Experimental Security Analysis of a Modern Automobile

Experimental Security Analysis of a Modern Automobile. Karl Koscher and colleagues presented this work at the IEEE Symposium on Security and Privacy in 2010. They tested a vehicle trust model in which an attacker could already send messages on a car’s internal network; the experiment did not examine how that access would be obtained. The practical question was whether that position could be used to affect safety-related functions, while the narrow setup means the results do not establish a scalable remote attack against cars generally.

The vehicle they examined was a distributed embedded system containing roughly 50 to 70 ECUs, with internal buses, diagnostics, telematics and safety-critical electronic control. In the tested CAN architecture, messages were broadcast without cryptographic proof of their source. The architecture also exposed weak access controls and was fragile under denial of service and malicious message injection.

The research question can be put plainly: once an attacker can transmit on the internal network, how much control can that access provide, and can malicious behavior persist or cross boundaries between vehicle networks? This scope is important. The team did not measure the likelihood of obtaining access through a remote entry point. Instead, it investigated the consequences after internal access was already available. That separates an impact experiment from a complete, remotely exploitable attack chain.

The team studied two 2009 cars of the same make and model, along with separately purchased ECUs. Testing included components on a bench, a stationary complete vehicle and controlled driving on a closed runway, with explicit safety procedures. The researchers built CarShark to capture and inspect CAN messages, then replay, probe or systematically vary them to see how components responded. They learned through experiments rather than relying on proprietary vehicle documentation.

The tested controls provided limited resistance once the internal network was exposed. Diagnostic and reprogramming protections were often unused or could be bypassed. For one brake controller, the researchers recovered a 16-bit challenge-response key in about a day and a half by repeatedly power-cycling the unit. With internal control, they also falsified displays and speed information and manipulated door locks and several cabin controls. These results demonstrated broad post-compromise influence, not a method for reaching the network remotely.

In physical experiments, the team demonstrated engine disruption, brake engagement or release, and loss of braking under selected conditions. Some attacks were tested at speeds up to 40 miles per hour on the closed runway. A reprogrammed telematics unit also bridged networks that were nominally separated. Malicious code could persist on a component, coordinate effects, wait for a particular vehicle state, and erase evidence by rebooting. The demonstrated effects were conditional results from the controlled setup, not proof that every vehicle would behave the same way.

The evidence has narrow boundaries. Only two cars of the same model were tested, and both belonged to an unnamed 2010 platform. External entry was assumed rather than demonstrated, packet-level details were withheld, and limited runway time constrained road testing. This was not a prevalence study. Whether the findings carry into other makes, models, or current architectures remains uncertain. The work therefore supports claims about what was possible in the evaluated vehicles after compromise, but not how common or remotely reachable those weaknesses were.

The defense-in-depth lesson is to plan for a component being compromised rather than relying only on prevention. Designs should pair detection with fail-safe behavior and recovery. A reasonable industry interpretation is that design reviews should test whether network boundaries and safety mechanisms still hold under deliberately malicious traffic, not merely accidental faults. Persistent code could trigger on vehicle state and reboot to erase evidence, reinforcing the need to detect compromise and recover from it.

Koscher and colleagues experimentally demonstrated that access to the tested internal vehicle network enabled manipulation ranging from false displays to selected engine and braking effects. The paper called for defense in depth, detection, fail-safe behavior and recovery rather than prevention alone. But the experiment does not show that cars generally were remotely exploitable: remote entry was outside its scope, and the same-model pair cannot establish prevalence across platforms or current vehicle designs.