A flaw buried deep in the hearts of all modern cars allows an attacker with local or even remote access to a vehicle to shut down various components, including safety systems such as airbags, brakes, parking sensors, and others.
The vulnerability affects the CAN (Controller Area Network) protocol that's deployed in modern cars and used to manage communications between a vehicle's internal components.
The flaw was discovered by a collaborative effort of Politecnico di Milano, Linklayer Labs, and Trend Micro's Forward-looking Threat Research (FTR) team.
Researchers say this flaw is not a vulnerability in the classic meaning of the word. This is because the flaw is more of a CAN standard design choice that makes it unpatchable.
Patching the issue means changing how the CAN standard works at its lowest levels. Researchers say car manufacturers can only mitigate the vulnerability via specific network countermeasures, but cannot eliminate it entirely.
"To eliminate the risk entirely, an updated CAN standard should be proposed, adopted, and implemented," researchers say. "Realistically, it would take an entire generation of vehicles for such a vulnerability to be resolved, not just a recall or an OTA (on-the-air) upgrade."
Researchers say that almost any modern car in circulation today is likely affected. Bosch developed the CAN protocol in 1983, and it became an ISO standard in 1993. Nearly all modern cars use it to interconnect components.
The vulnerability researchers describe is a denial of service attack. The issue can be exploited with local access by default, but if any of the car's components contains a remotely-exploitable flaw, then the CAN vulnerability can also be exploited from a remote location.
Below is an explanation of how the vulnerability works:
The research team says that all it takes is a specially-crafted device that attackers have to connect to the car's CAN bus through local open ports. The device reuses frames already circulating in the CAN rather than injecting new ones, generating errors and causing a denial-of-service in various car components.
The Department of Homeland Security's ICS-CERT has issued an alert regarding this flaw, albeit there is little to be done on the side of car makers.
"The only current recommendation for protecting against this exploit is to limit access to input ports (specifically OBD-II) on automobiles," said ICS-CERT experts in an alert released last month.
In the long term, researchers recommend that standardization bodies, decision makers, and car manufacturers get together to revise and improve existing standards or issue new ones in tune with our times.
The research was presented last month at the DIMVA conference in Bonn, Germany. The technical paper detailing the flaw in depth is available here and here. A YouTube video recorded by Trend Micro researcher Federico Maggi is available below.