Skip to main content
SpringerLink
Log in

Enabling Real-Time Restoration of Compromised ECU Firmware in Connected and Autonomous Vehicles

  • Conference paper
  • First Online:
Security and Privacy in Cyber-Physical Systems and Smart Vehicles (SmartSP 2023)

  • 132 Accesses

Abstract

With increasing development of connected and autonomous vehicles, the risk of cyber threats on them is also increasing. Compared to traditional computer systems, a CAV attack is more critical, as it does not only threaten confidential data or system access, but may endanger the lives of drivers and passengers. To control a vehicle, the attacker may inject malicious control messages into the vehicle’s controller area network. To make this attack persistent, the most reliable method is to inject malicious code into an electronic control unit’s firmware. This allows the attacker to inject CAN messages and exhibit significant control over the vehicle, posing a safety threat to anyone in proximity.

In this work, we have designed a defensive framework which allows restoring compromised ECU firmware in real time. Our framework combines existing intrusion detection methods with a firmware recovery mechanism using trusted hardware components equipped in ECUs. Especially, the firmware restoration utilizes the existing FTL in the flash storage device. This process is highly efficient by minimizing the necessary restored information. Further, the recovery is managed via a trusted application running in TrustZone secure world. Both the FTL and TrustZone are secure when the ECU firmware is compromised. Steganography is used to hide communications during recovery. We have implemented and evaluated our prototype implementation in a testbed simulating the real-world in-vehicle scenario.

This is a preview of subscription content, log in via an institution to check access.

Access this chapter

Log in via an institution
Chapter
USD 29.95
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
eBook
USD 49.99
Price excludes VAT (USA)
  • Available as EPUB and PDF
  • Read on any device
  • Instant download
  • Own it forever
Softcover Book
USD 64.99
Price excludes VAT (USA)
  • Compact, lightweight edition
  • Dispatched in 3 to 5 business days
  • Free shipping worldwide - see info

Tax calculation will be finalised at checkout

Purchases are for personal use only

Institutional subscriptions

Notes

  1. 1.

    Note that the detector should avoid directly communicating with the FTL via the untrusted ECU OS, which is unusual and hence suspicious.

  2. 2.

    This is necessary due to unresolved compatibility issues between the CAN drivers and specific OP-TEE implementation.

References

  1. https://www.nxp.com/products/processors-and-microcontrollers/s32-automotive-platform/s32z-and-s32e-real-time-processors:S32Z-E-REAL-TIME-PROCESSORS

  2. https://www.xilinx.com/products/boards-and-kits/zcu104.html#information

  3. https://www.nxp.com/design/designs/s32g3-vehicle-networking-reference-design:S32G-VNP-RDB3

  4. https://www.nxp.com/design/designs/s32k3-automotive-telematics-box-t-box-reference-design-board:S32K3-T-BOX

  5. Autonomous vehicle data storage - premio inc. https://premioinc.com/pages/autonomous-vehicle-data-storage

  6. Can - Automotive Basics. https://automotivetechis.wordpress.com/2012-06-01-can-basics-faq/

  7. Everything you need to know about performing an ECU reset. https://www.way.com/blog/ecu-reset/

  8. Memory use in automotive - electronic products. https://www.electronicproducts.com/memory-use-in-automotive/

  9. Raspberry pi 3 model b+. https://www.raspberrypi.com/products/raspberry-pi-3-model-b-plus/

  10. Trustzone for cortex-a - arm®. https://www.arm.com/technologies/trustzone-for-cortex-a

  11. Trustzone for cortex-m - arm®. https://www.arm.com/technologies/trustzone-for-cortex-m

  12. fio (2014). http://freecode.com/projects/fio

  13. Applying over-the-air updates in safely automotive ECUS (2021). https://www.nxp.com/company/blog/applying-over-the-air-updates-in-safely-automotive-ecus:BL-OTA-IN-AUTO-ECUS

  14. ECU programming guide (2021). https://ecutek.zendesk.com/hc/en-gb/articles/207345569-ECU-programming-guide

  15. Baek, S., Jung, Y., Mohaisen, A., Lee, S., Nyang, D.: SSD-insider: internal defense of solid-state drive against ransomware with perfect data recovery. In: 2018 IEEE 38th International Conference on Distributed Computing Systems (ICDCS), pp. 875–884. IEEE (2018)

    Google Scholar 

  16. Bielawski, R., Gaynier, R., Ma, D., Lauzon, S., Weimerskirch, A.: Cybersecurity of firmware updates. Technical Report DOT HS 812 807, University of Michigan. Transportation Research Institute and University of Michigan, Dearborn and Volkswagen Group of America (Herndon, VA) (October 2020), https://rosap.ntl.bts.gov/view/dot/55729

  17. Chattopadhyay, A., Lam, K.Y., Tavva, Y.: Autonomous vehicle: Security by design. IEEE Trans. Intell. Transp. Syst. 22(11), 7015–7029 (2021). https://doi.org/10.1109/TITS.2020.3000797

