Autonomy Under Attack: A Hacker's Intro to CAV Cybersecurity

Hacker Noob Tips

14 Mar 2025 — 7 min read

The future of transportation is increasingly autonomous, with Connected Autonomous Vehicles (CAVs) promising enhanced safety, efficiency, and convenience. These vehicles rely on a complex web of sensors, software, and communication systems to navigate our roads with limited or no human intervention. However, this intricate technology also introduces a significant and evolving attack surface for malicious actors. For the aspiring hacker or cybersecurity enthusiast, understanding the vulnerabilities and security challenges of CAVs is becoming increasingly crucial. Welcome to your introductory deep dive into the world of CAV cybersecurity.

carhacking

carhacking.pdf

4 MB

Why Target a Self-Driving Car? Unpacking Attack Motivations

Before diving into the technicalities, it's essential to understand why someone might want to hack a CAV. The sources reveal several key attack motivations:

Interrupting Operations: Imagine causing chaos on the roads by rendering autonomous driving systems inoperable. Attackers might aim to compromise critical components, forcing the vehicle back into manual mode or even completely immobilizing it. A Denial of Service (DoS) attack, for example, could overwhelm the vehicle's communication network with irrelevant data, disrupting essential functions like collision avoidance and navigation. Similarly, blackhole attacks, where a compromised node simply drops crucial data like accident alerts, can severely disrupt operations.
Gaining Control Over CAVs: The prospect of remotely controlling a vehicle is a serious security concern. Attackers might seek to manipulate a CAV's behavior, altering its route, speed, or even triggering emergency brakes. Sensor spoofing attacks, where false data is fed to the vehicle's sensors, can lead to incorrect and potentially dangerous decision-making. More alarmingly, code modification attacks, potentially targeting the Electronic Control Units (ECUs) through interfaces like the OBD-II scanner, could allow adversaries to execute malicious code and gain complete control.
Stealing Information: CAVs generate and process vast amounts of data, making them attractive targets for information theft. Attackers might aim to collect confidential information, including the user's personal data, location history, and driving patterns, which could be used for future attacks or other malicious purposes. Passive eavesdropping attacks on the vehicle's network traffic could allow attackers to recognize patterns and deduce sensitive information, such as passenger privacy, location, or personal preferences, especially if communication channels are insecure or unencrypted. Even seemingly innocuous data can be exploited; for instance, location privacy can be compromised through software side-channel attacks, as demonstrated with algorithms like AMCL.

Beyond these primary motivations, the increasing connectivity of CAVs to other systems opens doors for further malicious goals:

Financial Gain: As electric vehicles become more prevalent, attackers might target charging infrastructure for billing fraud by intercepting public identifiers or manipulating charging sessions. Ransomware attacks, where attackers lock vehicle functions and demand payment for their restoration, are also a potential future threat.
Surveillance: The ability to remotely track a vehicle and potentially listen to its occupants presents a significant privacy concern and a motivation for malicious actors.

Peering Under the Hood: Key Vulnerability Areas in CAVs

To achieve their malicious goals, attackers will target various vulnerable components within and connected to CAVs:

Communication Networks: CAVs rely on both internal (intra-vehicular) and external (inter-vehicular) communication networks. The Controller Area Network (CAN) bus, a common intra-vehicular network, has been shown to be susceptible to attacks like DoS by flooding it with malicious messages. External communication, such as Vehicle-to-Everything (V2X), while enhancing safety and efficiency, also introduces vulnerabilities if not properly secured.
Sensors: Autonomous driving heavily depends on data from various sensors (cameras, lidar, radar, etc.). Sensor spoofing, as mentioned earlier, can mislead the vehicle's perception of its environment, leading to dangerous situations.
Software and Electronic Control Units (ECUs): The complex software controlling CAV functions is a prime target. Vulnerabilities in the code can be exploited to gain unauthorized access and manipulate vehicle behavior. ECUs, which manage specific vehicle systems, can be compromised through physical access (like the OBD-II port) or remotely.
Charging Systems (CCS): As highlighted in our previous discussion, the Combined Charging System (CCS) for electric vehicles has inherent security vulnerabilities stemming from its underlying Power Line Communication (PLC) technology. These include radiative signal leakage, lack of inherent security in basic standards, and vulnerability to wireless attacks, potentially leading to eavesdropping, information theft, and billing fraud.
Over-the-Air (OTA) Updates: While OTA updates are crucial for software maintenance and security patches, they also present a potential attack vector. Malicious updates could introduce malware or compromise vehicle systems if the update process is not adequately secured.
Mobile Apps and Backend Systems: Many modern cars have companion mobile applications that allow users to remotely interact with their vehicles. Vulnerabilities in these apps or the backend systems they communicate with can provide attackers with unauthorized access and control over vehicle functions.
Keyless Entry Systems: These systems, while convenient, have also been shown to be susceptible to attacks like replay attacks, where an attacker intercepts and retransmits the unlock signal.

