自動(dòng)駕駛域控制-The Key to Remote Vehicle Control Autonomous Driving Domain Controller

TheKeytoRemoteVehicleControl:AutonomousDrivingDomainController

ShupengGao,YingtaoZeng,YimiHu,JieGaoFromBaiduSecurityLab

#BHASIA@BlackHatEvents

TraditionalCars

#BHASIA@BlackHatEvents

CurrentCars

#BHASIA@BlackHatEvents

FutureCars

#BHASIA@BlackHatEvents

TheEvolutionofBMW3SeriesElectronicSystems

#BHASIA@BlackHatEvents

#BHASIA@BlackHatEvents

關(guān)于自動(dòng)駕駛域控制器

OurPreviousResearchOntheIVI

#BHASIA

@BlackHatEvents

OurPreviousResearchOntheT-Box

#BHASIA@BlackHatEvents

OurPreviousResearchOnthe4GModule

#BHASIA@BlackHatEvents

#BHASIA@BlackHatEvents

RegardingAutonomousDrivingDomainControllers

#BHASIA@BlackHatEvents

Why

#BHASIA@BlackHatEvents

WhyResearchADAS?

?SmartvehiclesmaybethemostcomplexandadvancedIoT

devicesaccessibletothegeneralpublic.

?Comparedtothepast,smartcarsincorporateamyriadof

newtechnologiesincludingnewarchitectures,communicationinterfaces,processors,andoperatingsystems.

?Currently,thereisalackofattentiontothesecurityofADAS,whichisrelativelypoor.

?Improperdesignmayposerisksofremotevehiclecontrol.

?ComparedtoIVIandT-Boxdevices,thisrepresentsanewresearcharea.

?InvolvesAI,whichisveryinterestingandcutting-edge.

?Anewresearchdirectionforsecurityresearchersandautomotivemanufacturersecurityteams.

Finalgoal:EnhancingthesecurityofADASdevices.#BHASIA@BlackHatEvents

WhyResearchADAS--HighComplexity

NIOCenterComputingCluster

System:

4xLinux1xAndroid(QNXVM)

SoC:

4xNvidiaOrin-X1xQualcommSA8155

MCU:

2xTC3991xTC397

4xEMMC5xUFS

Morethan1000+TOPS@int8

(RTX4090660TOPS@int8)

#BHASIA@BlackHatEvents

WhyResearchADAS--HighComplexity

/product/xpeng-service-repair-manual-circuit-diagram/

#BHASIA@BlackHatEvents

WhyResearchADAS–NewArchitecture-EthernetConnectivity

/product/geely-hip-hif-service-repair-manuals/

#BHASIA@BlackHatEvents

WhyResearchADAS–NewArchitecture-EthernetConnectivity

#BHASIA@BlackHatEvents

/product/im-l7-ls7-workshop-service-repair-manual-wiring-diagram/

#BHASIA@BlackHatEvents

chassis

CAN

WhyResearchADAS--ControllableVehicles

ADASisconnectedto

PowertrainCANandChassisCAN.

CAN

ItNaturallyControlsVehicles

/product/im-l7-ls7-workshop-service-repair-manual-wiring-diagram/

What

#BHASIA@BlackHatEvents

MoreThan30+ADASDevices

#BHASIA@BlackHatEvents

TheDevelopmentProcessofADASControllers--FPGA

ACC/LKA

0.5TOPS

#BHASIA@BlackHatEvents

ArmCPUwithAIInferenceCapabilities(FrontCamera)

