Contenu connexe Similaire à 自動車セキュリティの現状 by クリス・ヴァラセク Chris Valasek (20) 自動車セキュリティの現状 by クリス・ヴァラセク Chris Valasek3.
• Charlie
Miller
[Security
Engineer]
|Twi,er|
• Chris
Valasek
[Director
of
Security
Intelligence]
|
IOAc4ve|
9.
•
– :
Bluetooth
•
•
– OEM
11.
•
•
•
• ECU
– Linux Windows
ECU
16. CAN
• CAN
ID 11 29
• 0
8
• CAN
ID
– CAN
ID
00
CAN
ID
01
•
•
17. CAN
•
– ID: 03, ID: B1, : 08, : 80 00 00 00 00
00 00 00
•
– ID: 00, ID: B6, : 04, : 33 A8 00 95
• ID
– 95
*
API
18.
• ABS
ECU
– ID:07, ID: 60, : 08, : 03 14 FF 00 00 00 00 00
ID:07, ID: 68, : 08, : 03 7F 14 78 00 00 00 00
ID:07, ID: 68, : 08, : 03 54 FF 00 00 00 00 00
• ECU ID
– ABS ID 0760
• ID 8 ID
•
21. :
SecurityAccess
• SecurityAccess
(ECU )
– IDH: 07, IDL: 26, Len: 08, Data: 02 27 01 00 00 00 00 00
IDH: 07, IDL: 2E, Len: 08, Data: 05 67 01 54 61 B6 00 00
IDH: 07, IDL: 26, Len: 08, Data: 05 27 02 D0 B6 F1 00 00
IDH: 07, IDL: 2E, Len: 08, Data: 02 67 02 00 00 00 00 00
• 0726
(SJB)
– 27
01
=>
• ECU OK
•
• ECU OK
– 67
02
=>
02
22. :
InputOuputControl
• ECU
(i.e.
do
stuff)
– IDH: 07, IDL: E0, Len: 08, Data: 06 2F 03 07 03 00 00 00
IDH: 07, IDL: E8, Len: 08, Data: 06 6F 03 07 03 36 90 00
• 07E0
inputOutputControl
– 2F
=>
ISO-‐14229 inputOutputControl
– 03
07
=>
– 03
00
00
=>
23.
• ECUReset
• ReadMemoryByAddress
• RoueneControl
• RequestDownload
• RequestUpload
• TransferData
• TesterPresent
• WriteMemoryByAddress
26.
• CAN
–
•
vs.
– ECU
•
–
27. :
•
• CAN
ID:
0201
• :
08
• :
AA
BB
00
00
CC
DD
00
00
•
=>
0.0065
*
(CC
DD)
–
67
• RPM
=>
0.25
*
(AA
BB)
–
24
•
(20.1mph
|
2233
rpm):
ID:02, ID:01, :08, : 23 45 00 00 34 56 00 00
35. SecurityAccess:
• PAM
• IDH: 07, IDL: 36, Len: 08, Data: 02 27 01 00 00 00 00 00
• IDH: 07, IDL: 3E, Len: 08, Data: 05 67 01 11 22 33 00 00
• IDH: 07, IDL: 36, Len: 08, Data: 05 27 02 CB BF 91 00 00
• IDH: 07, IDL: 3E, Len: 08, Data: 02 67 02 00 00 00 00 00
• ECU
37.
secret_keys = {
0x727: "50 C8 6A 49 F1",
0x733: "AA BB CC DD EE",
0x736: "08 30 61 55 AA",
0x737: "52 6F 77 61 6E",
0x760: "5B 41 74 65 7D",
0x765: "96 A2 3B 83 9B",
0x7a6: "50 C8 6A 49 F1",
0x7e0: "08 30 61 A4 C5",}
secret_keys2 = {
0x7e0: "44 49 4F 44 45",
0x737: "5A 89 E4 41 72”}
53.
-‐
John
Hanson
|
Toyota
Motor
Sales
U.S.A
54.
•
–
– PC
– PC
–
– ECU
–
55. /
•
–
– :
–
• ECU
– ECU
–
60. CAN
• 15 CAN
• 1 CAN
ID
• 1 CAN
ID
• CAN
ID
61. CAN
• ID
•
Hit
Counts:
Primary[03A9]
=>
9
|
Secondary[03A9]
=>
5
Hit
Counts:
Primary[0255]
=>
166
|
Secondary[0255]
=>
119
Hit
Counts:
Primary[0230]
=>
991
|
Secondary[0230]
=>
1011
Hit
Counts:
Primary[0250]
=>
168
|
Secondary[0250]
=>
209
Hit
Counts:
Primary[03C4]
=>
41
|
Secondary[03C4]
=>
46
Hit
Counts:
Primary[0340]
=>
80
|
Secondary[0340]
=>
82
Hit
Counts:
Primary[0422]
=>
83
|
Secondary[0422]
=>
36
Hit
Counts:
Primary[0423]
=>
17
|
Secondary[0423]
=>
6
Hit
Counts:
Primary[0420]
=>
83
|
Secondary[0420]
=>
47
Hit
Counts:
Primary[0200]
=>
496
|
Secondary[0200]
=>
630
62. :
•
–
• :
( )
• 1
( 20 )
0
10
20
30
40
50
60
70
80
90
100
Frequency distribution of 0201 CAN id
63. :
•
–
( )
•
• “Experimental
Security
Analysis
of
a
Modern
Automobile”
64.
•
• CAN
( CAN CAN )
•
•
68.
• Dr.
Charlie
Miller
(@0xcharlie)
– Twimer
Guy
– cmiller@openrce.org
• Chris
Valasek
(@nudehaberdasher)
– Director
of
Security
Intelligence
@
IOAceve
– cvalasek@gmail.com