Why Automotive Security Needs To Extend Beyond the CAN Bus

As vehicle technology has evolved from a simple combustion engine to a computer network on wheels, the way vehicles communicate and the vulnerabilities they face have seen significant transformations. This is, in part, due to a broad shift from a focus on the CAN Bus — long the central hub for communication within an automobile — to more diversified internal networks.

In this blog post, we’ll explore this shift and why the traditional automotive security approach centered around the CAN Bus is no longer sufficient.

‍

The Evolution of Vehicle Communication (1970s - Present)

In the 1970s, the automotive industry embraced a revolutionary approach to vehicle communication with the introduction of the Controller Area Network (CAN Bus). This paradigm-shifting technology facilitated communication between various electronic control units (ECUs) within a vehicle, allowing for centralized control and coordination of functions such as engine management, transmission, and braking.

The CAN Bus became the backbone of automotive communication, providing a reliable and efficient means for ECUs to exchange data. This centralized model of communication with specialized parts was a game-changer, offering improved efficiency and scalability. Over the years, the CAN Bus became synonymous with automotive communication, dominating the landscape for decades.

As technology advanced, the automotive industry witnessed a gradual evolution in the way vehicles communicated. The traditional CAN Bus model, while effective, faced challenges in adapting to the increasing complexity of modern vehicles. This led to the emergence of internal networks, offering a more sophisticated and diversified approach to communication.

Fast forward to the present day, and we find ourselves in an era where internal networks have become a modern replacement for the circuit-based communication of the CAN Bus and individualized ECUs. These networks, often utilizing Ethernet and other advanced protocols, enable a more distributed and interconnected architecture, accommodating the growing number of electronic components in contemporary vehicles.

‍

The CAN Bus Vulnerability Decline

As the main system for automotive communication, the CAN Bus also became a prime target for cyber threats. The centralized nature of the system, coupled with the proliferation of electronic components, made the CAN Bus very susceptible to exploitation. In the early days of automotive cybersecurity, over 75% of disclosed vulnerabilities were associated with the CAN Bus and its communication protocols.

However, the automotive attack surface has experienced a significant shift in recent years, with a 75% decrease in attacks targeting the CAN Bus since 2019. There are several reasons behind this decline, one of them being the industry's heightened awareness and proactive measures to address vulnerabilities associated with the CAN Bus. 

This decline in CAN Bus vulnerabilities doesn't imply that the system is obsolete or no longer relevant. Instead, it reflects a maturation in the understanding of the automotive attack surface. 

‍

The Shifting Attack Surface

The CAN Bus is no longer the main attack vector for automobiles. Cybersecurity programs, traditionally structured around rigorous testing of the CAN Bus, are evolving to encompass a broader spectrum of potential attack vectors as the automotive attack surface becomes more complex.

Peripherals

Since 2020, over 90% of disclosed attacks are targeting components of the vehicle other than the CAN Bus.

This shift highlights a strategic adaptation by attackers, recognizing that modern vehicles are intricate ecosystems with a multitude of interconnected components beyond the central communication hub.

Cloud

Beyond the peripherals, the cloud has emerged as a new battleground for cyber threats. The number of vulnerabilities associated with cloud connections has surged by 86% since 2020, indicating a growing interest from attackers in exploiting the digital interfaces that connect vehicles to cloud services. This trend underscores the importance of securing the cloud as an integral part of overall automotive cybersecurity.

Apps

Conversely, mobility apps, once perceived as potential weak links, have demonstrated resilience with an 82% decrease in attacks since 2020. This suggests that efforts to bolster the security of mobile applications connected to vehicles have been effective. While attackers pivot to new targets, the success in securing mobility apps serves as a positive benchmark in the ongoing battle against cyber threats.

USB Port

Yet, amid this evolution, one constant remains—the USB port. Despite advancements in technology, USB remains the most common and viable physical attack vector in 2023. This underscores the importance of addressing not only digital interfaces but also the physical connections that vehicles maintain with external devices.

This shift in the attack landscape necessitates a holistic approach to automotive security. Cybersecurity programs must extend beyond the traditional focus on the CAN Bus and adapt to the dynamic threat vectors impacting peripherals, cloud connections, mobility apps, and physical interfaces.

‍

The New Automotive Security Equation

The new security equation reads: 

CAN Bus + Peripherals + Cloud + Apps + USB = Comprehensive Security. 

‍

Each element in this equation represents a critical facet of the automotive ecosystem that must be safeguarded against potential cyber threats.

CAN Bus: While the number of attacks on the CAN bus have decreased, it remains a fundamental part of the automotive security equation.

Peripherals: With 90% of attacks now targeting peripherals, protecting the numerous interconnected devices and interfaces is now paramount for resilient automotive security.

Cloud: The surge in cloud-related vulnerabilities highlights the importance of securing connections to external services. Integrating robust security measures to protect the data flowing to and from the cloud is essential for a comprehensive security strategy.

Apps: Despite a decrease in attacks, mobility apps remain a vital part of the equation. Ensuring they remain secure is vital, as these applications often serve as gateways to the vehicle's systems.

USB: The persistent threat of USB as a common physical attack vector underscores the importance of securing physical interfaces, even as remote attacks become the norm. Protecting against malicious devices connected via USB is an ongoing challenge that must still be addressed in the security equation.

‍

Navigating the Future of Automotive Security

It's clear that the automotive security landscape has undergone a significant transformation. By embracing this holistic view of automotive cybersecurity, automotive cybersecurity programs can adapt to the varied nature of attacks, providing a robust defense against potential cyber threats that goes beyond traditional methodologies like the CAN bus.

‍

Mayhem: Comprehensive Automotive Security Testing 

Mayhem is a security testing solution that goes beyond the traditional confines of CAN Bus-centric testing. Mayhem’s advanced testing capabilities address the shifting automotive attack surface, defending against vulnerabilities that arise in the peripherals or other critical components beyond the CAN Bus.

‍