CAN Injection Hacking: Unraveling the Veins of Automotive Vulnerabilities

CAN Injection Hacking: Unraveling the Veins of Automotive Vulnerabilities

Speakers: Péter Vágvölgyi

Conference: Hacktivity

YouTube: https://www.youtube.com/watch?v=OXWHd0-2L20

Overview

In an era where vehicles are increasingly reliant on sophisticated electronic systems, the talk "CAN Injection Hacking: Unraveling the Veins of Automotive Vulnerabilities" by Péter Vágvölgyi at Hacktivity 2023 shed critical light on a severe cybersecurity risk facing the automotive industry. As modern cars integrate more electrical devices for enhanced user experience and functionality, the focus on cybersecurity has regrettably lagged, creating fertile ground for exploitation. This presentation delves into the fundamental vulnerabilities of the Controller Area Network (CAN) protocol, the backbone of in-vehicle communication, and exposes how a specific injection attack discovered in 2022 can compromise critical vehicle functions.

The core of Vágvölgyi's discussion centers on how external attackers can exploit inherent weaknesses in the CAN bus architecture to inject malicious messages, effectively taking control of various Electronic Control Units (ECUs). This vulnerability, demonstrated to allow actions ranging from unlocking doors to starting the engine, underscores a pressing concern for vehicle manufacturers, cybersecurity professionals, and car owners alike. The talk not only dissects the technical mechanics of such an attack but also proposes crucial defensive strategies, emphasizing the urgent need for robust authentication and hardware-based security measures to safeguard automotive systems against sophisticated cyber threats.

Background

▶ Watch: CAN protocol: internal vehicle communication overview (0:45)

The proliferation of electrical devices in modern vehicles, from sophisticated infotainment systems to advanced driver-assistance features, necessitates a robust internal communication network. The Controller Area Network (CAN) protocol emerged as the industry standard for this purpose, facilitating communication between various Electronic Control Units (ECUs), sensors, and actuators. CAN operates as a serial type communication, transmitting data bit by bit, and employs a bus topology, meaning there is no master-slave relationship; all ECUs can send and receive data. Communication occurs over two wires, CAN high and CAN low, with each message comprising a unique ID and the message content itself. Critically, only the ECU with the corresponding ID is intended to act on a given message.

Historically, older vehicles relied on extensive wiring harnesses, with separate battery wires for components like blinkers and headlights, leading to complex and costly designs. CAN communication drastically reduced this complexity and cost by requiring only two signal wires for numerous devices, making it an attractive solution for vehicle manufacturers. However, this efficiency came at a potential security cost. The CAN bus is a half-duplex system, allowing only one device to communicate at a time, and notably lacks inherent synchronization or authentication mechanisms for messages. While it boasts robust noise protection (maintaining voltage differences between CAN high and CAN low to define logical zero and one), its design primarily prioritized reliability and cost-effectiveness over security.

A significant vulnerability emerged in 2022, where hackers identified a critical "gap" in the CAN communication of certain vehicle types. This flaw allowed an external CAN injector to connect directly to the vehicle's internal network, bypassing traditional security layers and gaining unauthorized access to ECUs. Vágvölgyi illustrated this with an example topology where a "problematic ECU," such as the headlight unit, is connected on the same CAN line as sensitive components like the smart key and door control ECUs. Alarmingly, the Gateway, which routes CAN messages between different network segments (e.g., control canvas, powertrain canvas, autonomy canvas), was found to pass messages "back and forth... doesn't matter how it's a fake message or it's a validated message." This permissive behavior allowed unauthorized messages, including those targeting engine control, to propagate through the network, highlighting a fundamental flaw in the network's security architecture.

Earlier iterations of CAN also suffered from design weaknesses, such as a CAN wakeup signal that was merely an edge on the bus. This led to humorous but concerning incidents, like vehicles parked near powerful radio sweeps (e.g., at airports) experiencing continuous, unintentional wake-ups, draining their batteries. While modern CAN protocols have evolved to include defined wakeup signals to mitigate such issues, the fundamental lack of message authentication remained a critical open problem, paving the way for the CAN injection attacks seen today.

Key Findings

▶ Watch: Historical CAN wakeup signal vulnerability story (6:30)

The central revelation of Péter Vágvölgyi's presentation is the practical exploitation of the CAN protocol's inherent lack of authentication through CAN injection attacks. In 2022, hackers demonstrated the ability to connect an external device directly to a vehicle's internal CAN bus, effectively becoming a trusted, albeit malicious, participant in the network. This external access allows the attacker to inject fake messages that are indistinguishable from legitimate commands originating from authorized ECUs.

A critical aspect of this attack leverages the dominant state of the CAN bus. In CAN communication, a logical zero is defined as the dominant state, which means if any ECU transmits a logical zero, it overrides any other ECU attempting to transmit a logical one. By continuously sending these dominant states, the external CAN injector can effectively burn the network, preventing all other legitimate ECUs from communicating or reporting errors. This bus dominance grants the attacker exclusive control over the communication channel, allowing them to flood the network with their forged commands without interference.

