Cyber-Physical Systems Security—A Survey <s> 4) Smart Cars Attacks: a) Relay attacks: <s> We demonstrate relay attacks on Passive Keyless Entry and Start (PKES) systems used in modern cars. We build two efficient and inexpensive attack realizations, wired and wireless physical-layer relays, that allow the attacker to enter and start a car by relaying messages between the car and the smart key. Our relays are completely independent of the modulation, protocol, or presence of strong authentication and encryption. We perform an extensive evaluation on 10 car models from 8 manufacturers. Our results show that relaying the signal in one direction only (from the car to the key) is sufficient to perform the attack while the true distance between the key and car remains large (tested up to 50 meters, non line-of-sight). We also show that, with our setup, the smart key can be excited from up to 8 meters. This removes the need for the attacker to get close to the key in order to establish the relay. We further analyze and discuss critical system characteristics. Given the generality of the relay attack and the number of evaluated systems, it is likely that all PKES systems based on similar designs are also vulnerable to the same attack. Finally, we propose immediate mitigation measures that minimize the risk of relay attacks as well as recent solutions that may prevent relay attacks while preserving the convenience of use, for which PKES systems were initially introduced. <s> BIB001 </s> Cyber-Physical Systems Security—A Survey <s> 4) Smart Cars Attacks: a) Relay attacks: <s> This work exposes a largely unexplored vector of physical-layer attacks with demonstrated consequences in automobiles. By modifying the physical environment around analog sensors such as Antilock Braking Systems (ABS), we exploit weaknesses in wheel speed sensors so that a malicious attacker can inject arbitrary measurements to the ABS computer which in turn can cause life-threatening situations. In this paper, we describe the development of a prototype ABS spoofer to enable such attacks and the potential consequences of remaining vulnerable to these attacks. The class of sensors sensitive to these attacks depends on the physics of the sensors themselves. ABS relies on magnetic---based wheel speed sensors which are exposed to an external attacker from underneath the body of a vehicle. By placing a thin electromagnetic actuator near the ABS wheel speed sensors, we demonstrate one way in which an attacker can inject magnetic fields to both cancel the true measured signal and inject a malicious signal, thus spoofing the measured wheel speeds. The mounted attack is of a non-invasive nature, requiring no tampering with ABS hardware and making it harder for failure and/or intrusion detection mechanisms to detect the existence of such an attack. This development explores two types of attacks: a disruptive, naive attack aimed to corrupt the measured wheel speed by overwhelming the original signal and a more advanced spoofing attack, designed to inject a counter-signal such that the braking system mistakenly reports a specific velocity. We evaluate the proposed ABS spoofer module using industrial ABS sensors and wheel speed decoders, concluding by outlining the implementation and lifetime considerations of an ABS spoofer with real hardware. <s> BIB002 </s> Cyber-Physical Systems Security—A Survey <s> 4) Smart Cars Attacks: a) Relay attacks: <s> This paper presents an overview of the current state-of-the-art of security and privacy concerns regarding RFID-based car key applications. We will first present a general overview of the technology and its evolution before moving on to an overview and discussion of the various known security weaknesses and attacks against such systems and the associated privacy risks they introduce. <s> BIB003 </s> Cyber-Physical Systems Security—A Survey <s> 4) Smart Cars Attacks: a) Relay attacks: <s> While most automotive immobilizer systems have been shown to be insecure in the last few years, the security of remote keyless entry systems (to lock and unlock a car) based on rolling codes has received less attention. In this paper, we close this gap and present vulnerabilities in keyless entry schemes used by major manufacturers. In our first case study, we show that the security of the keyless entry systems of most VW Group vehicles manufactured between 1995 and today relies on a few, global master keys. We show that by recovering the cryptographic algorithms and keys from electronic control units, an adversary is able to clone a VW Group remote control and gain unauthorized access to a vehicle by eavesdropping a single signal sent by the original remote. Secondly, we describe the Hitag2 rolling code scheme (used in vehicles made by Alfa Romeo, Chevrolet, Peugeot, Lancia, Opel, Renault, and Ford among others) in full detail. We present a novel correlation-based attack on Hitag2, which allows recovery of the cryptographic key and thus cloning of the remote control with four to eight rolling codes and a few minutes of computation on a laptop. Our findings affect millions of vehicles worldwide and could explain unsolved insurance cases of theft from allegedly locked vehicles. <s> BIB004
This kind of attack targets the RKE, where an attacker relays the communications between the car and its key fob. The attack exploits the periodical LF beacon signal the car sends to detect if the key fob is in close range. The attacker captures and relays it, using an antenna, to the relatively far key fob, which is most likely in the car owner's pocket. The key fob is activated by the relayed signal and sends an "open" ultrahigh frequency (UHF) signal to open the car. Once the car is opened, the same attack is repeated from inside the car to start it. The attack was implemented successfully on ten different cars from eight manufacturers. In addition, it evades cryptographic measures because it targets communications at the physical layer BIB001 . This kind of attack is also called MITM or "two-thief" attacks BIB003 . In addition, Garcia et al. BIB004 presented an attack on the RKE system used in many cars. The attack relies on exploiting the simple cryptographic algorithms and inadequate key management in order to clone a car's key resulting in an unauthorized access to the car. key b) ABS Spoofing: Shoukry et al. BIB002 showed a physical attack on the ABS wheel speed sensor. The sensor measures the speed of a wheel using a magnetic field the gets induced by the iron tone wheel attached to every wheel. In the demonstrated attack, the authors introduced a malicious actuator that produces another magnetic field that disrupts the original field produced by the wheel speed sensor. This additional field results in inaccurate speed measurements received by the ABS ECU. The authors also demonstrated a spoofing attack that allows attackers to inject incorrect speed measures and spoof the ABS ECU.