Securing Self-Driving Cars. Charlie Chris

Transcription

1 Securing Self-Driving Cars Charlie Chris

2

3 Self-driving Definitions

4 Level-0 No automation technologies Driver in complete control Example: 1974 Ford Pinto

5 Level-1 Driver assistance Steering or speed (not at the same time) Driver still responsible for all vehicle actions Example: 2014 Jeep Cherokee

6 Level-2 Partial automation Car can control steering, braking, acceleration in certain conditions Autopilot like features Still nags the driver Example: Tesla Model S

7 Level-3 Conditional automation Car can control all elements of driving Driver has no obligation other than taking over in the event of unknown conditions Example: 2019 Audi with traffic jam pilot

8 Level-4 High automation Car can drive w/o a driver (or pedals/wheel) Restricted areas (i.e. mapped) Example: Cruise THESE ARE WHAT WE MEAN BY AV/SELF-DRIVING CAR

9 Level-5 Full automation Holy grail of self-driving No driver and can operate on any road / anytime Example: Kitt from Knight Rider

10 Current State

11 Current State Several major players Only a few locales Highly dependent on mapping, weather, and other variables Still relies on base vehicle (discussed later) Many more miles driven than human drivers Waymo => 4MM Uber => 2MM Cruise => 500k Mainly focused on ride sharing services

12 Waymo

13 Uber

14 Cruise

15

16 Self-driving Cars 101

17 Hardware Much different hardware than a standard passenger vehicle Much more expensive Different purposes Needs to connect the self-driving part with the underlying platform

18 Hardware: Sensor suite

19 LIDAR

20 Hardware: Compute Less like More Like

21 Hardware: Connection AV stack Bridge ECU Base vehicle* *Firmware changes are also required in platform ECUs

22 Hardware: UX ttps://techcrunch.com/wp-content/uploads/2017/10/waymo_pacifica_interior_ui_hero_closeup.png?w=730&crop=1

23 Hardware: Ethernet

24 Overall hardware setup Internet sensors telematics Vehicle ECUs sensors Ethernet Compute CAN Vehicle ECUs sensors sensors Vehicle ECUs Eth - CAN

25 Or Internet sensors telematics Vehicle ECUs sensors Ethernet Compute CAN Vehicle ECUs sensors sensors Vehicle ECUs Eth - CAN

26 Or Internet sensors telematics Vehicle ECUs sensors Ethernet Compute CAN Vehicle ECUs sensors sensors Vehicle ECUs Eth - CAN

27 Not this

28 This

29 Localization Location can be determined by sensor (Lidar) readings by comparing to an internal map This is much more accurate than GPS or other technologies

30

31 Connectivity Cars need to communicate to some back office Pick-up / drop-off passengers Send telemetry information Example: software version Example: current speed Pros: Non-public Cons: Most important entry point to secure

32 Applied Car Hacking History

33 2011 Chevy Malibu

34 LS CAN HS CAN Bluetooth CD

35 Cellular HS CAN

36

37 2015 Jeep Cherokee

38 Internet SPI HS CAN

39

40 2016 Telsa Model S

41 ethernet gateway HS CAN Internet CID

42

43 2018 BMW i3

44 K-CAN gateway PT-CAN SMS via base station???

45 Analysis Remote attacks are the most concerning Remote + physical control == worst attack Currently Gateways provide segregation, but become targets Priority over interconnected-ness & customer experience over security Still requires non-commoditized skill, money, and effort We can use all of this knowledge to our advantage!

46 Self-Driving Security Advantages

47 Oh no!...oh no?

48 Good news everyone! Right now, the org owns the car Comes home every day Gets updates every day (not OTA) Diagnostic ports can be in non-standard locations Devices can be locked away without easy access

49 Always watching, always judging We know where they are & what they re doing in real time! Always reporting back telemetry information

50 Reduced Attack Surface

51 Security through Obscurity We all know this isn t a real security barrier but. Devices used in self-driving cars may not be available to the general public Hard to hack a device which you don t have We know it s not perfect, but for the time being, it s something

52 Self-Driving Security Challenges

53 New yet old Component manufacturers are behind with their software TCP, TLS, 802.1x, etc. Functional ethernet!= modern computing ethernet

54

55

56 Threat Models

57 Long Distance (Remote Attacks)

58 Short Distance (Remote Attacks)

59 Physical

60 Sensors

61 Sensors

62 Defenses

63 Defense Reduce attack surface Trusted execution Key storage Encryption (at rest and in transit) Code signing Network segregation Message signing Threat detection

64 Conclusion

65 Conclusion Securing self-driving cars is different (and the same) as securing passenger vehicles There are tons of new sensors, compute, and communications There are advantages & disadvantages Defense techniques leverage known best practices for enterprise (and ICS) networks Nothing is perfect, but we think self-driving security is ahead of the curve Hack more cars. Publish new research. Secure autonomous vehicles.