Today, the number of the vehicles which are connecting to the internet directly is rapidly increasing. Accordingly the architecture of modern vehicles are rapidly dramatically changing. We have to keep up with the speed of that. But recently some vulnerabilities due to the lacking of basic security counter measures are reported. Now the time to integrate security and safety, hardware and software has come. This session will provide what’s going on inside and outside of modern vehicles in terms of security and safety.

3. Softwarelization

4. https://informationisbeautiful.net/visualizations/million-lines-of-
code/

8. Software is not protected

16. Most of the ECU is poor spec…
Obfuscation, Encryption, Hash Validation…

17. CASE

20. Airplane : Fly by Wire
Automobile : Drive by Wire
Recent Vehicles are already
Controlled by Network

22. Direct
Attack
System
Sniffing
Tempering
DoS
Network
Wireless
Connection
Jamming
Supply
Chain Risk
Vulnerability
Physical
Hacking
Application
Vehicle

23. Case Study

24. ・1.4M Jeeps were recalled
6667/TCP was opened
Controller
(V850)
Accessed with
Management Tool
Power Train
Recognized as proper
order
Linux
(OMAP)
Got root by breaking
the password
Overwrite Firmware
Cellular Network

25. ・After connected to AP, Tesla automatically reload the web page browser already
opened.
・QtCarBrowser used old verseion 「WebKit」 as engine.
・CVE-2011-3928 was existing.
・Utilizing 「CVE-2013-6282」, to disable AppArmor.
・Overwrite firmware on controller.

26. Summary

28. Direct
Attack
System
Sniffing
Tempering
DoS
Network
Wireless
Connection
Jamming
Supply
Chain Risk
Vulnerability
Physical
Hacking
Application
Vehicle

29. ・1.4M Jeeps were recalled
6667/TCP was opened
Controller
(V850)
Accessed with
Management Tool
Power Train
Recognized as proper
order
Linux
(OMAP)
Got root by breaking
the password
Overwrite Firmware
Cellular Network

30. Thank you !
Let’s fight together !