Educator: Vehicular Vulnerabilities. 2 2
In this lesson, 3 3
we're going to talk about planes, trains, and automobiles. 4 4
Well, not really. 5 5
We're going to talk about automobiles 6 6
and unmanned aerial vehicles 7 7
and any other vehicular thing that could be controlled 8 8
by some kind of a computer. 9 9
Now, these days, cars are getting smarter and smarter. 10 10
For instance, we have cars like Tesla that drive themself. 11 11
They use sensors around the car. 12 12
They take that information back to a centralized computer, 13 13
and then they adjust your steering for you 14 14
or your speed for you based on what they're sensing. 15 15
All of this is done by computers and by code, 16 16
which means it's dangerous, right? 17 17
Because all of this stuff 18 18
could have software vulnerabilities. 19 19
Now, these car manufacturers are doing their best 20 20
to try to keep these as safe and secure as possible, 21 21
but a lot of things and a lot of older vehicles 22 22
are extremely vulnerable. 23 23
So we have to talk about that 24 24
as we think about security at large 25 25
because you might have a corporate fleet of vehicles 26 26
and they might have some of these vulnerabilities. 27 27
Now, when we think about vehicles, 28 28
these vehicles all have lots of different systems on them. 29 29
These systems all have to connect some way. 30 30
And so we take all these different subsystems, 31 31
like the HVAC, and the steering, and the cruise control, 32 32
and all of these different functions, 33 33
and they all get passed 34 34
over what's called a controller area network, or a CAN. 35 35
Don't confuse this 36 36
with the CAN you learned about back in Network+, 37 37
where we talk about campus area networks, 38 38
this is a controller area network. 39 39
Now, when you talk about a controller area network, 40 40
this is a digital serial data communications network 41 41
that's used within a vehicle. 42 42
Now, if you look at an airplane, for instance, 43 43
they have miles and miles of cabling, 44 44
and all that cabling connects together. 45 45
That is a CAN. 46 46
In your car, the same thing, 47 47
just not as large or not as a big of an extent. 48 48
Now, when we start talking 49 49
about how we can talk to this CAN network, 50 50
how can we as somebody in the car reach into it? 51 51
Well, the primary method that we use is known as an OBD-II, 52 52
which is an Onboard Diagnostics module. 53 53
Now, this is something that was put in all cars 54 54
starting in about the 1990s. 55 55
And the reason for this 56 56
was as we started having onboard computers in the cars 57 57
and we got things like a check engine light, 58 58
and you want to know how do you check the engine? 59 59
Well, you plug in something into the OBD-II port 60 60
and that's going to end up coming back with a code 61 61
that tells you what's wrong. 62 62
That's what the port was originally designed for 63 63
but these days, it can be used for a lot more. 64 64
Now, when we look at a CAN bus, 65 65
this operates a lot like ethernet does. 66 66
If you think back to the way I talked about ethernet 67 67
all the way back in Network+, 68 68
we talked about the fact that ethernet was developed 69 69
with the idea that everybody on there was trusted 70 70
and so we didn't have to have a lot of security. 71 71
And CANs are built the same way. 72 72
Again, they're a contentious network, 73 73
where people are going to take turns talking, 74 74
and if not, there's going to be collisions 75 75
and they're going to have to repeat. 76 76
This is all very similar to ethernet, 77 77
the way it works. 78 78
Now, this is because the manufacturers, 79 79
essentially, never thought 80 80
that we were going to use these systems in cars 81 81
to the fact the way we do 'em now. 82 82
These CANs were developed in the 80s and 90s. 83 83
Did anyone think about self-driving cars 84 84
back in the 80s and 90s? 85 85
Probably not. 86 86
And the things that we can do with cars these days 87 87
is amazing compared to what we could do just 30 years ago. 88 88
And so this is the idea 89 89
of what we're doing with these cars in this CAN network. 90 90
Now, if the CAN is completely isolated, 91 91
it's probably pretty secure, 92 92
but the problem is in a lot of modern vehicles, 93 93
we've actually started bringing other networks 94 94
into these cars. 95 95
Some cars have cellular built in, 96 96
some cars have Wi-Fi built in, 97 97
and this is now bringing in the WAN into our cars 98 98
and bringing the outside world in, 99 99
which could also bring in vulnerabilities. 100 100
So, essentially, our cars have now become part 101 101
of the Internet of Things. 102 102
Now, there is no concept of source addressing 103 103
or message authentication within the CAN bus, 104 104
and this goes back to the idea of security. 105 105
So if there's no way to authenticate a message, 106 106