MobileyeQ4M/H

1.1~2TOPS

HorizonJourney2

4TOPS

#BHASIA@BlackHatEvents

#BHASIA@BlackHatEvents

Low-SpeedAutonomousDrivingDomainController

TITDA4VM8TOPSMobieye4H2TOPS

HorizonJ3

1xJ35TOPS

3xJ3

3xJ3

#BHASIA@BlackHatEvents

1xJ3And1xTDA4VM

#BHASIA@BlackHatEvents

2xTDA4VM

#BHASIA@BlackHatEvents

TITDA4VH

32TOPS

#BHASIA@BlackHatEvents

HorizonJ5

#BHASIA@BlackHatEvents

NvidiaXavier

#BHASIA@BlackHatEvents

NvidiaOrin-X

254TOPS

#BHASIA@BlackHatEvents

NvidiaOrin-X

#BHASIA@BlackHatEvents

2xOrin-X

508TOPS

#BHASIA@BlackHatEvents

4xOrin-X

1016TOPS

#BHASIA@BlackHatEvents

84TOPS

NvidiaOrin-N

#BHASIA@BlackHatEvents

Orin-XVSOrin-NSameInterface

#BHASIA@BlackHatEvents

2xMobileye5H

#BHASIA@BlackHatEvents

2xQualcommSA8650

100TOPS

#BHASIA@BlackHatEvents

#BHASIA@BlackHatEvents

ADASInternalStructure:

ADASInternalStructure:

?SoC:IncludesARMCPUandAINPU,runsanoperatingsystem,performsAIinference

?Memory:DDR

?Storage:UFS,EMMC,NorFlash

?Network:OnboardEthernetchip

?MCU:Autonomousdrivingdecisions,CAN

transmissionandreception,faultmonitoringanddegradation,powermanagement,ultrasonicradaralgorithms,AEBdecisions,etc.

?Serializer/Deserializer:Cameradatainput,outputsvideosignal(e.g.,parking360view)toIVI

?Powermanagementchip,CANtransceiverchip.

?Variousinterfaces:Power,Ethernet,CAN,etc.

?Other:GNSSGPSchip,IMUchip

front

fisheye

front

main

front

narrow

LVDSDisplay

LVDS

Control

SocOrin-X

Parking

FSD

PerceptionTasks

ZMQ/DDS/SOMEIP

MonitorTimeSync

MIPICamera

Interface

Deserializer

HMI

Localization

Obstacle

Prediction

HWDriver

Log

AEB

Planning

NvidiaDriveOS

Lane

left

TrafficLight

HDMap

right

SPIInterface

rear

MCUTC397

MarvellSwitch

CAN/FlexRay

Arbitration

Steer-by-wire

Powermanagement

Faultdiagnosis

Lidar

Ultrasonicradar

ADAS

CANTransceiver

Ultrasonicradar

#BHASIA@BlackHatEvents

FSDViewIVI

ParkingView

IMU

GNSS

Chassis/PowertrainCAN

GW

Linux/QNX

Cameras

4/5Gmodule

Internet

CAN

T-Box

AndroidonQNX

Display

CAN

IVI

TelematicsCAN

InfoCAN

EthSwitch

CAN

CAN

CAN

CAN

CAN

VCU

GW

DiagCAN

BodyCAN

CAN

DoIP

OBD

Perception

Control

ADAS

SocOrin-X

CANMCUTC397

Chassis/PowertrainCAN

CAN

ECUs

AutoACDoor

Bodyelectronics

CAN

#BHASIA@BlackHatEvents

APP/Task

ProxySOA

OTA

ZMQ

Security

…….

SYS

HW

Prediction

Planning

Fusion

Control

Localization

MAP/HMI

Perception

BEV

OCC

AEB

Lane

TrafficLight

Obstacle

ROS2

NvidiaDriveOS

Linux

OtherAutoFramework

QNX

Horizon

EMMC/UFSSW

…..

Ser/Des

#BHASIA@BlackHatEvents

Orin

MCU

TI

CAN

GNSS

PMIC

IMU

…..

How

#BHASIA@BlackHatEvents

HowtoResearchADAS-AnalyzeasanIoTDevice

Familiarizewiththestructure,findentrypoints,completetheattack.

Remotecodeexecution(RCE)maynotbeachievable,butriskssuchasinformationleakageare

alsosignificant.

OperatingSystem:

Accessthefilesystem,forexample,throughfirmwareextractionorfirmwaredownload.

Obtainshellaccess,forexample,throughadebuggingport.

InterfaceAnalysis:

Assessinterfaces:UART,Ethernetports,JTAG,DAP,etc.

SignalAnalysis:

AnalyzeCANsignals,CANFD,vehicleEthernet.

