DEF CON talk described a DHCP attack on a car's Ethernet diagnostics interface
The conference program scheduled a Car Hacking Village talk for August 8 whose abstract described reaching a production vehicle's internal network through a rogue DHCP server on its OBD Ethernet port.
A researcher from Autocrypt presented an attack against automotive Ethernet at DEF CON 34 in Las Vegas, according to the conference’s published program, which scheduled the talk for Saturday, August 8.
The talk, “Free IP, Free Chaos: DHCP-Assisted Flooding Against Automotive Ethernet,” was listed on the conference’s Creator Stage under the Car Hacking Village, with Yehyeong Lee named as the speaker.
Its abstract set out the premise that gateway electronic control units restrict traffic to specific addresses, but that some support DHCP so a diagnostic tool can be assigned one. That support, the abstract said, “allows an attacker to deploy a rogue DHCP server via the OBD Ethernet interface, assigning a controlled IP to the Gateway ECU.” It said this enabled network-level attacks without any prior knowledge of the vehicle’s internal network.
From that position the abstract described high-rate flooding at layers two and three, using ARP, ICMP, UDP or TCP, and said the effects reached the audio and navigation unit, the wipers and the headlights, and caused abrupt stopping when the vehicle was shifted into drive or reverse. At higher packet rates, it said, the infotainment display blacked out and did not recover until the vehicle was fully powered down.
The abstract said the findings were made on a production vehicle and that a demonstration had been prepared. It did not identify the manufacturer or the model, and the program listed no vulnerability identifiers and no disclosure timeline.
The abstract also stated that vehicles are increasingly adopting automotive Ethernet for UDS-based diagnostics in place of CAN.
Source: DEF CON 34 program, Creator Stage talks. Talk listing also carried by Car Hacking Village.