Cyber Attacks Types

Interception & monitoring the network traffic 

Attackers just listen and record all data on the bus and will try to figure out which frame related to which event 

He will use it later to defunctioning or even get control over your vehicle

Sending random or malformed data fuzzing main goal is to discover “ find the system weakness “

So in fuzzing the attackers will try to protect the important messages/frames then will try to send malformed/random data 

If we compare the method of attacking with Dos ( Denial of service)

Fuzzing finds the weakness & Dos exploits the weakness 

Fuzzing used with white hats & black hats 

For white hats finding & fix bugs using as a black box testing technique 

So used by defender for positive security assurance & proactive security for discovering Vulnerabilities 

How it used in 4 steps 

{ Generate - execute - monitoring - analyze ] 

• Generate random malfunction data 

• Execute these data 

• Monitor where the system will be malfunctioning 

• Analyze the data lead to this problem

Attacker may try to make your system malfunctioning so he will try to inject a high priority message on the CAN bus so all other nodes so they will be not able to communicate with each other or send/receive the recorded data 

So DOS the main goal is to make system unavailable 

This achieved if we speak on the CAN bus then the message with priority ID o then the legitimate messages can’t get through and always see that the bus is busy and trying to send will be arbitrated 

“Targeting the communication path so the vehicle essential functionalities will be disabled”

“ Black box “ “resending messages without understanding them” 

Delay then retransmit messages after without understanding the message content 

Use case remote keyless entry RKE 

Or replay messages that we think it related to specific action & this method need sniffing first 

In most cases replay attacks solved by making each frame is one time use only with many ways as refreshens values 

Replay Vs injection 

replay /records then replay existing data so no need to understand it but with injection modifying or create a new data so we need to understand it first