    Article  Google Scholar 

  18. Chen, N., Dafoe, J., Chen, B.: Poster: data recovery from ransomware attacks via file system forensics and flash translation layer data extraction. In: Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security, pp. 3335–3337 (2022)

    Google Scholar 

  19. Chen, N., Xie, W., Chen, B.: Combating the OS-level malware in mobile devices by leveraging isolation and steganography. In: Zhou, J., et al. (eds.) Applied Cryptography and Network Security Workshops: ACNS 2021. LNCS, vol. 12809, pp. 397–413. Springer, Cham (2021). https://doi.org/10.1007/978-3-030-81645-2_23

  20. Cho, K.T., Shin, K.G.: Fingerprinting electronic control units for vehicle intrusion detection. In: 25th USENIX Security Symposium (USENIX Security 16), pp. 911–927. USENIX Association, Austin (2016). https://www.usenix.org/conference/usenixsecurity16/technical-sessions/presentation/cho

  21. Choi, W., Jo, H.J., Woo, S., Chun, J.Y., Park, J., Lee, D.H.: Identifying ECUS using inimitable characteristics of signals in controller area networks. IEEE Trans. Veh. Technol. 67(6), 4757–4770 (2018). https://doi.org/10.1109/TVT.2018.2810232

    Article  Google Scholar 

  22. Code, G.: Opennfm. https://code.google.com/p/opennfm/

  23. Guan, L., et al.: Supporting transparent snapshot for bare-metal malware analysis on mobile devices. In: Proceedings of the 33rd Annual Computer Security Applications Conference, pp. 339–349 (2017)

    Google Scholar 

  24. Hackenberg, R., Weiss, N., Renner, S., Pozzobon, E.: Extending vehicle attack surface through smart devices (2017)

    Google Scholar 

  25. Hamada, Y., Inoue, M., Ueda, H., Miyashita, Y., Hata, Y.: Anomaly-based intrusion detection using the density estimation of reception cycle periods for in-vehicle networks. SAE Int. J. Transport. Cybersecur. Privacy 1 (2018). https://doi.org/10.4271/11-01-01-0003

  26. Han, M.L., Kwak, B.I., Kim, H.K.: Anomaly intrusion detection method for vehicular networks based on survival analysis. Veh. Commun. 14, 52–63 (2018). https://doi.org/10.1016/j.vehcom.2018.09.004

  27. Hoppe, T., Kiltz, S., Dittmann, J.: Applying intrusion detection to automotive it-early insights and remaining challenges. J. Inf. Assur. Secur. (JIAS) 4, 226–235 (2009)

    Google Scholar 

  28. Huang, J., Xu, J., Xing, X., Liu, P., Qureshi, M.K.: Flashguard: leveraging intrinsic flash properties to defend against encryption ransomware. In: Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security, pp. 2231–2244 (2017)

    Google Scholar 

  29. Köhler, J., Förster, H.: Trusted execution environments in vehicles. ATZelektronik worldwide 11(5), 36–41 (2016). https://doi.org/10.1007/s38314-016-0074-y

  30. Kim, B., Park, S.: ECU software updating scenario using OTA technology through mobile communication network. In: 2018 IEEE 3rd International Conference on Communication and Information Systems (ICCIS), pp. 67–72. IEEE (2018)

    Google Scholar 

  31. Klinedinst, D.J., King, C.: On board diagnostics: Risks and vulnerabilities of the connected vehicle. CERT Division, Software Engineering Institute, Carnegie Mellon University, April, White paper (2016)

    Google Scholar 

  32. Kwon, H., Lee, S., Choi, J., Chung, B.H.: Mitigation mechanism against in-vehicle network intrusion by reconfiguring ECU and disabling attack packet. In: 2018 International Conference on Information Technology (InCIT), pp. 1–5 (2018). https://doi.org/10.23919/INCIT.2018.8584882

  33. Ltd., O.: Lpc-h3131. https://www.olimex.com/Products/ARM/NXP/LPC-H3131/. Accessed 30 June 2023

  34. Min, D., et al.: Amoeba: an autonomous backup and recovery SSD for ransomware attack defense. IEEE Comput. Archit. Lett. 17(2), 245–248 (2018)

    Google Scholar 

  35. Murvay, P.S., Groza, B.: Source identification using signal characteristics in controller area networks. IEEE Signal Process. Lett. 21(4), 395–399 (2014). https://doi.org/10.1109/LSP.2014.2304139

    Article  Google Scholar 

  36. News, T.H.: Hackers take Remote Control of Tesla’s Brakes and Door locks from 12 Miles Away. https://thehackernews.com/2016/09/hack-tesla-autopilot.html

  37. Nie, S., Liu, L., Du, Y., Zhang, W.: Over-the-air: how we remotely compromised the gateway, BCM, and autopilot ECUs of tesla cars. Briefing, Black Hat, vol. 91 (2018)

