Cryptographic Hardware and Embedded Systems - CHES 2013 Lecture Notes in Computer Science Volume 8086, 2013, pp 55-72, Aug 2013
This work exposes a largely unexplored vector of physical-layer attacks with demonstrated consequ... more This work exposes a largely unexplored vector of physical-layer attacks with demonstrated consequences in automobiles. By modifying the physical environment around analog sensors such as Antilock Braking Systems (ABS), we exploit weaknesses in wheel speed sensors so that a malicious attacker can inject arbitrary measurements to the ABS computer which in turn can cause life-threatening situations. In this paper, we describe the development of a prototype ABS spoofer to enable such attacks and the potential consequences of remaining vulnerable to these attacks. The class of sensors sensitive to these attacks depends on the physics of the sensors themselves. ABS relies on magnetic–based wheel speed sensors which are exposed to an external attacker from underneath the body of a vehicle. By placing a thin electromagnetic actuator near the ABS wheel speed sensors, we demonstrate one way in which an attacker can inject magnetic fields to both cancel the true measured signal and inject a malicious signal, thus spoofing the measured wheel speeds. The mounted attack is of a non-invasive nature, requiring no tampering with ABS hardware and making it harder for failure and/or intrusion detection mechanisms to detect the existence of such an attack. This development explores two types of attacks: a disruptive, naive attack aimed to corrupt the measured wheel speed by overwhelming the original signal and a more advanced spoofing attack, designed to inject a counter-signal such that the braking system mistakenly reports a specific velocity. We evaluate the proposed ABS spoofer module using industrial ABS sensors and wheel speed decoders, concluding by outlining the implementation and lifetime considerations of an ABS spoofer with real hardware.
Uploads
Papers by Yasser Shoukry
corrupted measurements. The secure state estimation is a combinatorial problem, which has been addressed either by brute force
search, suffering from scalability issues, or via convex relaxations using algorithms that can terminate in polynomial time but are
not necessarily sound. In this paper, we present a novel algorithm that uses a Satisfiability-Modulo-Theory approach to lessen
the intrinsic combinatorial complexity of the problem. By leveraging results from formal methods over real numbers, we provide
guarantees on the soundness and completeness of our algorithm. Moreover, we provide upper bounds on the runtime performance
of the proposed algorithm in order to proclaim the scalability of the proposed algorithm. The scalability argument is then supported
by numerical simulations showing an order of magnitude decrease in the runtime performance with alternative techniques. Finally,
we demonstrate its application to the problem of controlling an unmanned ground vehicle.
data with untrustworthy third-party apps, often leading
to data misuse and privacy violations. Unfortunately,
state-of-the-art privacy mechanisms on Android provide
inadequate access control and do not address the vulnerabilities
that arise due to unmediated access to so-called
innocuous sensors on these phones. We present ipShield,
a framework that provides users with greater control over
their resources at runtime. ipShield performs monitoring
of every sensor accessed by an app and uses this information
to perform privacy risk assessment. The risks are
conveyed to the user as a list of possible inferences that
can be drawn using the shared sensor data. Based on
user-configured lists of allowed and private inferences, a
recommendation consisting of binary privacy actions on
individual sensors is generated. Finally, users are provided
with options to override the recommended actions
and manually configure context-aware fine-grained privacy
rules. We implemented ipShield by modifying the
AOSP on a Nexus 4 phone. Our evaluation indicates
that running ipShield incurs negligible CPU and memory
overhead and only a small reduction in battery life.
require novel algorithms for exploring different design decisions
at early stages of the design flow. The problem of allocating the
software components on electronic control units lies at the core
of these design decisions. This paper formalizes this allocation
problem using graph theory. The proposed formalism allows the
designer to use a wide variety of graph-theoretic optimization
algorithms, which are capable of minimizing more than one
criterion simultaneously. The proposed algorithm is then shown,
by means of numerical examples, to give the same answer as
mathematical optimization but is 15 times faster in computation
time.
communication packets over the controller area network (CAN) bus. Using online, dynamic, and
distributed scheduling of messages, one can obtain better temporal characteristics for networked
embedded control systems. The scheduling algorithm is implemented as a hardware unit which
is augmented to the communication controller on all of the communicating nodes in the system.
This insures minimum change in the current platforms used in CAN-based control applications
like those found heavily in automotive and aerospace applications. We provide a number of
experiments held over a physical CAN bus for controlling an automotive active suspension
system and showing the effect of the proposed scheduling implementation on the quality of the
control loop.
corrupted measurements. The secure state estimation is a combinatorial problem, which has been addressed either by brute force
search, suffering from scalability issues, or via convex relaxations using algorithms that can terminate in polynomial time but are
not necessarily sound. In this paper, we present a novel algorithm that uses a Satisfiability-Modulo-Theory approach to lessen
the intrinsic combinatorial complexity of the problem. By leveraging results from formal methods over real numbers, we provide
guarantees on the soundness and completeness of our algorithm. Moreover, we provide upper bounds on the runtime performance
of the proposed algorithm in order to proclaim the scalability of the proposed algorithm. The scalability argument is then supported
by numerical simulations showing an order of magnitude decrease in the runtime performance with alternative techniques. Finally,
we demonstrate its application to the problem of controlling an unmanned ground vehicle.
data with untrustworthy third-party apps, often leading
to data misuse and privacy violations. Unfortunately,
state-of-the-art privacy mechanisms on Android provide
inadequate access control and do not address the vulnerabilities
that arise due to unmediated access to so-called
innocuous sensors on these phones. We present ipShield,
a framework that provides users with greater control over
their resources at runtime. ipShield performs monitoring
of every sensor accessed by an app and uses this information
to perform privacy risk assessment. The risks are
conveyed to the user as a list of possible inferences that
can be drawn using the shared sensor data. Based on
user-configured lists of allowed and private inferences, a
recommendation consisting of binary privacy actions on
individual sensors is generated. Finally, users are provided
with options to override the recommended actions
and manually configure context-aware fine-grained privacy
rules. We implemented ipShield by modifying the
AOSP on a Nexus 4 phone. Our evaluation indicates
that running ipShield incurs negligible CPU and memory
overhead and only a small reduction in battery life.
require novel algorithms for exploring different design decisions
at early stages of the design flow. The problem of allocating the
software components on electronic control units lies at the core
of these design decisions. This paper formalizes this allocation
problem using graph theory. The proposed formalism allows the
designer to use a wide variety of graph-theoretic optimization
algorithms, which are capable of minimizing more than one
criterion simultaneously. The proposed algorithm is then shown,
by means of numerical examples, to give the same answer as
mathematical optimization but is 15 times faster in computation
time.
communication packets over the controller area network (CAN) bus. Using online, dynamic, and
distributed scheduling of messages, one can obtain better temporal characteristics for networked
embedded control systems. The scheduling algorithm is implemented as a hardware unit which
is augmented to the communication controller on all of the communicating nodes in the system.
This insures minimum change in the current platforms used in CAN-based control applications
like those found heavily in automotive and aerospace applications. We provide a number of
experiments held over a physical CAN bus for controlling an automotive active suspension
system and showing the effect of the proposed scheduling implementation on the quality of the
control loop.