UDSonCAN Attacks: Discovering Safety Critical Risks by Fuzzing
Uncovers safety-critical vehicle vulnerabilities via UDSonCAN diagnostic fuzzing, demonstrating unauthenticated vehicle acceleration and braking.
Summary
Diagnostic Services and Vehicle Safety
Unified Diagnostic Services over Controller Area Network (UDSonCAN) enables diagnostic communication with electronic control units (ECUs). Safety-critical diagnostic functions must be strictly gated by authentication when vehicles are in motion.
Fuzzing UDSonCAN Implementations
Systematic protocol fuzzing across production electric vehicle ECUs revealed diagnostic endpoints that execute without required SecurityAccess authentication checks.
Triggering Sudden Acceleration and Braking
Researchers demonstrated that injecting simple, unauthenticated diagnostic CAN frames can cause moving vehicles to brake abruptly or stationary vehicles to accelerate unexpectedly.
Automotive Countermeasures and ECU Hardening
Preventing unauthorized diagnostic execution requires enforcing robust cryptographic authentication, validating vehicle speed conditions in ECU firmware, and deploying CAN bus anomaly detection systems.
Related talks
Creator Stage·19 min
Hyo Jin Lee · Hanryeol Park
Analyzes connected dash cams from global manufacturers, discovering shared OEM vulnerabilities, OS command injections, and custom protocol flaws.
Car Hacking Village·26 min
collin · oblivion
Reverse engineers a commercial odometer rollback tool, extracting locked STM32 firmware and showing how CAN messages are intercepted and rewritten.
Car Hacking Village·29 min
Wyatt Ford · Alex Reuter
Wyatt Ford and Alex Reuter investigate security weaknesses in Vehicle Diagnostic Adapters (VDAs) used on heavy commercial trucks, exploring firmware updates and attack surfaces.