Cybersecurity of Firmware Updates DISCLAIMER
Total Page：16
File Type：pdf, Size：1020Kb
DOT HS 812 807 October 2020 Cybersecurity of Firmware Updates DISCLAIMER This publication is distributed by the U.S. Department of Transportation, National Highway Traffic Safety Administration, in the interest of information exchange. The opinions, findings, and conclusions expressed in this publication are those of the authors and not necessarily those of the Department of Transportation or the National Highway Traffic Safety Administration. The United States Government assumes no liability for its contents or use thereof. If trade or manufacturers’ names are mentioned, it is only because they are considered essential to the object of the publication and should not be construed as an endorsement. The United States Government does not endorse products or manufacturers. Suggested APA Format Citation: Bielawski, R., Gaynier, R., Ma, D., Lauzon, S., & Weimerskirch, A. (2020, October). Cybersecurity of Firmware Updates (Report No. DOT HS 812 807). National Highway Traffic Safety Administration. Technical Report Documentation Page 1. Report No. 2. Government Accession No. 3. Recipient's Catalog No. DOT HS 812 807 4. Title and Subtitle 5. Report Date Cybersecurity of Firmware Updates October 2020 6. Performing Organization Code 7. Authors 8. Performing Organization Report No. Russ Bielawski, Ron Gaynier, Dr. Di Ma, Sam Lauzon, and Dr. André Weimerskirch 9. Performing Organization Name and Address 10. Work Unit No. (TRAIS) Transportation Research Institute 11. Contract or Grant No. University of Michigan (Ann Arbor, MI) DTNH22-15-R-00104 Vehicle University of Michigan-Dearborn Electronics Systems Safety IDIQ Volkswagen Group of America (Herndon, VA) 12. Sponsoring Agency Name and Address 13. Type of Report and Period Covered National Highway Traffic Safety Administration Final Report 1200 New Jersey Avenue, SE 14. Sponsoring Agency Code Washington, DC 20590 15. Supplementary Notes 16. Abstract Over-the-Air (OTA) software and firmware updates are widely considered essential for networked devices. In the automotive industry, OTA firmware updates are anticipated to increase the efficiency and decrease the time in updating the critical firmware in vehicles’ electronic control units (ECUs). This project had these objectives: understand the scope and relevant attributes of firmware updates, understand their vulnerabilities and update solutions, understand mitigation methods for those vulnerabilities, and learn from adjacent industries. The report first presents a literature and technology review of the state-of-the-art of software updates in industries related to automotive, including the commercial aviation, medical, and consumer electronics industries. Next it identifies and assesses software update functionality risks in current and near-term future automobiles. Finally, it reviews mitigation methods to address those risks. In addition, this report describes the SAE AS5553A voluntary standard for the detection of and protection against counterfeit electronic parts in the aerospace industry and how it relates to the automotive industry. 17. Key Words 18. Distribution Statement Over-the-Air, Updates, Firmware, Software, This document is available to the public through ECU (Electronic Control Unit), Automotive, the National Technical Information Service, Network, Theft, Counterfeit, SAE AS5553A www.ntis.gov. 19. Security Classif. (of this report) 20. Security Classif. (of this page) 21. No. of Pages 22. Price Unclassified Unclassified 103 Form DOT F 1700.7 (8-72) Reproduction of completed page authorized i Executive Summary Over-the-Air (OTA) software and firmware updates are widely considered essential for networked devices. In the automotive industry, OTA firmware updates are anticipated to increase the efficiency and decrease the time in updating the critical firmware in vehicles’ electronic control units (ECUs). There is a demand to better understand firmware and software updates, particularly for embedded systems, and how to implement them securely. This work had the following objectives. • Understand the scope and relevant attributes of firmware updates • Understand the vulnerabilities of firmware update solutions • Understand the mitigation methods for those vulnerabilities • Learn from adjacent industries The report first presents a literature and technology review of the-state-of-the-art of software updates in industries related to automotive, including the commercial aviation, medical, and consumer electronics industries. Next it identifies and assesses the risks presented by software update functionality in current and near-term future automobiles. Finally, it gives a review of the mitigation methods to address those risks. In addition, this report describes the SAE AS5553A voluntary standard for the detection of and protection against counterfeit electronic parts in the aerospace industry and how it relates to the automotive industry. Summary of Lessons Learned in Adjacent Industry: Common existing defense mechanisms (e.g., signing, fortification, and intrusion detection) and vulnerabilities are noted in the body of the report as are potential defenses for secure vehicle firmware updates. Risk Assessment Conclusions: In identifying risks at both the vehicle-level and the technological design and implementation level, the researchers have identified the biggest risk with software update mechanisms as malware installation. Mitigation Methods Conclusions: In-field software updates are a necessity in the automotive industry to fix flaws without replacing hardware that is already deployed in the field. The current generation of automobiles primarily uses OTA software updates for telematics and infotainment ECUs only. While software updates are a boon for security, the mechanism, particularly the remote mechanism, creates a new avenue for attackers to exploit. A matrix of specific mitigations versus risks appears in the report (see Table 17). Intellectual Property Theft Risks and Mitigations Conclusions: Intellectual property theft, particularly software theft, can be enabled and made easier with software update mechanisms, particularly OTA mechanisms. In discussions with the original equipment manufacturer (OEM) and tier-1 supplier employees, the majority opinion is that protecting the software binaries is not a priority. The prevailing opinion in the industry is that ii there are too many other ways for an adversary to obtain a software binary to justify the cost of adding encryption to the software update process. Counterfeit and Fraudulent Electronic Parts and Products Conclusions: Fraudulent and counterfeit parts can pose a safety and monetary liability risk. SAE AS5553A is an aerospace standard for the creation of processes for detection, prevention, mitigation, and disposition of suspect, fraudulent, and counterfeit electronic parts. In general, SAE AS5553A should apply to the automotive industry quite readily. It is designed to be flexible and risk- informed. The requirements themselves should be applicable to the automotive industry; however, a more tailored collection of best practices might be reasonable to develop for the automotive sector specifically (not developed within this project). Final Conclusions: Secure in-field software updates are nearly universally considered to be essential for any networked computer system. However, software update functionality creates a new attack surface for attackers to potentially exploit. The installation of malware is one of the biggest risks for software updates. There is no singular, perfect reference model for securing software updates. Every system has different requirements and user experience targets that shape the design enough to require security to be at a minimum analyzed and usually designed with an application-specific approach. While software updates have a large surface from which vulnerabilities can potentially spring, many of the mitigations are known. Software update functionality can be attacked at many different places in the distribution process. And, while technical risks exist, many of the risks are social (such as lost passwords, etc.) in nature. The benefit of reliable, prompt software updates for in-field electronics is significant. iii Table of Contents Executive Summary ........................................................................................................ ii Summary of Lessons Learned in Adjacent Industry: ............................................... ii 1. Introduction ............................................................................................................... 1 2. Background, Definitions, and Literature Review ....................................................... 2 2.1 Background ......................................................................................................... 2 2.2 Software Update: Overview and Definitions ........................................................ 2 2.2.1 Current automotive software update mechanism and best practices. ............ 3 2.3 Step-By-Step: The OTA Software Update Process ............................................... 5 2.3.1 Packaging. .................................................................................................. 6 2.3.2 Transport. ................................................................................................... 6 2.3.3 Reception. ................................................................................................... 6 2.3.4 Installation. ................................................................................................