Standards as a Shield: The Significance of ISO/SAE 21434

Recognizing the growing cybersecurity risks associated with CAVs, standards like ISO/SAE 21434 (Automotive Cybersecurity Engineering) are of paramount importance. This standard provides a comprehensive framework for embedding cybersecurity into every stage of a vehicle's lifecycle, from initial concept to decommissioning.

Key aspects of ISO/SAE 21434 include:

Lifecycle Approach: It mandates that cybersecurity considerations are integrated throughout the entire vehicle lifecycle.
Secure Communication: It provides guidelines for securing both intra- and inter-vehicular communication protocols against various threats.
Secure Software Development: It promotes secure coding practices to minimize software vulnerabilities.
Risk Assessment (TARA): It requires the use of Threat Analysis and Risk Assessment (TARA) to proactively identify and evaluate potential cybersecurity risks.
Vulnerability Management: It establishes processes for identifying, assessing, and mitigating security weaknesses discovered throughout the vehicle's lifespan.
CVSS 3.X Exploitability Score: It utilizes the Common Vulnerability Scoring System (CVSS 3.X) to standardize the severity scoring of vulnerabilities, helping prioritize mitigation efforts.
Efficient Risk Management: It emphasizes the responsibility of vehicle manufacturers and suppliers to effectively manage cybersecurity risks.

ISO/SAE 21434 aims to shift cybersecurity from an afterthought to a fundamental aspect of CAV design and development. By providing a structured and standardized approach, it helps the automotive industry build more resilient and secure autonomous vehicles.

The Real-World Landscape: Insights from Car Hacking Research

The theoretical vulnerabilities discussed are not just academic exercises. As highlighted in the DEF CON Car Hacking Village presentations and other research, car hacking is a real and evolving field. Security researchers have demonstrated various attack vectors and vulnerabilities in real-world vehicles.

Key takeaways from these real-world investigations include:

Accessibility of Tools: The hardware required for experimenting with car hacking is becoming more readily available and affordable. Tools like software-defined radios (SDRs) can be used for intercepting and manipulating wireless signals.
"Software Archaeology": Many existing vehicle systems were not designed with robust security in mind from the outset, leading to vulnerabilities that resemble older software security flaws.
Focus on Communication: A significant amount of car hacking research focuses on exploiting vulnerabilities in communication protocols, both wired (like CAN bus) and wireless (like key fobs and Bluetooth).
Remote Attacks: A concerning trend is the prevalence of remote attacks against CAVs, which are harder to prevent and can cause more widespread damage.
Evolving Threat Landscape: As CAV technology advances, so do the potential attack vectors and the sophistication of attackers.

The work of security researchers in identifying and disclosing these vulnerabilities is crucial for improving the security posture of CAVs.

Securing the Autonomous Future: Ongoing Efforts

The cybersecurity of CAVs is an active area of research and development. Various strategies and technologies are being explored to enhance their security:

Secure Communication Protocols: Researchers are developing new and more secure protocols for both intra- and inter-vehicular communication.
Intrusion Detection Systems (IDS): Systems that can detect malicious activity within the vehicle's network are being developed, some leveraging machine learning for autonomous detection.
Blockchain Technology: Blockchain is being explored for securing CAV communications, enhancing data integrity, and managing access control.
Machine Learning (ML) for Security: ML techniques are being investigated for anomaly detection, threat prediction, and enhancing the robustness of security systems against new attacks.
Secure Over-the-Air (OTA) Update Mechanisms: Ensuring the integrity and authenticity of software updates is crucial to prevent the introduction of malware.
Hardware Security Measures: Implementing security features at the hardware level can provide a more robust defense against certain types of attacks.

Conclusion: The Road Ahead for CAV Cybersecurity

The journey towards a secure autonomous future is a continuous one. As CAV technology evolves, so too will the threats they face. Understanding the motivations behind attacks, the potential vulnerabilities within these complex systems, and the importance of security standards like ISO/SAE 21434 is fundamental for anyone interested in the cybersecurity landscape. The insights from real-world car hacking research underscore the urgency and importance of proactive security measures.

For the aspiring "hackernoob," the world of CAV cybersecurity offers a fascinating and critical area to explore. By understanding the fundamentals discussed here, you can begin to appreciate the challenges and contribute to the ongoing efforts to secure the vehicles of tomorrow. The safety and reliability of our future transportation depend not only on the advancements in autonomous driving but also on our collective commitment to building and maintaining robust cybersecurity defenses.