Detection of Malware on Vehicular Networks, 10-R8281
Principal Investigators
Mark J. Brooks
Marisa C. Ramon
Tam T. Do
Nakul Jeirath
Inclusive Dates: 01/01/12 – Current
Background — Computers are becoming increasingly prevalent in modern automobiles. By some estimates, even low-end cars contain anywhere from 30 to 50 of these automobile computers, also known as electronic control units (ECUs). ECUs control everything from the in-car entertainment system to the braking system and the engine fuel-air mixture. Wireless connectivity in these computers is also becoming more common, with some vehicles having capabilities for cellular, Bluetooth, and even Wi-Fi connections. Given this increasing sophistication and connectivity, the modern automobile is fertile ground for the same sort of malware and malicious attacks that are usually associated with traditional computers.
Approach — The primary objective of this investigation is to demonstrate the beginning steps toward a system of vehicular malware detection. As a result of this investigation, it is expected one or more prototype algorithms will be produced that can effectively detect the presence of vehicle malware. This is expected to further SwRI's understanding of vehicle exploitation tools and techniques and position the project team to present their results at a major relevant conference.
Accomplishments — A vehicle security test bed has been established with several Controller Area Network (CAN) analyzer tools, several infotainment ECUs, a vehicle, and an oscilloscope with a CAN-specific analyzer. Several wireless tools were also acquired for the test bed for connecting to vehicle infotainment devices.
Using the test bed, the project team investigated vehicle vulnerabilities, patterns of malware, and detection algorithms.
- Researched vulnerabilities in the ID3 tags in the MP3 files, USB vulnerabilities, Bluetooth vulnerabilities, and Wi-Fi vulnerabilities in the infotainment ECU.
- Investigated various malware pieces running on the infotainment ECU platform. These malware pieces attempt to reach the CAN bus once a vulnerability has been exploited.
- Recorded sample CAN traffic in a variety of scenarios and used this data to begin creating several detection algorithms based upon traffic variations. In order to test the detection algorithms, a prototype detector framework is being developed that will be used to test the detection algorithms on the CAN bus.
