CANflict：利用外设冲突对汽车网络进行数据链路层攻击
CANflict: Exploiting Peripheral Conflicts for Data-Link Layer Attacks on Automotive Networks
摘要：
目前汽车领域的研究已经证明了CAN协议在安全性方面的局限性。应用层攻击，包括创建恶意数据包，被认为是可行的远程，但可以很容易地检测到现代IDS。另一方面，最近的链路层攻击更隐蔽，可能更具破坏性，但需要对总线进行物理访问。在本文中，我们提出了CANflict，一种纯软件的方法，允许可靠的操作CAN总线在数据链路层从一个未经修改的微控制器，克服了国家的最先进的作品的限制。我们证明了可以从远程受损的ECU部署隐形CAN链路层攻击，目标是同一CAN网络上的另一个ECU。为此，我们利用微控制器外围设备之间存在的引脚冲突来制作多语言帧，这使得攻击者能够在位级别控制CAN流量并绕过协议规则。我们的实验证明了我们的方法对高，中，低端微控制器的有效性，我们提供了一个可扩展的工具，可用于实现我们的方法在不同的平台上，并建立在数据链路层的CAN对策为未来的研究奠定了基础。
英文摘要：
Current research in the automotive domain has proven the limitations of the CAN protocol from a security standpoint. Application-layer attacks, which involve the creation of malicious packets, are deemed feasible from remote but can be easily detected by modern IDS. On the other hand, more recent link-layer attacks are stealthier and possibly more disruptive but require physical access to the bus. In this paper, we present CANflict, a software-only approach that allows reliable manipulation of the CAN bus at the data link layer from an unmodified microcontroller, overcoming the limitations of state-of-the-art works. We demonstrate that it is possible to deploy stealthy CAN link-layer attacks from a remotely compromised ECU, targeting another ECU on the same CAN network. To do this, we exploit the presence of pin conflicts between microcontroller peripherals to craft polyglot frames, which allows an attacker to control the CAN traffic at the bit level and bypass the protocol's rules. We experimentally demonstrate the effectiveness of our approach on high-, mid-, and low-end microcontrollers, and we provide the ground for future research by releasing an extensible tool that can be used to implement our approach on different platforms and to build CAN countermeasures at the data link layer.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