#BHASIA@BlackHatEvents

HowtoResearch-AcquiringtheDevice

#BHASIA@BlackHatEvents

HowtoResearch-AcquiringtheDevice

#BHASIA@BlackHatEvents

HowtoResearch-PoweringOnandIgnition

#BHASIA@BlackHatEvents

/product/im-l7-ls7-workshop-service-repair-manual-wiring-diagram/

ReadEMMC/UFSStorage

#BHASIA@BlackHatEvents

ReadEMMCStorage

#BHASIA@BlackHatEvents

UseUFSProgrammertodump/write

EMMCinternallyintegratesaFlashController.

Allowsdirecteditinganddeletion.

Forexample,modifyingthe/etc/shadowfile.

UFScurrentlylackseffectivefilemanagement

methods.Similarasdd.

CurrentuseofUFSprogrammers:

?Completedump,write(upto300MB/s).

?Supportsspecifiedoffset.

#BHASIA@BlackHatEvents

UseUFSProgrammertodump/write–SlowlySpeed

#BHASIA@BlackHatEvents

UseUFSProgrammertodump/write–NewTools

#BHASIA@BlackHatEvents

PartitionTableDetails

HasGPT

HasaGPTpartitiontable,allowingdirectreadingof

partitionsandfiles:

?EXT4:Horizon,TI

?QNX:Mobileye,TI,Qualcomm

NoGPT/MBR

Nvidiadeviceslackastandardpartitiontable:

?EXT4(Orin)

?QNX(Xavier)

QNX6:Mountread-only,can’twrite

#BHASIA@BlackHatEvents

HasPartitionTable

TDA4EMMCDumpQNX，withGPT

J3EMMCDumpEXT4，withGPT

#BHASIA@BlackHatEvents

NoPartitionTable

Ifthereisnopartitiontable,

needrebuild

#BHASIA@BlackHatEvents

NvidiaQNX/AndroidIVIQNX

?ThetoolonlysupportssearchingforEXT3EXT4,FAT,andotherfilesystems.

?QNXrequiresmanualpartitioning.

binwalk-R‘\xeb\x10\x90\x00\x00’

start_offset=0x3EF500000

end_offset=0x543280000

count=$(((end_offset-start_offset)/

0x100000))

ddif=part3.ddof=new_part3.binbs=1024

skip=$((0x80000/1024))

#BHASIA@BlackHatEvents

NvidiaQNX/AndroidIVIQNX

Thenusetools,suchas

qnxmount

#BHASIA@BlackHatEvents

WhatCanWeObtainFromaStorageDump?

Sensitivefiles:

?/etc/shadowforcrackingpasswords

?Encryptionkeys(diskencryption,fileencryption,OTA)

?MQTTprivatekeys,passwords

?OTAupgradepackages

?Modelfiles

?MCUfirmware

?….

Usedframeworksandtechnologies

Startupprocesses,wherevulnerabilitiescanbe

discoveredinlisteningportprocessesthrough

reverseengineering.

#BHASIA@BlackHatEvents

HowToGetshell

HalfofthedeviceshaveSSHenabled:

?Defaultcredentials:nvidia/nvidia

?BruteforcewithHashcat

?Writeanew/etc/shadow

Passwordverificationmechanism:

?Passwordcrackingalgorithm

Dumpflash,modifythestartupprocess

Serialportlogin

Analysisandexploitationofvulnerabilitiesinlistening

processes

#BHASIA@BlackHatEvents

HowToGetshell–ModifyUFS

ModifyingEMMCstorageisquitecommon.

Nowwe:

1.DumpallUFSasa.img

2.Modify.img:

?0xd65f03c0isretinstruction

?BypassChangePasswd()function

?Modifyshadowfile

3.Writethe.imgfilebacktoUFS

#BHASIA@BlackHatEvents

HowToGetshell–UARTInterface

#BHASIA@BlackHatEvents

ObtainingNetworkAccess

?AllonboarddevicesusevehicleEthernet

?Usetwo-corecables

?Supports100M/1000M

#BHASIA@BlackHatEvents

ObtainingNetworkAccess--HowtoUseVehicleEthernetAdapters

?VehicleEthernetisdividedintofourcombinations:100M/1000Mand

master/slave.

?Additionally,100Misdifferentiatedbycablesequence.

