Candy Cream Exploy

Modern vehicles functionalities are regulated by Electronic Control Units (ECU), from a few tens to a hundred, commonly interconnected through the Controller Area Network (CAN) communication protocol. CAN is not secure-by-design: authentication, integrity and confidentiality are not considered in the design and implementation of the protocol. This represents one of the main vulnerability of modern vehicle: getting the access (physical or remote) to CAN communication allows a possible malicious entity to inject unauthorised messages on the CAN bus. These messages may lead to unexpected and possible very dangerous behaviours of the target vehicle. In this conference, we present CANDY CREAM, an attack made of two parts: CANDY aims at exploiting a misconfiguration of an infotainment system based on Android OS connected to the vehicle’s CAN bus network, and CREAM, a post-exploitation script that injects customized CAN frame to alter the behaviour of the vehicle.
LINK: -sito del gruppo: https://sowhat.iit.cnr.it -video dell’attacco: https://youtu.be/Hs73o8RxnNE