A global automaker required a thorough, but time-constrained, threat assessment and remediation plan for its critical Gateway Electronic Control Unit (ECU). The assessment needed to cover not only the main ECU but also its networked interaction with all of the vehicle’s numerous ECUs.
Having attempted to perform the assessment on its own, the manufacturer found its initial results lacked sufficient technical depth and were taking too long to report, threatening other key project timelines. They turned to IOActive to not only improve but also to accelerate the assessment process for this product.
The Challenge
An automotive Gateway ECU acts as a hub, routing and securing communication between ECUs and back-end services, such as the engine, transmission, brakes, steering, and infotainment. However, because it sits atop the vehicle’s digital nervous system, any compromise of the Gateway ECU can cascade to other subsystems through the entire in-vehicle network, including the Controller Area Network (CAN) bus and newer technologies like vehicular Ethernet. This widespread connectivity amplifies the potential for catastrophic results if vulnerabilities are exploited. Ensuring that any conceivable threats are accounted for and prioritized for remediation is a critical step in overall vehicle safety in the modern era.
In this case, the automaker was looking to certify the reliability and security posture of its Gateway ECU in accordance with ISO/SAE 21434, the international standard that specifies requirements for cybersecurity risk management in the design and development of automotive systems. The purpose of ISO 21434 is to establish a comprehensive framework for managing cybersecurity risks throughout the entire lifecycle of a vehicle, and ensure that automotive systems are designed with cybersecurity in mind from the outset, continually addressing potential vulnerabilities and threats.
ISO 21434 applies to all stages of a vehicle’s lifecycle, including concept, development, production, operation, maintenance, and decommissioning. It covers all electronic and electrical systems within the vehicle, including software, hardware, and communication interfaces.
Enter TARA
A critical component of ISO 21434 is a risk assessment process known as Threat Analysis and Risk Assessment (TARA). A TARA’s risk-based approach involves systematically identifying potential damage scenarios, threat scenarios, and attack paths, evaluating their impact and attack feasibility, and determining the risk to decide appropriate mitigation strategies.
Given their tight project timelines, what the automaker needed was a specialized consulting service with core competencies focused on the use of TARA in an automotive system. That’s where IOActive comes in, as a research-driven security services company with a history of automotive testing and ethical hacking that dates to the earliest days of digital vehicle control systems.
In the context of automobile control systems, a meaningful TARA program is structured to ensure all potential security risks are identified, assessed, and prioritized for mitigation. Potential vectors include physical threats (when a malicious actor has hands-on access to a vehicle, for example) and wireless threats (for hacking attempts leveraging the vehicle’s on-board cellular and WiFi connectivity).
For this automaker client, IOActive organized the highly technical TARA to include the following tasks.
Initiation and Planning