Carlos Sahuquillo - Car Hacking: de Angelina Jolie a Charlize Theron [rootedvlc2018]
•
1 like•439 views
Durante la charla haré una pequeña introducción a la evolución de las redes intravehiculares para terminar hablando sobre el estado del arte de la Seguridad, cómo los ladrones aprovechan algunas de estas vulnerabilidades para robar coches y algunos de los ataques más comunes que se empiezan a ver en coches conectados. También mostraré un pequeño video/demo que vamos a grabar estos días sobre cómo realizar una denegación de servicio a una centralita (ECU) de un vehículo.
Recommended
Recommended
More Related Content
Similar to Carlos Sahuquillo - Car Hacking: de Angelina Jolie a Charlize Theron [rootedvlc2018]
Similar to Carlos Sahuquillo - Car Hacking: de Angelina Jolie a Charlize Theron [rootedvlc2018] (20)
More from RootedCON
More from RootedCON (20)
Recently uploaded
Recently uploaded (20)
Carlos Sahuquillo - Car Hacking: de Angelina Jolie a Charlize Theron [rootedvlc2018]
- 1. 1 Car Hacking: De Angelina Jolie a Charlize Theron
- 2. 2 Los mecánicos de toda la vida
- 3. 3 Los mecánicos de toda la vida
- 4. 4 Los mecánicos de toda la vida
- 5. 5 Mercedes 300: El inicio
- 6. 6 ¿Qué es una ECU? • An ECU is an embedded system that controls/monitors systems in a car. • Combination of ECUs is known as the cars computer. • The cars “computer” is not one system but a large number of small subsystems connected together by a network.
- 7. 7 ¿Qué es una ECU? • More than 80 ECUs in a car. • Each ECU (Electronic Control Unit) connected in car represents a separate point of vulnerability to a cyber attack. • If one ECU is compromised, it’s a gateway to every other ECU in the vehicle. • Terabytes of data travel between vehicles, cloud networks, wearables and mobile devices, and, obviously they represent a desirable target for cybercriminals.
- 8. 8 ¿Qué es una ECU? • The CAN bus is a 30-year old architecture. CAN contains numerous vulnerabilities that are inherent in its design. • Lack of segmentation and Boundary Defense. • Lack of Device Authentication. • Unencrypted Traffic. • Security by obscurity is not security at all
- 10. 10
- 11. 11
- 12. 12 Evolución de las amenazas Early hacks Recent hacks
- 13. 13 Evolución de las amenazas • Hackers Can steal a Tesla Model S in seconds by cloning its key fob: https://www.wired.com/story/hackers-steal-tesla-model-s-seconds-key-fob/
- 14. 14 Evolución de las amenazas • A Dutch first: Ingenious BMW theft attempt: https://mrooding.me/a- dutch-first-ingenious-bmw-theft-attempt-5f7f49a96ec8
- 18. 18 Bus-off attack • Fault tolerance • 5 errors Bit error, Stuff error, CRC error, Form error, ACK error • Counters – TEC: transmit error counter – REC: receive error counter error-active bus-off error-passive TEC > 127 | REC > 127 TEC < 128 & REC < 128 TEC > 255 Reset | 128x11 recessive bits
- 19. 19 Bus-off attack 0 1 0 1 0 1 0 1 0 0 1 0 1 0 1 0 1 0 0 1 0 1 0 1 0 1 1 0 1 0 1 0 1 0 1 0 0 1 0 1 1 0 1 0 1 0 1 0 1 0 0 1 0 1 0 1 0 1 0
- 20. 20 Bus-off attack • Attack conditions –Same ID –Same time –Different data 0x107 8 0x08 0xA0 0xFE 0x04 0x80 0x00 0x00 0x04 0x107 8 0x08 0x80 0xFE 0x04 0x80 0x00 0x00 0x04 0 0 0 0 1 0 0 0 1 0 1 0 0 0 0 0 0 0 0 0 0 1 0 0 0 1 0 0 0 1 0 0 0 0 0 0 Error raised TEC1 + 8 Error raised TEC2 + 8 TEC = 128 0 0 0 0 1 0 0 0 1 0 1 0 0 0 0 1 0 0 0 1 0 0 0 1 , , , Error raised TEC1 + 8 TEC2 - 1 TEC1 = 255 Bus-off
- 22. 22 Bus-off attack (Bonus track)
- 23. 23 Central locking cansend can0 184#61A40A0009000200 cansend can0 366#0010001E80030000 cansend can0 184#2F51050118000200 cansend can0 366#0010001E80030000
- 26. 26 Park assistant • Parking operation ~ 1min – 60.000 can messages – 150 IDs ID Byte 0 Byte 1 Byte 2 Byte 3 Byte 4 Byte 5 Byte 6 Byte 7 130 EB 6A 16 00 06 00 04 80 130 8F 6B 16 00 06 00 04 80 130 9C 6C 16 00 06 00 04 80 130 CB 6D 15 00 06 00 04 80 130 01 6E 13 00 06 00 04 80 130 A2 6F 11 00 06 00 04 80 130 C5 61 0E 00 06 00 04 80
- 28. 28 GPS spoofing
- 29. 29 El futuro
- 30. 30 El futuro
- 31. 31 El futuro
- 33. 33 No parece que vaya a dejar de utilizarse http://eecatalog.com/automotive/2013/03/13/automotive-communication-protocols-preparing-for-the- future/
- 34. 34 Cómo podemos protegernos • IDPS: Real Time Detection and Neutralization – CANBUS Packet Inspection – Context Analysis – Detects malicious CAN messages using ML algorithms – Zero days detection (based on behavior) – Low delay to manage the HUGE amount of data
- 35. 35 Agradecimientos • A XXXX: por anular la garantía del coche cuando fuimos la primera vez con una ECU brickeada:
- 36. 36
- 37. 37 Muchas gracias Carlos Sahuquillo Pascual Automotive CyberSecurity Consultant @csahuqui on Twitter https://sahuquillo.org Igor Robles Puente Automotive CyberSecurity Research Engineer