Grey-box Analysis and Fuzzing of Automotive Electronic Components via Control-Flow Graph Extraction Andreea-Ina Radu Flavio D. Garcia
[email protected] [email protected] University of Birmingham Birmingham, United Kingdom ABSTRACT 1 INTRODUCTION Electronic Control Units are embedded systems which control the Until recently, the in-vehicle network was considered a safe, trusted functionality of a modern vehicle. The growing number of Elec- environment. Resistance against inside malicious adversaries was tronic Control Units in a vehicle, together with their increasing not considered. Vehicles have not benefited from the scrutiny that complexity, prompts the need for automated tools to test their many of the computerised systems surrounding us have, until re- security. cently. Nowadays, a vehicle has upwards of 70 Electronic Control To this end, we present EffCAN, a tool for ECU firmware fuzzing Units (ECUs) and, the manufacturer outsources the design of the via Controller Area Network. EffCAN operates on the Control Flow hardware and development of the firmware to first tier suppliers. Graph, which we extract from the firmware. The Control Flow First tier suppliers may, in turn, outsource tasks to other companies. Graph is a platform independent representation, which allows us The many stakeholders and complexities of the supply chain make to abstract from the often obscure underlying architecture. The tracking of responsibility difficult. Control Flow Graph is annotated with information about static Often, when firmware is outsourced, manufacturers receive only data comparisons that affect the control flow of the firmware. This the firmware image, which they upload to the hardware.