?Recommendedtouseadapterswithauto-negotiationcapabilities.

#BHASIA@BlackHatEvents

HowtoObtainTheIP

Capturingpacketsinpromiscuous

modetodeterminetheSOCIP

address:

?VLANsarecommonlypresent.

?MostdevicesdonotuseARPand

requireMACaddressbinding.

?Sometimes,settingthelocalIP

andMACaddressisnecessary

basedontheUDP'sdestinationIPandMAC.

?SomedevicesuseIPv6addresses.

#BHASIA@BlackHatEvents

InterfaceRisk

Boardoftenhasmany

interfaces,especiallyUART

andJTAG.

Somecarmanufacturers

notonlyhavenumerous

debugginginterfacesbut

alsoclearlylabelthem.

Theseinterfacesareoften

neededfordebuggingand

firmwareflashing.Hence,

protectionisnecessary.

#BHASIA@BlackHatEvents

SpecialInterfaces：Flash、HDMI、DP、DAP、Ethernet、Recovery

#BHASIA@BlackHatEvents

ResearchonOtherRelatedPeripherals--CAN

CapturetheWakeup

CANsignal

CANBUS

MCU

CANtransceiver

EachcontrollerhasmultipleCANchannels.Onesupportswake-upfunctionality,suchas

TJA1043.

CANinterfacepinscanbedeterminedbasedontheCANtransceiverpinout.

SomeADASsystemsrequireCANsignalsforwake-up,eitheranyCANsignalorspecific

IDanddatabits.#BHASIA@BlackHatEvents

ResearchonOtherRelatedPeripherals--Lidar

?Automotive-gradeLiDAR

?UsesEthernet

?Automakeradded20bytesofSOME/IPcommands

?Reverseengineeredautomaker'sdrivertoenableLiDARhackinganduse.

#BHASIA@BlackHatEvents

ResearchonOtherRelatedPeripherals--Serializer/Deserializer

Intheautomotivefield,imagetransmissiondoesnotuseHDMIorDisplayPort,UseLVDSfordatatransmissionand

powersupply.

Datatransmissioniscarriedoutbycalculatingminorvoltagechanges.

Technology:FPD-LinkandGMSL

Inthefieldofsecurity:Wecanperformcamerasimulationinjectionsandsaveondisplayscreens(whicharegenerally

expensive).

Instrumentdisplayscreen

(currentlyhassomecolorissues)

CameraInjectDevice

#BHASIA@BlackHatEvents

Risks

#BHASIA@BlackHatEvents

Firmware/DeployImage/DevelopmentDocument

#BHASIA@BlackHatEvents

Frameworks

#BHASIA@BlackHatEvents

TI/Nvidia/Horizon/MobieyeModelFiles

#BHASIA@BlackHatEvents

ModelConfiguration,RawModel

Convenientmodelinvocation,training,andfine-tuning#BHASIA@BlackHatEvents

AIComputeCenter

Training

Continuous

RoadTesting

DeploymentofAIModelsonVehicles

TechnicalRoadmap

LabeledData

Modeloutputconsumessignificant

computationalanddataresources,with

extensivepost-optimizationiterations.

Needstobeprotected

Inference

Model

OTA

Quantizationand

Optimization

ModelForBoard

Deployed

Case

Optimization

Asasecurityresearcher,youcannowmovebeyondusingYOLOformodel

adversarialresearch(GAN)andpaperwriting,asyouhaveaccesstorealmodels.#BHASIA@BlackHatEvents

SecurityAnalysisofModelFiles

Themodelfilecontainsthemodelstructureandparameterinformation

?Modelstructureisveryimportantasitformsthebasisofgoodresults.

?.onnx.ptareoriginalmodels,FP32,convenientfortrainingandtuning.

?.hbm.trt.engine.binarequantizedmodels,INT8,suitableforinferenceondeviceswithlowcomputingpower.

Conclusion:

?Donotdeploy/store.onnxmodelsinvehicles,it'sdangerous.

?Quantizedmodelslike.trtcanbedirectlyusedforinference.

?Modelstructureanalysisisalsopossible.

