The Vehicle May Be Sick: Denial of Diagnostic Services by Exploiting the CAN Transport Protocol

Technical Summary: "The Vehicle May Be Sick: Denial of Diagnostic Services by Exploiting the CAN Transport Protocol"

1. Problem Statement

Modern vehicle maintenance and safety rely heavily on Unified Diagnostic Services (UDS), which allows technicians to access Electronic Control Units (ECUs) to read fault codes, monitor sensors, and reprogram systems. While most existing research focuses on vulnerabilities at the application layer (e.g., unauthorized access or malicious command injection), the transport layer—specifically the ISO 15765-2 (CAN Transport Protocol/ISO-TP)—has been largely overlooked.

The ISO 15765-2 standard was designed for efficiency and reliability in message segmentation and reassembly but was developed without inherent security considerations. This creates a critical research gap: an attacker who can manipulate the transport layer can disrupt diagnostic communication regardless of any security protections implemented at the application layer.

2. Methodology

The researchers employed a systematic approach to identify and validate vulnerabilities:

• Attack Derivation: The authors performed a deep logical analysis of the ISO 15765-2 standard, focusing on frame characteristics (Single, First, Consecutive, and Flow Control frames), transmission mechanisms, and error-handling routines. This led to the identification of eight novel attack scenarios (A1–A8).
• Adversary Model: The model assumes an attacker has gained access to the CAN bus (via compromised infotainment, wireless interfaces, or physical OBD-II access) and can both monitor and inject arbitrary CAN messages.
• Experimental Setup: The attacks were tested on a real 2021 Hyundai Elantra CN7 passenger vehicle. The researchers used two distinct diagnostic tools to ensure practical relevance:
  1. G-Scan3: An OEM-level tool capable of high-security authentication (Secure Gateway).
  2. OBDSCAN4.0 (via ELM327): A common, low-cost aftermarket tool.
• Validation: The team executed the attacks and analyzed the resulting CAN message traces and the diagnostic outputs (e.g., DTCs, sensor data, and ECU identifiers) to measure the impact.

3. Key Contributions

• Identification of 8 Novel Attacks: The paper categorizes attacks based on whether they exploit frame characteristics, transmission logic, or error-handling mechanisms.
• First Transport-Layer Analysis: It provides the first comprehensive security analysis of the ISO 15765-2 standard in a real-world automotive context.
• Mitigation Framework: The authors propose specific technical countermeasures for each attack (e.g., stateful tracking, FIFO queue-based session management, and service-based allow-listing).
• Demonstration of Real-World Impact: The study proves that these attacks are not merely theoretical but can actively deceive professional diagnostic tools.

4. Results

The researchers found that while all eight attacks were successfully executed, three specific scenarios (A4, A5, and A6) had the most significant impact on the diagnostic process:

• A4 (DataLength Attack): Exploits the FF_DL field to exceed buffer sizes, causing the receiver to abort.
• A5 (SequenceNumber Attack): Injects a CF with an incorrect sequence number, forcing the receiver to terminate the session.
• A6 (Session Override Attack): Sends a new SF or FF during an active session, causing the receiver to overwrite the current data with a new session.

Impact on Vehicle Functions:

• Concealed Faults: Attacks caused the G-Scan3 to report "0" DTCs (Diagnostic Trouble Codes) even when errors existed, effectively masking critical vehicle defects.
• Manipulated Sensor/Test Data: In functional tests (like evaporative emission leak tests), the attacks induced false "gas leak detected" readings, which could lead to unnecessary repairs or regulatory non-compliance.
• Data Corruption/Omission: Attacks increased diagnostic time by up to six times and caused "data spraying," where valid information was overwritten by initialization values.

5. Significance

This research highlights a fundamental flaw in automotive cybersecurity architecture: Application-layer security (like AUTOSAR SecOC) is insufficient if the underlying transport layer is unprotected. Because SecOC authenticates the payload but not the transport control fields (like sequence numbers or length indicators), the proposed attacks remain effective even in "secure" vehicles.

The findings serve as a critical warning to Original Equipment Manufacturers (OEMs) to implement transport-layer defenses and provide a motivation for future updates to international automotive security standards (such as ISO/SAE 21434) to include mandatory controls for the CAN transport protocol.