The CAN FD vulnerability threatens the safety of the vehicle – IT Management’s website

CAN FD extends the classic CAN bus protocol and provides faster and consistent communication between various components in most modern vehicles. However, CAN FD has a critical newly discovered vulnerability that affects millions of vehicles worldwide.

What types of threats and hacker attacks can you specifically expect here? And what specific measures are recommended to successfully close the security gap?

The Controller Area Network (CAN) bus protocol has been established as a common network and communication standard for control units in vehicles for a good 25 years. However, in today’s highly digitized vehicles, the data transmission capacity of a single CAN bus is no longer sufficient. Therefore, a new technology has been introduced with the Controller Area Network Flexible Data Rate (CAN FD) protocol, which significantly speeds up communication thanks to a larger number of data bytes per message. The protocol is primarily used to transfer critical messages between different components.

Security experts from CYMOTIVE Technologies have now discovered a flaw in the CAN FD protocol that seriously endangers the safety of almost all modern vehicles: CANCAN allows messages sent over communication protocols to be encapsulated. This allows you to smuggle a fake CAN FD message that contains the correct message. This allows components to be made to accept a closed internal message instead of the external message that was actually sent on the bus. Core: Conventional security solutions available on the market are not able to effectively mitigate this type of attack. The CANCAN vulnerability could affect any conceivable vehicle component that uses the CAN FD protocol. This also includes protocols that are currently under development such as CAN-XL.

Take this vulnerability seriously and take appropriate steps

Therefore, it is strongly recommended that all car manufacturers and their suppliers take this vulnerability seriously and take appropriate security measures. The cybersecurity research team at CYMOTIVE has developed helpful solutions that can be used to effectively counter possible attacks. These include, for example, so-called can-frame attacks, which exploit legitimate sent messages. This category also includes “bus floods” (sending high priority messages, preventing other messages from being sent), “spoofing” (sending messages that should be sent elsewhere) and “sniffing” (listening to unencrypted data for another authority ). These attacks can seriously affect the availability, authenticity and confidentiality of the system.

Detect anomalies and block malicious messages

Well thought-out intrusion detection systems (IDS) and intrusion prevention systems (IPS) can help. The former try to detect anomalies on the CANBUS. These can be based on inbound message properties such as time, CANID, and in some implementations also on the payload itself. If such an anomaly is detected, the event can be recorded. However, the attack is not effectively prevented. IPS usually includes all the functions of the said IDS, and also offers some message blocking mechanisms. Some solutions can detect the malicious message in real time and prevent it from reaching its destination. This can be done in two ways: For example, there is the possibility of acting as a man in the middle (MITM) between the attacker and the bus. As MITM, IPS is able to refuse to send malicious messages. The second option is to inject bits directly into the bus when sending a malicious message. This may mark it as invalid for processing by other components.

Leave a Comment