RollBack: A New Time-Agnostic Replay Attack Against the Automotive Remote Keyless Entry Systems
Authors:
Levente Csikor,
Hoon Wei Lim,
Jun Wen Wong,
Soundarya Ramesh,
Rohini Poolat Parameswarath,
Mun Choon Chan
Abstract:
Today's RKE systems implement disposable rolling codes, making every key fob button press unique, effectively preventing simple replay attacks. However, a prior attack called RollJam was proven to break all rolling code-based systems in general. By a careful sequence of signal jamming, capturing, and replaying, an attacker can become aware of the subsequent valid unlock signal that has not been us…
▽ More
Today's RKE systems implement disposable rolling codes, making every key fob button press unique, effectively preventing simple replay attacks. However, a prior attack called RollJam was proven to break all rolling code-based systems in general. By a careful sequence of signal jamming, capturing, and replaying, an attacker can become aware of the subsequent valid unlock signal that has not been used yet. RollJam, however, requires continuous deployment indefinitely until it is exploited. Otherwise, the captured signals become invalid if the key fob is used again without RollJam in place. We introduce RollBack, a new replay-and-resynchronize attack against most of today's RKE systems. In particular, we show that even though the one-time code becomes invalid in rolling code systems, replaying a few previously captured signals consecutively can trigger a rollback-like mechanism in the RKE system. Put differently, the rolling codes become resynchronized back to a previous code used in the past from where all subsequent yet already used signals work again. Moreover, the victim can still use the key fob without noticing any difference before and after the attack. Unlike RollJam, RollBack does not necessitate jamming at all. Furthermore, it requires signal capturing only once and can be exploited at any time in the future as many times as desired. This time-agnostic property is particularly attractive to attackers, especially in car-sharing/renting scenarios where accessing the key fob is straightforward. However, while RollJam defeats virtually any rolling code-based system, vehicles might have additional anti-theft measures against malfunctioning key fobs, hence against RollBack. Our ongoing analysis (covering Asian vehicle manufacturers for the time being) against different vehicle makes and models has revealed that ~70% of them are vulnerable to RollBack.
△ Less
Submitted 14 September, 2022;
originally announced October 2022.
Decentralized Identifier-based Privacy-preserving Authenticated Key Exchange Protocol for Electric Vehicle Charging in Smart Grid
Authors:
Rohini Poolat Parameswarath,
Prosanta Gope,
Biplab Sikdar
Abstract:
The popularity of Electric Vehicles (EVs) has been rising across the globe in recent years. Smart grids will be the backbone for EV charging and enable efficient consumption of electricity by the EVs. With the demand for EVs, associated cyber threats are also increasing. Users expose their personal information while charging their EVs, leading to privacy threats. This paper proposes a user-empower…
▽ More
The popularity of Electric Vehicles (EVs) has been rising across the globe in recent years. Smart grids will be the backbone for EV charging and enable efficient consumption of electricity by the EVs. With the demand for EVs, associated cyber threats are also increasing. Users expose their personal information while charging their EVs, leading to privacy threats. This paper proposes a user-empowered, privacy-aware authenticated key exchange protocol for EV charging in smart grid. The proposed protocol is based on the concept of Decentralized Identifier (DID) and Verifiable Credentials (VCs). The use of DIDs empowers users by helping them to have complete control over their identities. The charging station and the user verify that the other party is legitimate before proceeding with the charging services using VC. Key recovery is another issue we address in this paper. A method to recover lost keys is incorporated into the proposed protocol. We present formal security proof and informal analysis to show that protocol's robustness against several attacks. We also provide a detailed performance analysis to show that the proposed protocol is efficient.
△ Less
Submitted 27 June, 2022;
originally announced June 2022.
