Black Hat Europe Upcoming connected cars that communicate with other vehicles or roadside systems might easily be tracked even by snoopers with limited resources unless the technology is tweaked, an expert in automated and connected vehicle cybersecurity warns.

Connected Vehicle is an upcoming technology that allow will allow cars and road-side infrastructure to communicate. This Intelligent Transportation Systems (ITSs) technology is touted as a means to improve traffic flow and safety.

Vehicles continually broadcast messages containing their location. But these messages might be intercepted.

During an experiment run on the campus of the University of Twente in The Netherlands, two Wi-Fi sniffing stations were able to track a target smart car nearly half the time, according to Dr. Jonathan Petit, principal scientist at Security Innovation and a researcher at the University of Twente.

Connected vehicles continually broadcast messages containing their location. These messages can be received by anyone, jeopardising location privacy.

Experiment results demonstrate that tracking is feasible even if such an attacker covers a small number of intersections. Vehicle pseudonym change strategies can mitigate passive surveillance, the exercise showed.

Experiment results demonstrate that tracking is feasible even if such an attacker covers a small number of intersections. For example, with only two sniffing stations, a mid-sized attacker can track the target vehicle on a zone-level 78 per cent of the time, and on a road-level 40 per cent of the time. Pseudonym schemes harden tracking by increasing the number of sniffing stations required.

“Everyone can deploy a surveillance system to track connected vehicles,” Petit’s talk concluded. “It is cheap and easy and somewhat effective. Countermeasures exist to mitigate the risk.”

Petit presented his research on tracking connected cars at the recent Black Hat Europe during a two-part session where he also discussed research into the security of sensors in self-driving cars.

Your next ride

Automated vehicles are equipped with multiple sensors (LiDAR or light-radar, camera for traffic sign recognition etc.) enabling local awareness of their surroundings. Petit and his team were able to develop remote attacks on camera-based system and LiDAR using commodity hardware. Left unresolved the shortcomings would potentially affect the safety of types of smart cars not expected to become mainstream for at least five years.

A fully automated vehicle will solely rely on its sensors readings to make short-term driving decisions. Sensors have withstand both deliberate attacks as well as glare from the sun and weather conditions on the road that might effect lower sensor data quality or alter sensor input to disrupt the automation system.

As previously reported, a cheap laser pointer together with a Raspberry Pi might be used to develop an attack rig for under $200. Adding a pulse modulator would increase the cost slightly while increasing the effectiveness and scope of attacks. Attacks could be mounted from up to 100m away. Temporarily blinding sensors could force a car into braking or swerving. A flash might blind a vehicle for two seconds or more, the experiments showed.

Countermeasures would involved developing more robust sensors, according to Petit, who described his finding as a “wake up call” for developers of automated cars and sensor suppliers.

Results from laboratory experiments show effective blinding, jamming, replay, relay, and spoofing attacks are possible. Spoofing can involve creating echoes of a fake car or (potentially) pedestrians. Tests on a commercial IBEO Lux lLiDAR unit in the lab showed such spoofing was possible but this does not necessarily translate onto a risk on the road. “Establishing stable objects on sensor output in real driving scenarios level for vehicle control could not be demonstrated,” as Petit put it.

Fortunately Petit and his fellow researchers have come up with software and hardware countermeasures that improve sensors resilience against these types of attacks. “Fooling camera-based systems is easy and cheap,” Petit warned. “Don’t trust automated vehicle sensors unless you implement countermeasures to mitigate such threats.”

Potentially vulnerable sensors are also deployed in the latest luxury cars for advanced driver assistance systems (ADAS), so the results of Petit and his team’s research have short-term relevancy beyond automated driving.

Slides from Petit’s Black Hat presentation, Self-Driving and Connected Cars: Fooling Sensors and Tracking Drivers, are here (pdf). Related research papers, Connected Vehicles: Surveillance Threat and Mitigation (pdf, here); and Remote Attacks on Automated Vehicles Sensors: Experiments on Camera and LiDAR (pdf, here), are also available.

Dr. Petit works as and advisor to governmental and commercial organisations that are rolling out trusted infrastructures to support communications for the connected vehicle market. He previously served as co-chair of the European PRESERVE research project, and early field test of connected vehicle security.

The two sides to the research by Petit and his team reveal that there are more issues to car safety and privacy than that revealed by the high profile hack into the brakes and engine of a Jeep Cherokee by Charlie Miller and Chris Valasek.back in the summer, which Petit described as more a hack on the cellular network of connected cars than anything. ®