CyLab researchers create tool to help prevent cyberattacks on vehicles

In 2015, two security gurus remotely hacked a Jeep Cherokee while it was being driven down the highway. The hackers blared music through the car’s speakers, blasted the A/C, and killed the engine. Luckily, the hackers were only demonstrating the ability to do so, the driver was in on it, and no one was hurt.

With vehicles increasingly becoming outfitted with computers to control everything from the radio to the steering wheel, researchers are looking for ways to keep cars protected from attacks like the one demonstrated in 2015. First things first: they need a map of what the car’s computer network looks like.

“That’s super confidential,” says CyLab’s Sekar Kulandaivel, a Ph.D. student in Electrical and Computer Engineering (ECE). “That type of information is automakers’ secret sauce.”

That type of information is automakers’ secret sauce.

Sekar Kulandaivel, Ph.D. student, Electrical and Computer Engineering

So Kulandaivel and his colleagues went ahead and developed their own network-mapping tool. Put simply, the tool can identify all of the computers on the vehicle’s network, what messages each computer is sending, where those messages are going, and where they could go if an attacker took control over one. The tool does all of this for a vehicle in under 30 minutes and less than $50 worth of hardware.

Kulandaivel presented the team’s study last week at the USENIX Security Symposium in Santa Clara, Calif.

It’s important to know that the hackers in 2015 were able to take control of the Jeep Cherokee by hacking into the car’s internet-connected infotainment system. Once they were in there, they learned that the infotainment system could communicate with many more things than just the radio, or the navigation system.

“You would ideally think the infotainment unit should only be able to talk to other radio components, like the display,” Kulandaivel says. “It shouldn’t be able to communicate with your engine. But it can. And the hackers took advantage of that.”

The network-mapping tool developed by Kulandaivel and his colleagues would ideally identify those unwanted connections between computers as vulnerabilities so that the automaker could be informed before an actual attack occurred.

The team tested their tool on five real-world vehicles, including a 2009 Toyota Prius and a 2017 Ford Focus. Thanks to their tool, they discovered that the Focus was found to be vulnerable to an engine shut-down attack, and the Prius had an extra computer that had been installed when the car was modified to all-electric.

Using this tool, we found this unexpected computer that was transmitting on this network, and we had no idea.

Sekar Kulandaivel, Ph.D. student, Electrical and Computer Engineering

“Using this tool, we found this unexpected computer that was transmitting on this network, and we had no idea,” Kulandaivel says.

One might argue that automakers should just share the network map of their vehicles so that it can be ensured vulnerabilities don’t exist. But vehicles can change over time, Kulandaivel says. Owners may have aftermarket parts installed, introducing new components to the network, and even degradation of parts can change how the network works.

“Say a device is starting to fail over time,” Kulandaivel says. “If that causes the characteristics of the device to change the network map, then new vulnerabilities could emerge.”

Other authors on the study included Carnegie Mellon Information Security graduate student Tushar Goyal, ECE Master’s student Arnav Kumar Agrawal, and ECE professor Vyas Sekar.