active research. This research attempts to evaluate its appropriateness for automotive applications, by proposing an intelligent sniffing/fuzzing process and evaluating its effectiveness using a purpose-built prototype implementation. The proposed technology sniffs CAN traffic over the CAN network of a vehicle and watches for changes in the values of the various CAN messages being transmitted, both in terms of their IDs as well as their contents. This data can then be analysed and the list of CAN IDs with the corresponding value changes deducted. This list can then be used to devise fuzz attacks either by manually selecting which bytes are randomly fuzzed or whether they will be fuzzed using values that have been observed in sniffed traffic and hence are deemed to be legitimate. The results show that fuzzing can be effective in detecting CAN network vulnerabilities. While more work needs to be done in this direction, such as the automatic detection of counters and their intelligent fuzzing, the results of this research suggest that fuzzing is indeed a useful technique in automotive security research.
References
[1] R. Kammerer, B. Frömel, and A. Wasicek, “Enhancing security in CAN systems using a star coupling router,” 7th IEEE Int. Symp. Ind. Embed. Syst. SIES 2012 – Conf. Proc., pp. 237–246, 2012.
Student: Ezekiel Bajada
Supervisor: Dr Clyde Meli
Course: B.Sc. IT (Hons.) Software Development