CANflict: Exploiting Peripheral Conflicts for Data-Link Layer Attacks on Automotive Networks

Alvise de Faveri Tron,Stefano Longari,Michele Carminati,Mario Polino,Stefano Zanero

DOI: https://doi.org/10.1145/3548606.3560618

2022-09-20

Abstract:Current research in the automotive domain has proven the limitations of the CAN protocol from a security standpoint. Application-layer attacks, which involve the creation of malicious packets, are deemed feasible from remote but can be easily detected by modern IDS. On the other hand, more recent link-layer attacks are stealthier and possibly more disruptive but require physical access to the bus. In this paper, we present CANflict, a software-only approach that allows reliable manipulation of the CAN bus at the data link layer from an unmodified microcontroller, overcoming the limitations of state-of-the-art works. We demonstrate that it is possible to deploy stealthy CAN link-layer attacks from a remotely compromised ECU, targeting another ECU on the same CAN network. To do this, we exploit the presence of pin conflicts between microcontroller peripherals to craft polyglot frames, which allows an attacker to control the CAN traffic at the bit level and bypass the protocol's rules. We experimentally demonstrate the effectiveness of our approach on high-, mid-, and low-end microcontrollers, and we provide the ground for future research by releasing an extensible tool that can be used to implement our approach on different platforms and to build CAN countermeasures at the data link layer.

Cryptography and Security

What problem does this paper attempt to address?

The problem that this paper attempts to solve is to carry out an attack on the CAN bus data link layer in the automotive network by exploiting pin conflicts between microcontroller peripherals. Specifically, the paper proposes a new method named CANflict, which allows reliable manipulation of the data link layer of the CAN bus from a remotely compromised ECU, only by software means without relying on specific hardware modifications. This method overcomes the problems of insufficient precision or the need for high - performance hardware faced by existing technologies when performing advanced data link layer attacks, and does not require strong assumptions about the target CAN traffic, because it provides powerful read - write primitives that can be used in combination to initiate current and future attacks.

The main contributions of the paper include:
- Proposing a new, software - only method that can reliably and accurately read and inject bits on the CAN bus, bypassing the limitations of the CAN controller;
- Demonstrating how to initiate data link layer attacks using remotely compromised ECUs, making remote data link layer attacks a reality;
- Proving that complete CAN frames that fully conform to CAN timing and format specifications can be generated, using the concept of polyglot frames;
- Releasing an extensible framework that can read and write arbitrary bits on different microcontrollers and peripherals, and can be extended to the research of other hardware and protocols in the future.

The paper verifies the effectiveness of its method through experiments, shows the possibility of implementing attacks on different levels of microcontrollers, and provides a tool to support further research. This not only reveals the potential weaknesses in the security of the CAN bus, but also provides new ideas for the development of future security measures.