.onnx

.trt/.plan

#BHASIA@BlackHatEvents

AnalysisandReconstructionofModelFiles

Bevnet.onnx

+0First4bytesarefilemagic,ptrt,ftrt

+8Serializedversionnumber,0xd5,0xcd,0xe8

+0x10Modeldatasize

+0x18Serializeddata,TRTdefinesmultipletags,decoded

withhardcoding

Reverseengineeringonlibnvinfer.so.8usingFridahooks

#BHASIA@BlackHatEvents

AnalysisandReconstructionofModelFiles

CompiletheLeNetmodelusingTensorRTandparseit

withourscript.

Comparedtotheoriginalmodel,thestructureissimilar,

somelayersmergedandoptimized.

Parsetheacquiredmodel.

Multipletasksandoutputshapes.

#BHASIA@BlackHatEvents

AnalysisandReconstructionofModelFiles

model.hbm:

Reverseengineerhxxx-disasandhxxx-simprocesses.

Thefirstline:magicnumber;'X2A'indicatesthatthe

followingmodelinstructionsareforX2A.Other

instructions,suchasX2,B25,etc.

?X2ABERNOULLI2

?X2BERNOULLI

?B25BAYES

Theoffsettablestartsat0xB8,withoneentryfor

eachmodel,eachentryoccupying8bytes.

#BHASIA@BlackHatEvents

#BHASIA@BlackHatEvents

AnalysisandReconstructionofModelFiles

UseFridaforreverseengineering.

detection_segment_0containsinstructioninformation.

Startingat0x472E0,eachinstructionis8bytes,suchassome

convolutionoperations,whichareacceleratedintheBPU.

#BHASIA@BlackHatEvents

Demo：AToyCarUtilizingAnAutomotive-gradeAIRecognitionModel

A$50miniaturecar,withaNPU.

Weextractedasetof

modelsfromthe

ADAScontroller

Anddeployedthemontheminiaturecar.

Nowit'sworth$500

AboutTC3XXMCU

TriCoreTC3xxorRH850

AlmostallcontrollerscontaintheTC397andTC399.In

ADAS,Gateway,T-Box,IVI,VCU,othercontrollers

Why?

?SupportsASIL-Dsafetyrequirements.SoitcansendCANsignals.

?Lockstepcores,ECCprotectionforinstructionsanddata.

?Ethernet,FlexRay,CAN-FD,LIN,SPI.

InADAS：

Powermanagement

Faultdiagnosis

Steer-by-wire

CANTransceiver

CAN/FlexRay

Ultrasonicradar

MCUTC397

Arbitration

#BHASIA@BlackHatEvents

TC397FirmwareAnalysis

-ManysystemscontainMCUfirmwarefiles,evenwith.elfsymbolfiles.

-Ghidracanperformreverseanalysis!

-MCUfirmwareisreadable!Onlyafewautomakerssetreadprotection,typicallyprotectingonlyafewblocks.

-EveryADAScircuitboardhasDAPreadpins.

-WespecificallydesignedacoreboardreaderthatcanremovetheMCU,

solder,andperformfirmwarereading,debugging,andsignalanalysis.

#BHASIA@BlackHatEvents

ReverseEngineeringofTC397Firmware

?GhidracananalyzeTriCorehexfirmware.

?AnalyzingMCUfirmwareprimarilytounderstandCANcontrollogicbetter.BecauseSoCcannotdirectly

sendCAN.

?IdentifykeyfunctionsintheMCUtoconfirm

correspondingvehiclecontrolinterfacesintheSoC.

UDPreceivefunction

SinceallcontrollershavetheTC397MCU,thisisa

verygoodresearchdirection:

?AnalyzethesecurityofbasicmodulesinAUTOSAR(especiallythenetworkmodules).

?ExamineTriCore'ssecuritymechanisms(suchasencryption,protection),andwhethertheycanbebypassed.

#BHASIA@BlackHatEvents

HowtoControl

#BHASIA@BlackHatEvents

UltimateGoal:AchievingVehicleControl

AchievingvehiclecontrolistheultimategoalinresearchingADAS

controllers.

Weneedto:

?Understandthehardwarearchitecture,workflow,andsecurityrisksofADAScontrollers.

?Understandtheprinciplesofvehiclecontrolandcontrolsignals.

