- Problem addressed by the paper
Remote attack and mitigation on specific model of modern computerized cars.
- Solution proposed in the paper. Why is it better than previous work?
Exploiting vulnerability in the firmware. Previous works only consider internal attack surface which require physical access to the cars. This paper proves the possibility of remote external surface attack.
- The major results.
After gaining access, attacker can have complete control over the car.
B. Basic idea and approach. How does the solution work?
At first, we need physical contact with the device to extract the firmware. Then we can reverse-engineer the firmware. Then we can find vulnerable code paths such as strcpy(). Then we can weaponize or exploit those vulnerable code paths.
- Gaining complete control over the car.
- The paper also provide mitigation and working with industry and government to prevent this attack in the future.
- It still need physical access in the beginning.
- It might not work in general since it was tested on a specific model (not disclosed). Different manufacturer might have different component architecture and different vulnerabilities paths.
- It might still take significant amount of time to prepare the attack since the attack need to be matched with a specific model architecture.
- Target cars might still rare and testing the attack is costly as it might damage the cars.
E. Future work, Open issues, possible improvements
- It should test the attack on self-driving cars.