Security issues in controller area networks in automobiles

Abstract

Modern vehicles may contain a considerable number of ECUs (Electronic Control Units) which are connected together through various means of communication, with the CAN (Controller Area Network) protocol being the most widely used. However , several vulnerabilities such as the lack of authentication and the lack of data encryption have been pointed out by several authors, which eventually render vehicles unsafe to its users and surroundings. Moreover, the lack of security in modern automobiles has been studied and analysed by other researchers as well since several reports about modern car hacking have been published. The aim of this project is to analyse and test the level of security in these systems , taking a BMW E90 (3-series) instrument cluster as a sample for a proof of concept study. The setup of this experiment consists of a vehicle simulator connected to the instrument cluster while a rogue device is also connected to the CAN-Bus in order to perform a man in the middle attack and send spoofed messages to the instrument cluster. The results obtained from this project have proven the lack of authentication and the lack of data encryption vulnerabilities in modern automobiles since the instrument cluster did not detect any unauthorised devices on the network . Furthermore, since the CAN-bus protocol does not provide any form of encryption to safeguard data on the network, it makes it even more possible to read and write messages onto the CAN-Bus.