Attacking and Defending Autos Via OBD-II

Dale Peterson, Digital Bond, Inc. peterson@digitalbond.com

@digitalbond

Industrial Control Systems

Monitor and Control A Process

•  Sensors measure temperature, current, speed, flow, …

•  Actuators turn things on/off, heat/cool, mix, control flow, …

•  Some are controlled by humans/operators •  Others maintain steady state or goal •  Additional safety systems prevent really bad

things from happening •  Sound familiar?

Let’s Learn From Industrial Control System (ICS) Security Struggles

and Save Decades of Insecurity in the Auto Industry

ICS Access = Compromise

•  If an attacker can gain access to almost any SCADA, DCS or other type of ICS –  He can cause components to crash –  He can control the process –  He can change the process (Stuxnet) –  He can sometimes change the Safety System (Stuxnet)

ICS Protocols – Insecure By Design

Secure By Design

•  Product goes through a Security Development Lifecycle (SDL) –  Microsoft and others provide resources on this

•  Threat Model determines required security controls •  Software coding practices •  Fuzz testing •  Independent 3rd Party Testing

•  Well understood but takes years & effort

Insecure By Design

Insecure By Design is not simply the lack of

Secure By Design. It is much worse!!!

Insecure By Design provides the attacker with everything he would want as a documented feature. There is no need to find a bug or

vulnerability.

Insecure By Design

“The pro’s don’t bother with vulnerabilities when attacking ICS. They use documented features of

protocols and products.”

Ralph Langner of Stuxnet fame

Charlie Miller / Chris Valasek 2014

•  Connected to a control system and … •  Were able to monitor and control, no surprise •  Incredibly impressive reverse engineering •  Completely unnecessary, many in this room have

this knowledge •  The Safety question?

–  Chuck Yeager or child jumping off roof? –  Marie Curie or blindly mixing chemicals to see what

happens?

No Authentication

•  No source or data authentication •  Access = Compromise

–  Modbus TCP –  EtherNet/IP –  S7, DNP3, PROFINET, CC, HART, OPC Classic –  Proprietary Protocols

– And CANBus

Security Perimeter is Key

•  Bad guys will succeed if they get in •  Require effective security perimeter to keep

them out •  ICS History

–  Connected directly to corporate networks –  Some connected to the Internet –  Anytime, anywhere remote access for in house

support, 3rd party support, convenience or curiosity

Access To Insecure By Design Car?

•  Access = Compromise, so how can an attacker access the CANBus? Many ways are being found.

•  Corey Thuen in Digital Bond Labs looked at insurance use of OBD-II port

•  Specifically the Progressive Snapshot dongle

•  Could this comms network, Snapshot device, or Progressive site be used to attack cars?

ICS Comparison

1.  Access = Compromise? ICS and auto 2.  Little or no thought about security in embedded

components

Search S4 Basecamp Video

Snapshot Dongle

Analysis Environment

Communication – No Security

•  No encryption, no authentication, no firmware signing or other security

•  Attacker has unrestricted access to device if he can get to it over the cellular network or from a Progressive network

Software Quality

•  Did not follow even the most basic secure coding practices

•  Lots of strcopy and other banned functions –  Lead to overflows and other security issues

•  Lacking input validation, bad behavior when fuzzed

Snapshot Summary

•  Little or no thought to security in development by vendor (Xirgotech) or Progressive … it’s a little embedded device

•  Deployed units can never be trusted •  Likely some improvements has taken place in

backend servers at Progressive which is very important –  Compromising Progressive Servers could allow access

and control to 2,000,000+ vehicles

ICS Comparison

1.  Access = Compromise? ICS and auto 2.  Little or no thought about security in embedded

components? ICS and auto 3.  Push historical data out?

GE Power Plant Turbine Monitoring

•  1800+ Turbines in 60+ countries from GE Atlanta –  Useful efficiency and preventive maintenance info

GE Power Plant Turbine Monitoring

•  Communications from Atlanta includes firewalls, encryption, two-factor authentication, background checks, secure facility and more

•  From that location in Atlanta they can access (and control) 1800+ turbines in 60+ countries

•  A HUGE target and … •  Control is not necessary, all GE needs is the data

–  Sound familiar to insurance companies?

Implement Least Privilege

•  Only allow what is required •  Some solutions for GE and OBD-II

–  Unidirectional (one-way) gateway, data can be sent from the car out, but no comms allowed to the car

–  Limited functionality, allow reads / data access but no control commands

–  Have the equivalent of a historian on the vehicle that the OBD-II can access

•  Evaluate the residual risk

ICS and Vehicle Risk Comparison

•  End unit compromise –  Much greater for critical infrastructure ICS –  Widespread blackout, lack of gas, environmental

damage, death –  Vehicle compromise could be tragic, but limited

•  Greater risk to vehicles is compromise of concentrated remote access with control capability –  Benefits are greater in vehicles, but make sure your

risk management includes cyber

ICS Comparison

1.  Access = Compromise? ICS and auto 2.  Little or no thought about security in embedded

components? ICS and auto 3.  Push historical data out? ICS today / auto future? 4.  Control / Safety segregation

Safety Integrated Systems (SIS)

•  Prevent really bad things from happening, automatically, all the time, even when the control system fails, no human interaction

•  Problem: If control system can communicate with the SIS a cyber attack can compromise both –  Stuxnet Protection system to prevent overpressure

•  Problem: Control Systems often want sensor data from the safety system

Increasingly Common Solution

•  Install an ICS firewall that only allows read requests from ICS to SIS –  ICS can’t write to SIS, can’t change logic, load

firmware or do anything but read points

•  Solution for cars … restrict communications between modules –  Focus on protecting modules with most critical control –  Focus on limiting access from modules with remote

access –  Much faster solution than developing secure CAN

Develop Secure CAN or Replace with Secure Protocol

Don’t fall for the “this will take a decade” like the ICS world did!

Digital Bond CANBus Tools

•  Digital Bond Labs tools are on GitHub –  https://github.com/digitalbond/

•  canbus-utils for analyzing CANBus traffic •  canbus-beaglebone for low-cost testing platform •  canbus-protector includes some proof of concept

fixes discussed in this session

Digital Bond

•  S4xJapan … November 6th in Tokyo •  S4x16 … January 12-14 in Miami Beach •  Focused control system security company •  Consulting

–  Dedicated ICS security team since 2003

•  Labs –  Find new vulnerabilities and attack techniques

•  Contact: Dale Peterson, peterson@digitalbond.com @digitalbond on twitter

Questions