dragosr@dragosr
Apropos of Automotive Security. Ironically, it's one of the focus areas of our presentations this year at CanSecWest.
CanSecWest 2024 Presentation:
Death By A Thousand Cuts: Compromising Automotive Systems via Vulnerability Chains
Linfeng Xiao
The intersection of new energy vehicles, intelligent networking, and traditional automotive manufacturing has significantly blurred the lines between cybersecurity and physical security. As vehicles become increasingly connected, the paradigm of threats has shifted from physical attacks, such as those on car keys, to sophisticated cyber attacks originating from the internet. This change raises a critical question: are modern vehicles equipped to fend off such cyber threats effectively?
Our research aims to demonstrate the feasibility of remotely compromising a new energy vehicle without any physical interaction. With over 11 million new energy vehicles produced and sold globally, we embarked on a black box security analysis across various models. This journey took us from an initial lack of debugging access to successfully creating exploit chains that leverage multiple vulnerabilities for vehicle theft. Our methodology highlights the intricate process of identifying and chaining together remote code execution (RCE) and privilege escalation vulnerabilities to gain unauthorized control over the vehicle.
We delve into the technical specifics of discovering multiple RCE and privilege escalation vulnerabilities across different vehicle models and how these can be exploited via in-vehicle communication technologies. Our findings illustrate the potential for post-exploitation manipulation of critical vehicle components, including doors and windows, and even circumventing the Passive Entry Passive Start (PEPS) system. By expanding the attack surface for contactless assaults, we emphasize the broad implications of RCE vulnerabilities. The presentation concludes with an analysis of the current state of new energy vehicle security, offering targeted recommendations to automakers for enhancing their vehicles' resilience against cyber threats.
secwest.net