that means any message that goes on that CAN bus 107 107
is immediately considered trusted by the computer. 108 108
So if I can get a message into the CAN bus that says, 109 109
"Make the car go 100 miles an hour." 110 110
It's going to do it 111 111
because it's going to trust that that message was real 112 112
because it got to the CAN bus. 113 113
That's the only way it knows that something is trusted. 114 114
If the message got to the CAN bus, it must be trusted. 115 115
That's how it was designed. 116 116
And so that is a big flaw that we have in these systems. 117 117
Let me give you a good example of this. 118 118
Here's an article from a couple years ago, 119 119
and it was written by Andy Greenberg, who's a journalist. 120 120
He's a journalist for Wired Magazine. 121 121
He reported on his driving experience 122 122
while driving a Jeep 123 123
going at about 70 miles an hour outside Downtown St. Louis, 124 124
when hackers decided to start doing an exploit. 125 125
Now, he was doing this as part of an experiment 126 126
and the hackers were actually pen testers, 127 127
but let me read to you what he said. 128 128
"Though I hadn't touched the dashboard, 129 129
the vents in the Jeep Cherokee started blasting cold air 130 130
at the maximum setting, 131 131
chilling the sweat on my back 132 132
through the in-seat climate control system. 133 133
Next, the radio switched to the local hip hop station 134 134
and began blurring Skee-Lo at full volume. 135 135
I spun the control knob left 136 136
and hit the power button to no avail. 137 137
Then, the windshield wipers turned on, 138 138
and the wiper fluid blurred the glass." 139 139
And he keeps going on 140 140
with all the things the pen testers were able to do 141 141
as he was driving this vehicle 70 miles an hour 142 142
down the street, and they were able to hack into it 143 143
and do all this stuff remotely. 144 144
So if you're interested in seeing this article, 145 145
if you just type in the name of this article, 146 146
it'll come up in Google, 147 147
you can watch the video and actually see it happening. 148 148
It's pretty interesting, 149 149
and it gives you a good idea 150 150
of what we're talking about here 151 151
with the vulnerabilities of a CAN system. 152 152
So how can an attacker get into a vehicle and modify it? 153 153
Well, they have to get to the CAN bus, 154 154
and there's really three ways to do it. 155 155
One is they can do it locally. 156 156
They can attach an exploit locally to the OBD-II. 157 157
Now, you might think, 158 158
"Well, that means they have to be in the car with you." 159 159
Well, not necessarily. 160 160
You can create a plug that plugs into the OBD-II, 161 161
and most OBD-IIs are underneath the dashboard 162 162
where somebody doesn't see it visibly. 163 163
So, let's say you went to a local restaurant, 164 164
and you actually handed your car off to some valet. 165 165
While you were in there, 166 166
he could have plugged in something to the OBD-II, 167 167
and now he has a connection 168 168
that he can run an exploit from. 169 169
So, again, this is vulnerabilities 170 170
that we have to think about. 171 171
Now, another thing they can do 172 172
is they can actually exploit over the onboard cellular. 173 173
If your car has a cell modem built into it, 174 174
that means you have a connection to the outside world, 175 175
which means they have a connection to you. 176 176
Now, most cars have two networks. 177 177
They have the entertainment network 178 178
and the vehicular CAN network, and they are separated. 179 179
For instance, I have a Tesla that I drive. 180 180
It has a cell modem built in. 181 181
That runs through the entertainment system 182 182
so I can listen to the radio, 183 183
I can listen to songs over Pandora and Spotify, 184 184
and things like that. 185 185
That is one system. 186 186
And then there's the system 187 187
that controls the driving of the car. 188 188
They've built that as two separate systems 189 189
because of this vulnerability. 190 190
But if you have a manufacturer 191 191
who doesn't have a clear separation of the two, 192 192
that could be an issue. 193 193
And then the third, 194 194
you can have an exploit over the onboard Wi-Fi. 195 195
Again, a lot of cars have onboard Wi-Fi 196 196
as a feature that was added 197 197
within the last five to 10 years. 198 198
And so if I'm driving close to you 199 199
and I can reach your Wi-Fi, 200 200
and there's a link between that Wi-Fi and the CAN, 201 201
I can then get message into your CAN and cause issues. 202 202
So, again, this isn't a big area 203 203
that we as cybersecurity analysts are really going to work in, 204 204
except to know that this vulnerability exists. 205 205
For the exam, 206 206
if you can remember these three vulnerabilities, 207 207
you'll do fine when it comes to vehicle questions.