"Cars hacked through wireless tire sensors" Another paper plus USENIX SEC10 proceedings

[David G. Koontz]

What looks like to be an applicable paper.  Not the same set of authors as
the earlier reference to USENIX.

Experimental Security Analysis of a Modern Automobile
Karl Koscher, Alexei Czeskis, Franziska Roesner, Shwetak Patel, and
Tadayoshi Kohno
Department of Computer Science and Engineering University of Washington
Seattle, Washington 98195–2350 Email:
{supersat,aczeskis,franzi,shwetak,yoshi}@cs.washington.edu
Stephen Checkoway, Damon McCoy, Brian Kantor, Danny Anderson, Hovav Shacham,
and Stefan Savage
Department of Computer Science and Engineering University of California San
Diego La Jolla, California 92093–0404 Email:
{s,dlmccoy,brian,d8anders,hovav,savage}@cs.ucsd.edu


Abstract—  Modern automobiles are no longer mere mechanical devices; they
are pervasively monitored and controlled by dozens of digital computers
coordinated via internal vehicular networks. While this transformation has
driven major advance- ments in efficiency and safety, it has also introduced
a range of new potential risks. In this paper we experimentally evaluate
these issues on a modern automobile and demonstrate the fragility of the
underlying system structure. We demonstrate that an attacker who is able to
infiltrate virtually any Electronic Control Unit (ECU) can leverage this
ability to completely circumvent a broad array of safety-critical systems.
Over a range of experiments, both in the lab and in road tests, we
demonstrate the ability to adversarially control a wide range of automotive
functions and completely ignore driver input — including disabling the
brakes, selectively braking individual wheels on demand, stopping the
engine, and so on. We find that it is possible to bypass rudimentary network
security protections within the car, such as maliciously bridging between
our car’s two internal subnets. We also present composite attacks that
leverage individual weaknesses, including an attack that embeds malicious
code in a car’s telematics unit and that will completely erase any evidence
of its presence after a crash. Looking forward, we discuss the complex
challenges in addressing these vulnerabilities while considering the
existing automotive ecosystem.

Appears in 2010 IEEE Symposium on Security and Privacy. See
http://www.autosec.org/ for more information.

http://www.autosec.org/pubs/cars-oakland2010.pdf

There's also a FAQ on the paper:  http://www.autosec.org/faq.html


Add electronic throttle and steer by wire (ala Lexus LS460) and I see an App
Store app getting popular for those James Bond back seat drivers.

The USENIX Security Symposium http://www.usenix.org/events/sec10/tech/
lists the paper referenced in Ars Technia under Real-World Security as

Security and PRivacy Vulnerabilities of In-Car Wireless Networks: A Tire
Pressure Monitoring System Case Study (P. 323)

Ishtiaq Rouf, University of South Carolina, Columbia; Rob Miller, Rutgers
University; Hossen Mustafa and Travis Taylor, University of South Carolina,
Columbia; Sangho Oh, Rutgers University; Wenyuan Xu, University of South
Carolina, Columbia; Marco Gruteser, Wade Trappe, and Ivan Seskar, Rutgers
University

The USENIX SEC10 Paper
Security and Privacy Vulnerabilities of In-Car Wireless Networks: A Tire
Pressure Monitoring System Case Study

Ishtiaq Rouf et. al. is available at:
http://www.usenix.org/events/sec10/tech/full_papers/Rouf.pdf

It is also found in the two page layout PDF of the USENIX SEC10 proceedings
http://www.usenix.org/events/sec10/tech/
at:

http://www.usenix.org/events/sec10/tech/full_papers/security10_proceedings.pdf
 (20 MB)
http://www.usenix.org/events/sec10/tech/full_papers/sec10_errata.pdf

(Referred papers are available individually)

or the epub versions:
http://www.usenix.org/sec10/epub  (16 MB)
http://www.usenix.org/events/sec10/tech/full_papers/USENIX_Security10_Errata.epub

Readable with the Firefox EPUBReader add-on the epub is not encrypted
meaning you can extract quotes or cites easily and access the papers as HTML
files found in the epub (zip) archive.  The quality is excellent.

Also in  a mobi version, the proceedings are just chocka full of other
interesting things, too.



---------------------------------------------------------------------
The Cryptography Mailing List
Unsubscribe by sending "unsubscribe cryptography" to majordomo at metzdowd.com