Connected Cars: Generic Hacking and Threat Model

In previous posts, we talked about what threatens the owners of connected cars and discussed ways to hack such vehicles. In this post, we will discuss the generalized hacking method and threat model for smart vehicles, resulting from the third part of our study, Driving Security Into Connected Cars: Threat Model and Recommendations .

Generalized remote hacking method

Jeep Cherokee, BMW Tesla. , , , CAN- .

:

1.  — Wi‑Fi‑. « » (MitM) , Wi-Fi.

   
   
   
   
   

2. , - . . , .

   
   
   
   
   

3. - -, , WebKit. , Linux shell .

   
   
   
   
   

4. , shell, , . root- . Linux, , , .

   
   
   
   
   

5. , , , . CAN- , , CAN- . , .

   
   
   
   
   

6. , . «» , .

   
   
   
   
   

7. , CAN- . / CAN-. , CAN- CAN-.

   
   
   
   
   

8. CAN- ID CAN-, .

   
   
   
   
   

, , . . .

, (Intelligent Transportation System, ITS). , , - / . :

• V2X, ;

  
  
  
  
  

• V2X, ;

  
  
  
  
  

• ITS;

  
  
  
  
  

• MitM- ITS;

  
  
  
  
  

• ITS;

  
  
  
  
  

• / ;

  
  
  
  
  

• ITS;

  
  
  
  
  

• MitM- ;

  
  
  
  
  

• , ;

  
  
  
  
  

• ;

  
  
  
  
  

• CAN;

  
  
  
  
  

• «» ;

  
  
  
  
  

• - ;

  
  
  
  
  

• ;

  
  
  
  
  

• ;

  
  
  
  
  

• , ;

  
  
  
  
  

• ;

  
  
  
  
  

• ;

  
  
  
  
  

• ;

  
  
  
  
  

• Shodan;

  
  
  
  
  

• , , RDS-TMC, «» .

  
  
  
  
  

• « » (DDoS) ITS;

  
  
  
  
  

• DDoS- ITS;

  
  
  
  
  

• ;

  
  
  
  
  

• ;

  
  
  
  
  

• , , SQL-, (XSS), DNS;

  
  
  
  
  

• V2X;

  
  
  
  
  

• ;

  
  
  
  
  

• V2X .

  
  
  
  
  

— , V2X- ITS ITS. , , — , .

.

, , , . , .

. DREAD, :

• (Damage potential): , ?

  
  
  
  
  

• (Reproducibility): ?

  
  
  
  
  

• (Exploitability): ?

  
  
  
  
  

• (Affected users): ?

  
  
  
  
  

• (Discoverability): , ?

  
  
  
  
  

, , .

, DREAD . :

• , 12 15;

  
  
  
  
  

•  — 8 11;

  
  
  
  
  

•  — 5 7.

  
  
  
  
  

DREAD, . , , .

, :

• 29 66% , 17% — 17% — .

  
  
  
  
  

• , , , , , , .

  
  
  
  
  

• . , / , — .

  
  
  
  
  

• .

  
  
  
  
  

• DDoS Shodan .

  
  
  
  
  

• -, , , ITS, V2X, . , , .

  
  
  
  
  

• ITS . , , .

  
  
  
  
  

ITS, V2X, . , , . , , , , SaaS, , . , ITS , , .