    Google Scholar 

  38. OP-TEE. Op-tee documentation. https://optee.readthedocs.io/en/latest/general/about.html Accessed 30 June 2023

  39. Stevebell. A Pivotal Year for Black Hat Cyber Attacks on Connected Cars - TU Automotive (2008). https://www.tu-auto.com/2018-a-pivotal-year-for-black-hat-cyber-attacks-on-connected-cars/

  40. Tankasala, D., Chen, N., Chen, B.: A step-by-step guideline for creating a testbed for flash memory research via LPC-h3131 and opennfm (2020)

    Google Scholar 

  41. Thing, V.L., Wu, J.: Autonomous vehicle security: a taxonomy of attacks and defences. In: 2016 IEEE International Conference on Internet of Things (iThings) and IEEE Green Computing and Communications (GreenCom) and IEEE Cyber, Physical and Social Computing (CPSCom) and IEEE Smart Data (SmartData), pp. 164–170 (2016). https://doi.org/10.1109/iThings-GreenCom-CPSCom-SmartData.2016.52

  42. Wang, P., Jia, S., Chen, B., Xia, L., Liu, P.: Mimosaftl: adding secure and practical ransomware defense strategy to flash translation layer. In: Proceedings of the Ninth ACM Conference on Data and Application Security and Privacy, pp. 327–338 (2019)

    Google Scholar 

  43. Wang, X., Yuan, Y., Zhou, Y., Coats, C.C., Huang, J.: Project almanac: a time-traveling solid-state drive. In: Proceedings of the Fourteenth EuroSys Conference 2019, pp. 1–16 (2019)

    Google Scholar 

  44. Wen, H., Chen, Q.A., Lin, Z.: Plug-N-Pwned: comprehensive vulnerability analysis of OBD-II dongles as a new Over-the-Air attack surface in automotive IoT. In: 29th USENIX Security Symposium (USENIX Security 20), pp. 949–965. USENIX Association (2020). https://www.usenix.org/conference/usenixsecurity20/presentation/wen

  45. Xie, W., Chen, N., Chen, B.: Enabling accurate data recovery for mobile devices against malware attacks. In: 18th EAI International Conference on Security and Privacy in Communication Networks (2022)

    Google Scholar 

  46. Yang, Y., Duan, Z., Tehranipoor, M.: Identify a spoofing attack on an in-vehicle can bus based on the deep features of an ECU fingerprint signal. Smart Cities 3(1), 17–30 (2020). https://doi.org/10.3390/smartcities3010002

  47. Zhang, T., Antunes, H., Aggarwal, S.: Defending connected vehicles against malware: challenges and a solution framework. IEEE Internet Things J. 1(1), 10–21 (2014). https://doi.org/10.1109/JIOT.2014.2302386

    Article  Google Scholar 

Download references

Acknowledgments

This work was supported by US National Science Foundation under grant number 2225424-CNS, 1928349-CNS, and 2043022-DGE.

Author information

Authors and Affiliations

  1. Department of Computer Science, Michigan Technological University, Michigan, USA

    Josh Dafoe, Harsh Singh, Niusen Chen & Bo Chen

Authors
  1. Josh Dafoe
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. Harsh Singh
    View author publications

    You can also search for this author in PubMed Google Scholar

  3. Niusen Chen
    View author publications

    You can also search for this author in PubMed Google Scholar

  4. Bo Chen
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to Bo Chen .

Editor information

Editors and Affiliations

  1. Binghamton University, Binghamton, NY, USA

    Yu Chen

  2. National Taiwan University, Taipei, Taiwan

    Chung-Wei Lin

  3. Michigan Technological University, Houghton, MI, USA

    Bo Chen

  4. Northwestern University, Evanston, IL, USA

    Qi Zhu

Rights and permissions

Reprints and permissions

Copyright information

© 2024 ICST Institute for Computer Sciences, Social Informatics and Telecommunications Engineering

About this paper

Check for updates. Verify currency and authenticity via CrossMark

Cite this paper

Dafoe, J., Singh, H., Chen, N., Chen, B. (2024). Enabling Real-Time Restoration of Compromised ECU Firmware in Connected and Autonomous Vehicles. In: Chen, Y., Lin, CW., Chen, B., Zhu, Q. (eds) Security and Privacy in Cyber-Physical Systems and Smart Vehicles. SmartSP 2023. Lecture Notes of the Institute for Computer Sciences, Social Informatics and Telecommunications Engineering, vol 552. Springer, Cham. https://doi.org/10.1007/978-3-031-51630-6_2

Download citation

  • DOI: https://doi.org/10.1007/978-3-031-51630-6_2

  • Published:

  • Publisher Name: Springer, Cham

  • Print ISBN: 978-3-031-51629-0

  • Online ISBN: 978-3-031-51630-6

  • eBook Packages: Computer ScienceComputer Science (R0)

Publish with us

Policies and ethics

Search

Navigation