The integration of the Internet of Things (IoT) devices and solutions into passenger vehicles has transformed cars into a complex system with intelligence and a platform for extending information technology possibilities. These devices communicate through in-vehicle networks that use the controller area network (CAN) as a de facto standard for the safety-critical functionality of the vehicles. One creative exploit against CAN is the bus-off attack, which uses the fault tolerance capabilities of the CAN bus to coerce a victim electronic control unit (ECU) into the bus-off state from which it is not allowed to access the bus. As a result, the victim ECU is unable to send or receive messages. The WeepingCAN attack is a stealthy variation of the bus-off attack that reduces its observability and therefore the effectiveness of detection-based mitigation. In this paper, we introduce three software-based improvements that greatly increase both the efficiency and effectiveness of the WeepingCAN attack. First, we introduce a novel zero-phase approach for synchronizing the attack. Second, we discover an alternative approach to disable retransmissions, which is a key capability of WeepingCAN, that allows the attack to be conducted from more ECUs than before. Third, we identify a transitive attack strategy that enables an attacker to target many more ECUs than originally possible. We evaluate our improvements experimentally using a CAN benchmark and find that the zero-phase synchronization improves the attack success rate from 75% to over 90% and the transitive attack strategy enables all the ECUs in the benchmark to be attacked.


    Access

    Check access

    Check availability in my library

    Order at Subito €


    Export, share and cite



    Title :

    From Weeping to Wailing: A Transitive Stealthy Bus-Off Attack


    Contributors:


    Publication date :

    2024-09-01


    Size :

    9156361 byte




    Type of media :

    Article (Journal)


    Type of material :

    Electronic Resource


    Language :

    English




    WeepingCAN: A Stealthy CAN Bus-off Attack

    Bloom, Gedare | TIBKAT | 2021


    SA-Attack: Speed-adaptive stealthy adversarial attack on trajectory prediction

    Yin, Huilin / Li, Jiaxiang / Zhen, Pengju et al. | IEEE | 2024


    Confiscating Flight Control System by Stealthy Output Injection Attack

    Dutta, Abhishek / Langbort, Cedric | AIAA | 2017


    CASAD: CAN-Aware Stealthy-Attack Detection for In-Vehicle Networks

    Nowdehi, Nasser / Aoudi, Wissam / Almgren, Magnus et al. | ArXiv | 2019

    Free access