HECA

“Physical access to the vehicle is often the first step to further attacks,” says Hannah Nöttgen, describing her area of responsibility. “I’m the wireless guy,” says Matteo Varotto, introducing himself with a wink. He is focusing on radio signals. Both observe a lack of awareness of data protection in relation to cars. “Many people are meanwhile watchful of data security on their smartphones. But only few think about what information their cars give away about them,” says Matteo. “Modern cars are data leeches,” warns Hannah.

Vehicles have long been equipped with mobile communication systems, GPS, Wi-Fi, Bluetooth, and USB ports on board. The team is looking closely at these communication channels and interfaces, which are attack vectors. There are also points of attack that are typical for specific vehicles. First, there is the OBD2 interface, the on-board diagnostics system in common use since the early 2000s. Via the socket, which is usually installed in the driver’s footwell, it is possible to read out not only the functions of emissions-related systems and electronic control units. “Many manufacturers meanwhile also use it to update firmware,” says Christoph Krauß.

As wireless communication between modern cars and other vehicles, road users or smart infrastructure increases, known in technical terms as “Vehicle-to-Everything” (V2X), this also creates attack vectors. HECA, however, also has potential attack points on its radar that are less conspicuous. Krauß says: “DAB radios have also already been manipulated.” So much for pop songs.

“To get a feel for where to start and to find viable approaches, at the beginning of the project we experimented in a more playful way,” says Krauß. They then selected suitable methods. In an iterative process, two phases constantly alternate: “First, we identify attack vectors and simulate attacks – then we develop ways to harden the vehicles.” In computer technology, the word “hardening” in the project title means upgrading a system’s security. “Differentiating and classifying data streams is a very important aspect for us,” says Krauß. By way of example: When the car is in operation, the driver needs the navigation system. For this, the vehicle downloads maps and traffic data. At the same time, however, it should not reveal its location to potential attackers. The project team has been given a clear mandate: interventions must be non-invasive – i.e., no cutting cables or snapping antennas – and flexible in terms of time, i.e. it must be possible to activate them temporarily.

“We look at attack vectors in detail and at various levels – physics, communication, and cryptography,” explains Stefan Valentin. “In HECA, we systematically investigate what data the vehicles transmit and what data they receive.” Here, software-defined radios (SDRs) play an important role. “These are programmable transmitters and receivers,” says Valentin. “The computer processes wireless signals in software, and transmits or receives them with minimal radio-specific hardware.” This makes it easy to test, demonstrate and implement prototypes that previously called for the building of chips. SDRs can receive, record, and analyse radio signals, but also play them back, i.e., reproduce recorded signals or generate manipulated signals.

Application example: With the keyless locking systems today, it is possible to open a car door and start a vehicle without having to insert a key into a lock or press a button on the key. Attackers exploit this for what are called “relay attacks”: they position transmitters and receivers between the vehicle and the key, intercept the radio signal, redirect it and can then unlock the vehicle. Distance estimation developed by vehicle manufacturers on the basis of ultra-wideband radio signals is intended to prevent this. “A challenging task in the project is an attack on this distance estimation that bypasses this security feature,” says Valentin.

Inside and in front of Building D21, the team puts a second-hand VW Passat, a new Mercedes-Benz Vito, and an electric VW ID.3 to the acid test. “We work with current models, but we are also keeping an eye on future technical challenges,” says Christoph Krauß. One example is the charging connectors on electric vehicles, via which information is also exchanged with the charging infrastructure.

Something else that the HECA team is testing is the targeted disruption of wireless communication by means of jamming. A jammer transmits signals that disable communication. The jammers developed have a short range so that they only interfere with the vehicle and not, for example, with emergency calls in the vicinity. Valentin gives a typical example of an application: “It can protect against spying by preventing the transmission of the vehicle’s location data.”

Most of the team’s findings are transferable to other emergency vehicles. This is at least as important because if a fire engine were to be directed to the wrong place or an ambulance to be disabled, this could quickly cost lives. Many of the project results might even have more fundamental benefits, says Krauß: “The technical basis of police vehicles is the same as that of normal cars, so most of what we are developing is also relevant for standard vehicles.” This means that HECA could also make vehicles safer that are not equipped with blue lights and radios.

In the first half of the project, the HECA team worked on stationary or slow-moving vehicles. They will soon be shifting into higher gears. “We plan next to conduct attacks at high speeds in a secure environment,” says Krauß. They have already asked if they can use a police training ground. The HECA team at h_da is doing everything they can to make it more difficult for attackers to hack vehicle systems and for Mister X and his buddies to be met with “Access denied”.