The attack specifically targets ECUs responsible for critical vehicle functions. By injecting fake messages such as "I'm a validated key, please open the door" or "I'm fully valid, please start the engine," the external device can trick the vehicle's systems into performing unauthorized actions. Vágvölgyi highlighted that a common point of compromise involves "problematic ECUs" like the headlight unit, which might share a CAN line with more sensitive components such as the smart key and door control ECUs. The vulnerability of the Gateway to indiscriminately forward messages, regardless of their authenticity, further exacerbates the problem, allowing these fake commands to reach their intended targets across different CAN segments. The speaker also mentioned that a specific, modified GBL device (a general-purpose hardware device) was used by hackers for this purpose, indicating the accessibility and relative simplicity of constructing such an attack tool.

Technical Deep Dive

▶ Watch: Step-by-step CAN injection attack explained (9:10)

The technical foundation of the CAN injection attack hinges on a deep understanding of the CAN protocol's physical and logical layers, particularly its arbitration mechanism and the concept of dominant and recessive states. The CAN bus operates using two wires, CAN high and CAN low. The voltage difference between these two lines defines the logical states: a voltage difference of approximately 0 Volts represents a logical zero, while a difference of roughly 2.5 Volts represents a logical one. Crucially, the logical zero is defined as the dominant state, and the logical one as the recessive state. This means if one ECU transmits a dominant bit (logical zero) while another transmits a recessive bit (logical one) simultaneously, the dominant bit will prevail on the bus. This arbitration mechanism is designed for collision detection and resolution, but it becomes a potent weapon in the hands of an attacker.

The attack methodology, as described by Vágvölgyi, follows a precise sequence:

1. Physical Access and Connection: The first step involves gaining physical access to the vehicle's CAN bus. This often requires removing a component like the fender to expose the wiring. An external CAN injector, such as a modified GBL device, is then physically connected to the CAN high and CAN low wires.
2. System Readiness Check: Once connected, the CAN injector typically enters a listening mode. It waits for a legitimate wakeup signal or other CAN traffic to confirm that the vehicle's ECUs are active and the system is ready for communication. This ensures the attack is launched when the vehicle is in an operational state.
3. Bus Dominance (Burning the CAN Network): This is the most critical technical step. The external CAN injector begins to continuously transmit dominant states (logical zeros) onto the CAN bus. Because a logical zero is dominant, any legitimate ECU attempting to transmit a logical one (or any message) will be overridden. This effectively silences all other ECUs on the bus, preventing them from sending messages, including error reports. The speaker referred to this as "burning the CAN network," as it renders the bus unusable for legitimate communication, giving the attacker exclusive control.
4. Activation of Extra Circuit and Message Injection: With bus dominance established, the attacker activates an "extra circuit" within their CAN injector device. This circuit is responsible for generating and sending the forged CAN messages. These messages are crafted to mimic legitimate commands, such as "I'm a valid key, please open the door" or "I'm fully valid, you can start the engine." The lack of authentication in the standard CAN protocol means that the receiving ECUs cannot distinguish these fake messages from genuine ones.
5. Exploitation of Gateway Vulnerabilities: The attack is further facilitated by the permissive nature of some vehicle Gateways. These Gateways are designed to route CAN messages between different isolated CAN segments (e.g., powertrain, body control, infotainment). If a Gateway is not configured to perform strict authentication or validation, it will simply forward the injected fake messages to other segments, allowing them to reach sensitive ECUs (e.g., engine control, door control) that might reside on a different CAN line. This broadens the attack's scope significantly.

The consequence of this detailed technical execution is profound: an attacker can remotely unlock a vehicle, start its engine, or even manipulate critical safety systems, simply by injecting carefully crafted, unauthenticated messages onto the CAN bus. This highlights a fundamental design flaw where trust is implicitly granted to all devices on the network, a paradigm that is no longer acceptable in the face of sophisticated cyber threats.

Demo / Proof of Concept

▶ Watch: Performance impact of cryptography in real-time CAN (14:20)

While Péter Vágvölgyi's presentation did not include a live, real-time demonstration of the CAN injection attack, he effectively described and illustrated the methodology, functioning as a conceptual proof of concept. The speaker detailed the steps taken by hackers to exploit the vulnerability, including the physical connection of an external CAN injector, the process of gaining bus dominance by continuously sending logical zero states, and the subsequent injection of fake messages.

Vágvölgyi specifically referenced a "GBL picture" and described the device used by hackers as "something like this device size," indicating that a physical tool, likely a modified off-the-shelf component, was indeed employed in real-world attacks. The narrative of the attack — from removing a fender to connect the device, to listening for system readiness, and then "burning" the CAN network with fake messages to open doors or start the engine — served to clearly demonstrate how the attack works and its potential impact. This detailed explanation, grounded in observed real-world incidents, served as a compelling proof of concept for the audience.

Defensive Implications

▶ Watch: Question on replay attacks and MAC randomness (16:00)

Addressing the CAN injection vulnerability requires a multi-layered approach, focusing on authentication, network segmentation, and hardware-based security. Péter Vágvölgyi outlined several critical defensive implications and solutions for automotive manufacturers and cybersecurity professionals.

