Securing Embedded Systems: Analyses of Modern Automotive Systems and Enabling Near-Real Time Dynamic Analysis
Total Page:16
File Type:pdf, Size:1020Kb
Securing Embedded Systems: Analyses of Modern Automotive Systems and Enabling Near-Real Time Dynamic Analysis Karl Koscher A dissertation submitted in partial fulfillment of the requirements for the degree of Doctor of Philosophy University of Washington 2014 Reading Committee: Tadayoshi Kohno, Chair Gaetano Borriello Shwetak Patel Program Authorized to Offer Degree: Computer Science and Engineering © Copyright 2014 Karl Koscher University of Washington Abstract Securing Embedded Systems: From Analyses of Modern Automotive Systems to Enabling Dynamic Analysis Karl Koscher Chair of the Supervisory Committee: Associate Professor Tadayoshi Kohno Department of Computer Science and Engineering Today, our life is pervaded by computer systems embedded inside everyday products. These embedded systems are found in everything from cars to microwave ovens. These systems are becoming increasingly sophisticated and interconnected, both to each other and to the Internet. Unfortunately, it appears that the security implications of this complexity and connectivity have mostly been overlooked, even though ignoring security could have disastrous consequences; since embedded systems control much of our environment, compromised systems could be used to inflict physical harm. This work presents an analysis of security issues in embedded systems, including a comprehensive security analysis of modern automotive systems. We hypothesize that dynamic analysis tools would quickly discover many of the vulnerabilities we found. However, as we will discuss, there are several challenges in applying traditional dynamic analysis tools to embedded systems. We propose and evaluate new tools to overcome these challenges. Karl Koscher i Securing Embedded Systems Table of Contents Acknowledgements ........................................................................................................................................... iv Dedication...... ................................................................................................................................................... vii Chapter 1: Introduction and Background ................................................................................................. 1 1.1. Introduction ....................................................................................................................................... 1 1.2. Background ........................................................................................................................................ 2 1.2.1. Embedded Systems ................................................................................................................... 3 1.2.2. Automobiles............................................................................................................................... 4 1.3. Related work ...................................................................................................................................... 9 1.3.1. Automotive Systems ................................................................................................................. 9 1.3.2. Security Analyses of Embedded Systems ............................................................................ 12 1.3.3. Dynamic Analysis .................................................................................................................... 20 1.3.4. Automated Analyses of Embedded Systems ...................................................................... 23 Chapter 2: Security Analysis of Internal Automotive Interfaces ......................................................... 25 2.1. Introduction and Threat Model .................................................................................................... 25 2.2. Experimental Setup ......................................................................................................................... 26 2.2.1. Experimental Environments ................................................................................................. 26 2.2.2. The CARSHARK Tool .............................................................................................................. 29 2.3. Intra-Vehicle Network Security .................................................................................................... 30 2.3.1. CAN Bus .................................................................................................................................. 31 2.3.2. CAN Security Challenges ....................................................................................................... 32 2.3.3. Deviations from Standards .................................................................................................... 36 2.4. Component Security ....................................................................................................................... 40 2.4.1. Attack Methodology ............................................................................................................... 41 2.4.2. Stationary Testing ................................................................................................................... 42 2.4.3. Road Testing ............................................................................................................................ 46 2.5. Multi-Component Interactions ..................................................................................................... 48 2.5.1. Composite Attacks .................................................................................................................. 49 2.5.2. Bridging Internal CAN Networks ........................................................................................ 50 2.5.3. Hosting and Wiping Code ..................................................................................................... 51 2.6. Discussion and Conclusions .......................................................................................................... 52 ii Acknowledgements 2.6.1. Diagnostic and Reflashing Services ...................................................................................... 55 2.6.2. Aftermarket Components ...................................................................................................... 56 2.6.3. Detection Versus Prevention ................................................................................................ 56 2.6.4. Toward Security ...................................................................................................................... 57 Chapter 3: Security Analysis of External Automotive Interfaces ........................................................ 59 3.1. Introduction ..................................................................................................................................... 59 3.2. Automotive Threat Models ........................................................................................................... 61 3.2.1. Indirect Physical Access ......................................................................................................... 62 3.2.2. Short-Range Wireless Access ................................................................................................ 65 3.2.3. Long-Range Wireless .............................................................................................................. 67 3.2.4. Stepping Back .......................................................................................................................... 69 3.3. Vulnerability Analysis ..................................................................................................................... 69 3.3.1. Experimental Context ............................................................................................................ 70 3.3.2. Indirect Physical Channels ..................................................................................................... 74 3.3.3. Short-Range Wireless Channels: Bluetooth ........................................................................ 79 3.3.4. Long-Range Wireless Channels: Cellular ............................................................................. 83 3.4. Remote Exploit Control ................................................................................................................. 89 3.4.1. TPMS ........................................................................................................................................ 90 3.4.2. Bluetooth .................................................................................................................................. 91 3.4.3. FM RDS ................................................................................................................................... 91 3.4.4. Cellular ...................................................................................................................................... 92 3.5. Threat Assessment .......................................................................................................................... 92 3.5.1. Theft ......................................................................................................................................... 93 3.5.2. Surveillance .............................................................................................................................. 95 3.6. Discussions and Synthesis .............................................................................................................