?Learnhowtoachievecompleteremotevehiclecontrol,including

gainingaccesstothevehiclenetworkandADASdevicepermissions.

Note:Duetothesignificantimpactofrelatedvulnerabilities,wewillnot

demonstratevehiclecontrolinthistalk.

Mainly:topopularizeknowledgeandsecurityrisksrelatedtoADAS

controllers.#BHASIA@BlackHatEvents

ECU2

Driver

ECU

Wire-controlledChassisTechnology

T-Box

GW

ADAS

IVI

VCU

ECU1

ADAS

#BHASIA@BlackHatEvents

IVI

ADAS

VCU

ECU1

ECU2

HowtoControlaVehicle

T-Box

GW

Controlthecar'sthrottle,steering,andbrakes

throughelectronicsignals(CAN).

Howtocontrolthevehicle:

?DirectlycontroltheECU(verydifficult,astheECUhasnooperatingsystemandnoattackentrypoints)

?DirectlycontrolAssisteddrivingmodule,

gatewayandVCU(challenging,asmostlackanoperatingsystemandETHnetworkinterface)

?Controltheautonomousdrivingdomaincontroller.

#BHASIA@BlackHatEvents

#BHASIA@BlackHatEvents

HowtoControlaVehicle--

ControllingtheGateway

Somevehicleswithautonomousdrivingfeatureshave

complexgatewaymodule:

?AnonboardCPUwithafullLinuxsystemandmultiplenetworkports.

?FunctionsincludeCANsignalcontrol,DoIPdiagnosticservices,OTAservices,andEthernetswitch.

Gainingshellaccesstothegatewayallowsfullcontrol

overthevehicle.

Limitations:

Advancedgatewayslikethesearerare.

Controllingthevehiclerequiresdetailedanalysisoflow-

levelCANmessages.

HowtoControlaVehicle–ControllingtheAssistedDrivingModule

Earlyassisteddrivingcars,suchasthosewithlane-keeping

functions,usetheMobileyeQ4Mchip.

Althoughsteeringcanbecontrolledviaelectronicsignals,the

limitationsinclude:

?OnlyhavingaCANinterface.

?AsimpleoperatingsystemonFPGA,withoutnetworkingcapabilities.

Thesefactorsmakeitimpossibletoaccessassisteddrivingdevices

overthenetwork,exploitvulnerabilities,andgaindevice

permissions.

#BHASIA@BlackHatEvents

Unabletocontrolthevehicle.

#BHASIA@BlackHatEvents

HowtoControlaVehicle–

ControllingtheADAS

Acompletecomputer(usuallyrunningLinux)with

networkconnectivity:

?Variousinterfaces,includingcamera,network,anddebugginginterfaces.

?AIinferencecapabilitieswithsubstantialcomputationalpower.

?ConnectedtothepowertrainCANandchassisCAN,itcancontrolthevehicle'sthrottle,

brakes,andsteeringwheel.

Howcanoneachievevehiclecontrol?

?First,gaincontroloftheADAS.InvokerelevantAPIs.

?TriggertheMCUtosendcontrolCANsignals.

Linux/QNX

Cameras

4/5Gmodule

Internet

CAN

T-Box

AndroidonQNX

Display

CAN

IVI

TelematicsCAN

InfoCAN

EthSwitch

CAN

CAN

CAN

CAN

CAN

VCU

GW

DiagCAN

BodyCAN

CAN

DoIP

OBD

Perception

Control

ADAS

SocOrin-X

CANMCUTC397

Chassis/PowertrainCAN

CAN

ECUs

AutoACDoor

Bodyelectronics

CAN

#BHASIA@BlackHatEvents

Cameras

4/5Gmodule

Internet

T-Box

CAN

EthSwitch

GW

T-Boxmoduleisthesoleremoteattackentrypoint.Containsmanyvulnerabilities.

Controlgatewaycanmanagethevehicle,butsomegatewayslackLinuxsystem,

onlyhaveMCU.AnalyzingunderlyingCANsignalsischallenging.

GainnetworkaccessthroughT-Boxvulnerabilities,controlADASdevices,thenuse

upper-levelAPItocontrolthevehicle,whichiseasyand