1. Message Authentication Code (MAC):

The primary defense against unauthorized message injection is the implementation of a Message Authentication Code (MAC). This cryptographic technique ensures the authenticity and integrity of CAN messages.

• Sender Side: An ECU wishing to send a message generates a MAC by applying a specific algorithm to the message content, using a pre-shared key. The message and its generated MAC are then transmitted together over the CAN bus.
• Receiver Side: The receiving ECU decodes the MAC using the same algorithm and key. It then compares the received MAC with its independently generated MAC for that message. If the two MACs do not match, the message is considered forged or tampered with and is immediately rejected. This mechanism directly counters the injection of fake messages by ensuring only authenticated commands are processed. When asked about replay attacks, Vágvölgyi noted that the MAC algorithm is not easily figured out and often the messages themselves would be encrypted, making simple replay difficult without knowing the key and algorithm.

1. "Paranoid Gateway" Implementation:

The vehicle's Gateway plays a crucial role in routing messages between different CAN segments. Instead of passively forwarding all traffic, Gateways should be made "paranoid" or more intelligent.

• Error Detection: When an external device connects and attempts to "burn" the bus, it typically causes disturbances on the network, leading to bus-off errors or other error entries. A paranoid Gateway would be configured to detect these anomalies.
• Message Validation: The Gateway should then actively validate incoming CAN messages. For instance, it could reject any message originating from a segment that has recently experienced error entries, or messages that do not conform to expected patterns or authorized sources. This prevents malicious traffic from propagating across the vehicle's network.

1. Zero Trust Architecture:

Adopting a Zero Trust security model is paramount. This principle dictates that no ECU or network segment, whether internal or external, should be inherently trusted. Every communication must be authenticated and authorized before being granted access. This paradigm shift moves away from the implicit trust model of traditional CAN, requiring explicit verification for all interactions.

1. Hardware Security Module (HSM) / Automotive Secure Hardware Extension (SHE):

For robust, hardware-level security, the integration of Hardware Security Modules (HSMs) or Automotive Secure Hardware Extensions (SHEs) within ECUs is critical.

• Dedicated Hardware: An HSM is essentially a second, dedicated microcontroller embedded within the ECU's main processor.
• Secure Storage: It provides a secure environment for storing sensitive data such as certificates, keys, and other secret information, protecting them from unauthorized access or extraction.
• Cryptographic Operations: HSMs/SHEs are designed to perform cryptographic operations (like encryption and authentication) efficiently and securely. This means that even if a message is intercepted on the network, it cannot be deciphered without the proper keys stored within the HSM.
• Runtime Protection: Vágvölgyi also highlighted that HSMs include "runtime tuning detection," ensuring that cryptographic processes run securely without performance degradation, a common concern for real-time automotive systems. The HSM handles the cryptographic overhead, allowing the main ECU processor to focus on its primary functions while maintaining secure communication.

By combining these defensive strategies, the automotive industry can significantly bolster the security posture of vehicles, transforming the vulnerable "veins" of the CAN bus into a more resilient and trustworthy communication network.

Key Takeaways

• CAN Protocol's Inherent Vulnerabilities: The Controller Area Network (CAN) protocol, while efficient and cost-effective, lacks built-in message authentication, making it susceptible to injection attacks where fake messages are indistinguishable from legitimate ones.
• Bus Dominance for Attack Control: Attackers can exploit the CAN protocol's dominant state (logical zero) to effectively "burn" the bus, preventing legitimate ECUs from communicating and gaining exclusive control over the network.
• Real-World Impact of CAN Injection: External CAN injectors can be used to send forged commands, leading to unauthorized actions such as unlocking doors, starting the engine, or potentially manipulating safety-critical systems, as demonstrated by vulnerabilities found in 2022.
• Gateway as a Critical Weak Point: Permissive Gateways that indiscriminately forward messages, even unauthenticated ones, facilitate the spread of malicious commands across different CAN segments within the vehicle.
• Multi-Layered Defense is Essential: Effective countermeasures involve implementing Message Authentication Codes (MACs) for message integrity, developing "paranoid" Gateways that detect and reject suspicious traffic, and integrating Hardware Security Modules (HSMs) or Automotive Secure Hardware Extensions (SHEs) for secure key storage and cryptographic operations.
• Shift to Zero Trust in Automotive: The automotive industry must adopt a Zero Trust security model, where every communication and every device on the network is explicitly authenticated and authorized, moving away from implicit trust.

About the Speaker(s)

Péter Vágvölgyi delivered an insightful and technically detailed presentation at Hacktivity, demonstrating a profound understanding of automotive cybersecurity, specifically concerning the Controller Area Network (CAN) protocol. While his specific title and company were not detailed in the transcript, his ability to dissect complex vulnerabilities, explain intricate attack methodologies, and propose robust defensive strategies clearly positions him as an expert in the field of vehicle security and embedded systems. His talk served as a crucial warning and a call to action for the automotive industry to prioritize cybersecurity in vehicle design and implementation.