In a modern automobile, the in-vehicle communication network interconnects multiple subsystems, including those that perform safety-critical functions such as engine control, anti-lock braking, and airbag deployment, among many others. Therefore, the loss of data integrity in the network can have serious consequences for the safety of the vehicle. To that extent, CAN protocol, the most common in-vehicle communication standard, employs error-handling mechanisms such as bit-monitoring and cyclic-redundancy check to detect intentional or unintentional data manipulation. In this work, we exploit the transmission line nature of the CAN physical layer (a twisted pair cable) to induce voltage transients that result in bit manipulations. Specifically, we demonstrate bidirectional bit flip attacks, recessive to dominant (R→D) and dominant to recessive (D→R) with the aid of multiple compromised nodes (electronic control units) in the network. In addition, both the attacks, the simpler R→D, and the complex D→R are designed to be undetectable to the aforementioned error-handling mechanisms. The attacks become effective for distances ≥ 4m for D→R and ≥ 1m for R→D between the transmitter and receiver nodes. By demonstrating these bit flips, we challenge two fundamental physical layer assumptions of CAN: the impossibility of turning a dominant bit to recessive without an external current source, and having nonidentical signals on two nodes at the same time. The theory behind the attacks is presented, backed by circuit simulations, in-lab validations, and real-world demonstrations in a vehicle. These bit-level attacks, designed at the physical layer, circumvent software-based CAN defenses and lay the groundwork for a broader spectrum of potential attacks, including the manipulation of a data frame that we demonstrate.

Sensing data integrity in a cyber-physical system (CPS) is critical to its safe operation. Intolerable data manipulation can potentially lead to very hazardous consequences. Numerous countermeasures have proven capable of protecting sensitive circuitry, cabling, and their signals from the effects of electromagnetic interference (EMI). However, in the case of intentional electromagnetic interference (IEMI), existing countermeasures possess limited efficacy. IEMI-capable adversaries attack the signal processing circuits and signal paths between sensors/actuators and the controller, seeking to manipulate the signals and falsify data. On a printed circuit board (PCB), the traces carrying these signals act as unintentional receiving antennae to a time-varying electromagnetic field generated by an adversary. In this paper, we demonstrate IEMI attacks on the PCBs used in electric vehicle (EV) charging systems, a highly safety-critical CPS. To mitigate these attacks, we implement passive PCB-level countermeasures, namely, differential signaling, via-fencing, and optical fiber for interconnects. In addition, we propose and implement a multiplexer-based defense that dynamically modifies the route path and evades the adversary. All four countermeasures have been extensively evaluated against multiple adversarial setups and ranked based on their impact. Further, adaptive attacker strategies have been proposed to circumvent the effective countermeasures.

Wired serial communication (e.g., UART, I2C) is widely used to exchange information between sensors, actuators, and controllers in automation, control, and cyber-physical systems. In this work, it is demonstrated that intentional electromagnetic interference (IEMI) can be utilized to not only induce spurious serial communications but to also alter legitimate communications, arbitrarily and at a distance, through attacks that cause controlled, bidirectional bit flips. To prove the efficacy of such attacks, two attack signal types, which require differing levels of attacker knowledge and resources to be effective, are proposed and evaluated against UART and I2C serial communication systems. The first attack waveform, which we call simple, is an inexpensive--to--produce narrowband waveform that has high power and tight timing constraints, but requires little attacker knowledge about the targeted system, while the second waveform, which we call complex, leverages a wideband signal that requires less power to achieve the same effect, is more tolerant of timing error in the signal processing phase, but requires a high amount of attacker knowledge of the targeted system. The simple waveform is shown to be over 98.3% effective at inducing a desired bit sequence into randomly transmitted UART frames, which indicates that an attacker could also choose to inject spurious UART frames, at will. On the I2C data streams, the complex waveform is demonstrated to be overall 75% effective in inducing random bits. Countermeasures are discussed and experimentally validated in high-IEMI scenarios.

Diversity-based security approaches have been studied for several decades since the 1970s. The concept ofdiversity-by-designemerged in the 1980s. Since then, diversity-based system design research has been explored to provide more secure and dependable services in cyber-physical systems (CPSs). In this work, we are particularly interested in providing an in-depth, comprehensive survey of existing diversity-based approaches, their insights, and associated future work directions for building secure and dependable CPSs. This will allow us to provide promising ways of providing quality network and services based on key diversity-by-design principles for those who want to conduct research on developing secure and dependable CPSs using diversity as a system design feature. This survey paper mainly provides: (i) The common concept of diversity based on its multidisciplinary nature along with the historical evolution of the concept of diversity-by-design for providing secure and dependable services; (ii) the key diversity-by-design principles; (iii) the key benefits and caveats of using the diversity-by-design; (iv) the main concerns of CPS environments utilizing the diversity-by-design; (v) an extensive survey and discussions of existing diversity-based approaches based on five different classifications; (vi) the types of attacks considered by diversity-based approaches; (vii) the overall trends of evaluation methodologies used for diversity-based approaches, in terms of metrics, datasets, and testbeds; and (viii) the insights, lessons, and gaps identified from this extensive survey and future work directions.

As the world's predominant navigation system, GPS is critical to modern life, finding applications in diverse areas like information security, healthcare, marketing, and power and water grid management. Unfortunately this diversification has only served to underscore the insecurity of GPS and the critical need to harden this system against manipulation and exploitation. A wide variety of attacks against GPS have already been documented, both in academia and industry. Several defenses have been proposed to combat these attacks, but they are ultimately insufficient due to scope, expense, complexity, or robustness. With this in mind, we present our own solution: fingerprinting of GPS satellites. We assert that it is possible to create signatures, or fingerprints, of the satellites (more specifically their transmissions) that allow one to determine nearly instantly whether a received GPS transmission is authentic or not. Furthermore, in this paper we demonstrate that this solution detects all known spoofing attacks, that it does so while being fast, cheap, and simpler than previous solutions, and that it is highly robust with respect to environmental factors.