Fuzz-Tests für die Bordladesteuerung von Elektrofahrzeugen

During the cyber security assessment of an On-board Charging control ECU of an electric vehicle, KPIT identified 133 threats and 12 vulnerabilities in application mode, and 111 threats and 13 vulnerabilities in boot and flashing mode. After acceptance of these findings, our customer, a German Tier1, working on an electrical vehicle OEM program; asked KPIT to execute Fuzz testing of the same ECU to find out the internal vulnerabilities.

Key Highlights:

• Developed a Fuzzer which can be used to find hidden vulnerabilities of an Automotive Systems by sending fuzzed data over CAN (UDS) protocol, using mutation-based Fuzz Testing.
• Mutation of the valid input request is carried out; mutated inputs are provided to the SUT and SUT’s responses are analyzed for any crash or halt.
• By providing invalid input to the system, the behavior of the ECU is observed. The erroneous responses of ECU (vulnerabilities) are found and reported. These requests and responses are stored in a file and analyzed.
• Generated list of vulnerable messages
• Converted complete development from Python to CAPL to support customer, as customer was working on CANOE based tools.
• Identified found number of anomalies in mutation phase, which could become the reasons for Denial of service attack and reply attack on automotive systems.