Thinking Beyond Bus-off: Targeted Control Falsification in CAN

Controller Area Network (CAN) is considered to be the de facto standard for intra-vehicular communication of modern automobiles. Due to the lack of strong authentication and confidentiality schemes, CAN has been the popular target of a multitude of attacks in the last two decades. Among such attacks, the Bus-off attack (BoA) is considered an important attack vector since it helps the attacker impersonate a trusted safety-critical controller while actually sending false messages.In this paper, we uncover the limitations of classical BoA along with the recent variants in the context of targeting specific automotive safety-critical control loops. In particular, we show that state-of-the-art system-agnostic BoAs are actually futile in the presence of rudimentary range and gradient-based signal monitors that filter out signals exhibiting drastic changes. Instead, we propose a new attack model FalCAN that maximally impacts a given automotive closed-loop while maintaining stealth against monitors. Given the control and bus network specifications, the attack first figures out maximal delays that can be introduced for targeted control loops while attempting BoA. The attack then identifies suitable false data sequences for such delayed actuations that maximize the state error while staying undetected. We implement this attack model on automotive-grade ECUs with benchmark CAN traffic and visualize the impact by real-time emulation of the plant using Hardware-in-loop (HIL) simulation.