Successfully reported this slideshow.
We use your LinkedIn profile and activity data to personalize ads and to show you more relevant ads. You can change your ad preferences anytime.

Attacking and Defending Autos Via OBD-II from escar Asia


Published on

This presentation from escar Asia does go into detail on the Progressive Snapshot dongle security problems, but it also addresses common issues found in ICS security and the path forward. For example the insecure by design problem, no thought on embedded product security, importance of a security perimeter as the immediate best security solution, and the medium to long term solutions.

Published in: Technology
  • Login to see the comments

Attacking and Defending Autos Via OBD-II from escar Asia

  1. 1. Attacking and Defending Autos Via OBD-II Dale Peterson, Digital Bond, Inc. @digitalbond
  2. 2. Industrial Control Systems
  3. 3. Monitor and Control A Process •  Sensors measure temperature, current, speed, flow, … •  Actuators turn things on/off, heat/cool, mix, control flow, … •  Some are controlled by humans/operators •  Others maintain steady state or goal •  Additional safety systems prevent really bad things from happening •  Sound familiar?
  4. 4. Let’s Learn From Industrial Control System (ICS) Security Struggles and Save Decades of Insecurity in the Auto Industry
  5. 5. ICS Access = Compromise •  If an attacker can gain access to almost any SCADA, DCS or other type of ICS –  He can cause components to crash –  He can control the process –  He can change the process (Stuxnet) –  He can sometimes change the Safety System (Stuxnet)
  6. 6. ICS Protocols – Insecure By Design
  7. 7. Secure By Design •  Product goes through a Security Development Lifecycle (SDL) –  Microsoft and others provide resources on this •  Threat Model determines required security controls •  Software coding practices •  Fuzz testing •  Independent 3rd Party Testing •  Well understood but takes years & effort
  8. 8. Insecure By Design Insecure By Design is not simply the lack of Secure By Design. It is much worse!!! Insecure By Design provides the attacker with everything he would want as a documented feature. There is no need to find a bug or vulnerability.
  9. 9. Insecure By Design “The pro’s don’t bother with vulnerabilities when attacking ICS. They use documented features of protocols and products.” Ralph Langner of Stuxnet fame
  10. 10. Charlie Miller / Chris Valasek 2014 •  Connected to a control system and … •  Were able to monitor and control, no surprise •  Incredibly impressive reverse engineering •  Completely unnecessary, many in this room have this knowledge •  The Safety question? –  Chuck Yeager or child jumping off roof? –  Marie Curie or blindly mixing chemicals to see what happens?
  11. 11. No Authentication •  No source or data authentication •  Access = Compromise –  Modbus TCP –  EtherNet/IP –  S7, DNP3, PROFINET, CC, HART, OPC Classic –  Proprietary Protocols – And CANBus
  12. 12. Security Perimeter is Key •  Bad guys will succeed if they get in •  Require effective security perimeter to keep them out •  ICS History –  Connected directly to corporate networks –  Some connected to the Internet –  Anytime, anywhere remote access for in house support, 3rd party support, convenience or curiosity
  13. 13. Access To Insecure By Design Car? •  Access = Compromise, so how can an attacker access the CANBus? Many ways are being found. •  Corey Thuen in Digital Bond Labs looked at insurance use of OBD-II port •  Specifically the Progressive Snapshot dongle •  Could this comms network, Snapshot device, or Progressive site be used to attack cars?
  14. 14. ICS Comparison 1.  Access = Compromise? ICS and auto 2.  Little or no thought about security in embedded components
  15. 15. Search S4 Basecamp Video
  16. 16. Snapshot Dongle
  17. 17. Analysis Environment
  18. 18. Communication – No Security •  No encryption, no authentication, no firmware signing or other security •  Attacker has unrestricted access to device if he can get to it over the cellular network or from a Progressive network
  19. 19. Software Quality •  Did not follow even the most basic secure coding practices •  Lots of strcopy and other banned functions –  Lead to overflows and other security issues •  Lacking input validation, bad behavior when fuzzed
  20. 20. Snapshot Summary •  Little or no thought to security in development by vendor (Xirgotech) or Progressive … it’s a little embedded device •  Deployed units can never be trusted •  Likely some improvements has taken place in backend servers at Progressive which is very important –  Compromising Progressive Servers could allow access and control to 2,000,000+ vehicles
  21. 21. ICS Comparison 1.  Access = Compromise? ICS and auto 2.  Little or no thought about security in embedded components? ICS and auto 3.  Push historical data out?
  22. 22. GE Power Plant Turbine Monitoring •  1800+ Turbines in 60+ countries from GE Atlanta –  Useful efficiency and preventive maintenance info
  23. 23. GE Power Plant Turbine Monitoring •  Communications from Atlanta includes firewalls, encryption, two-factor authentication, background checks, secure facility and more •  From that location in Atlanta they can access (and control) 1800+ turbines in 60+ countries •  A HUGE target and … •  Control is not necessary, all GE needs is the data –  Sound familiar to insurance companies?
  24. 24. Implement Least Privilege •  Only allow what is required •  Some solutions for GE and OBD-II –  Unidirectional (one-way) gateway, data can be sent from the car out, but no comms allowed to the car –  Limited functionality, allow reads / data access but no control commands –  Have the equivalent of a historian on the vehicle that the OBD-II can access •  Evaluate the residual risk
  25. 25. ICS and Vehicle Risk Comparison •  End unit compromise –  Much greater for critical infrastructure ICS –  Widespread blackout, lack of gas, environmental damage, death –  Vehicle compromise could be tragic, but limited •  Greater risk to vehicles is compromise of concentrated remote access with control capability –  Benefits are greater in vehicles, but make sure your risk management includes cyber
  26. 26. ICS Comparison 1.  Access = Compromise? ICS and auto 2.  Little or no thought about security in embedded components? ICS and auto 3.  Push historical data out? ICS today / auto future? 4.  Control / Safety segregation
  27. 27. Safety Integrated Systems (SIS) •  Prevent really bad things from happening, automatically, all the time, even when the control system fails, no human interaction •  Problem: If control system can communicate with the SIS a cyber attack can compromise both –  Stuxnet Protection system to prevent overpressure •  Problem: Control Systems often want sensor data from the safety system
  28. 28. Increasingly Common Solution •  Install an ICS firewall that only allows read requests from ICS to SIS –  ICS can’t write to SIS, can’t change logic, load firmware or do anything but read points •  Solution for cars … restrict communications between modules –  Focus on protecting modules with most critical control –  Focus on limiting access from modules with remote access –  Much faster solution than developing secure CAN
  29. 29. Develop Secure CAN or Replace with Secure Protocol Don’t fall for the “this will take a decade” like the ICS world did!
  30. 30. Digital Bond CANBus Tools •  Digital Bond Labs tools are on GitHub – •  canbus-utils for analyzing CANBus traffic •  canbus-beaglebone for low-cost testing platform •  canbus-protector includes some proof of concept fixes discussed in this session
  31. 31. Digital Bond •  S4xJapan … November 6th in Tokyo •  S4x16 … January 12-14 in Miami Beach •  Focused control system security company •  Consulting –  Dedicated ICS security team since 2003 •  Labs –  Find new vulnerabilities and attack techniques •  Contact: Dale Peterson, @digitalbond on twitter
  32. 32. Questions