It's easier to break than to patch: a stealthy DoS attack on CAN | Stefano Zanero & Stefano Longari

### Overview Stefano Zanero and Stefano Longari present research on inherent design vulnerabilities in the Controller Area Network (CAN) bus, the primary communication standard connecting critical and non-critical Electronic Control Units (ECUs) in vehicles. Unlike attacks that exploit unauthenticated broadcast messages to spoof signals or flood networks, this work demonstrates how standard CAN error-handling and fault-confinement mechanisms can be abused to perform a targeted denial-of-service (DoS) attack that forces a specific ECU off the bus, subsequently allowing stealthy message spoofing.

### Key Topics - Automotive intrusion detection system (IDS) architectures, including specification-based, frequency-based, and machine learning methods, and their evasion. - CAN bus electrical properties: dominant (0) vs. recessive (1) bits, arbitration, and bit-level overwriting. - Abusing CAN protocol fault-confinement rules and Transmit Error Counters (TEC) to induce a "bus-off" state. - Experimental proof of concept using low-cost hardware against a laboratory testbed and an Alfa Romeo Giulietta. - Design and evaluation of "CANpy/CopyCAN", a passive state-tracking IDS that monitors ECU error counters directly from bus traffic to detect and mitigate spoofing.

### Technical Details In a standard CAN network, ECUs arbitrate for bus access. A transmitted 0 (dominant) overrides a 1 (recessive). If an ECU observes a signal on the bus differing from what it transmitted outside arbitration, it flags a bit error and transmits an active error flag (six dominant zero bits). Each transmission error increments the ECU's Transmit Error Counter by 8, whereas successful transmissions decrement it by 1. When the counter exceeds 127, the ECU enters an error-passive state; when it exceeds 255, the ECU enters a bus-off state, disconnecting itself entirely from the bus.

The researchers exploit this behavior through a targeted attack: 1. The attacker monitors the CAN bus for the victim ECU's identifier (ID). 2. Once the victim wins arbitration, the attacker locates a known recessive bit (such as the CRC delimiter, which is always 1). 3. The attacker overwrites this recessive bit with a dominant 0. 4. The victim perceives this discrepancy as a transmission error and increments its error counter by 8. 5. Repeating this sequence 32 consecutive times forces the victim's counter past 255, knocking it completely off the bus.

Because the attacker's hardware must avoid standard automatic error handling, the authors implemented custom software-defined CAN controller logic on an Arduino coupled with a basic CAN transceiver. In experimental trials, they successfully disabled the parking sensor module on an Alfa Romeo Giulietta connected via the OBD-II port, preventing the sensors from functioning.

### Takeaways The core DoS condition cannot be patched at the CAN protocol level without altering standard fault confinement specifications. However, secondary spoofing—where an attacker impersonates the silenced ECU—can be detected. The authors created a defensive system ("CopyCAN") implementing a finite state machine that observes raw bus bits to track each ECU's error counter. When an ECU enters bus-off, any subsequent frames carrying that ECU's ID are identified as spoofed. The defense can log incidents, alert systems, or actively transmit dominant bits to invalidate unauthorized frames.