Manufacturers must take note of a Controller Area Network (CAN) Bus standard vulnerability that could impact the security of automobiles and other products across a range of industries.
CAN is a standard that allows communication between various mechanisms in modern cars. News of the flaw came in the form of an alert issued by the U.S. Industrial Control Systems Cyber Emergency Response Team (ICS-CERT).
About the Controller Area Network Vulnerability
The ICS-CERT alert builds on analysis from a group of Italian researchers who published a paper in 2016, titled, “A Stealth, Selective, Link-Layer Denial-of-Service Attack Against Automotive Networks.” The paper defined both possible weaknesses in CAN and the potential for denial-of-service (DoS) attacks.
These researchers also issued a proof-of-concept (PoC) exploit and a video that demonstrated how an attacker could take advantage of the vulnerability to deactivate parking sensors on an Alfa Romeo Giulietta. That exploit triggered malfunctions in CAN nodes.
ICS-CERT noted that attackers trying to take advantage of the CAN flaw would need physical access to the car. However, errant individuals with physical access and a high degree of expertise might be able to alter the flow of network traffic and run a DoS attack that interrupts vehicle functions. The severity of the attack depends upon the ease with which an external party can access an input port, usually via the onboard diagnostics standard known as ODB-II.
How to Mitigate Risks
In addition to security researchers, ICS-CERT has contacted some of the vendors who could be impacted by the flaw — especially those in the car manufacturing and health care sectors — to help outline mitigation techniques.
This type of CAN attack might be harder to detect than other potential vulnerabilities, which are often picked up by intrusion detection and prevention systems. ICS-CERT hoped that its recently published alert will help affected firms to identify potential mitigation, reducing the risk from both this CAN vulnerability and other cybersecurity threats.
Best practice would be to reduce access to input ports on cars, particularly ODB-II, since the total impact of the vulnerability is tightly related to the presence of security controls. Businesses that witness suspicious activity should report any results to ICS-CERT.
The Future of Connected Vehicles
In a white paper, senior security consultant Corey Thuen reported that attackers can exploit numerous vulnerabilities in the technology systems of modern cars. Interestingly, his research found that more than one-quarter (27 percent) of vulnerabilities can be used to exploit the CAN protocol, leading to control of the connected vehicle, according to Computer Weekly.
Patching flaws will not be straightforward because of the extensive use of CAN across industries and products. As the new age of connectivity emerges, users and vendors will have to focus heavily on cybersecurity and data protection measures.