skip to main content
10.1145/3538969.3543802acmotherconferencesArticle/Chapter ViewAbstractPublication PagesaresConference Proceedingsconference-collections
research-article
Open access

An Internet-Wide View of Connected Cars: Discovery of Exposed Automotive Devices

Published: 23 August 2022 Publication History

Abstract

As the number of connected cars increases, cyber-attacks targeting them become significant risks. Especially, On-Board Equipment (OBE) that is directly accessible from the Internet can be an immediate target. However, it is not known what kind of and how many connected automotive devices can be remotely accessed from the Internet and, if compromised, become an entry point for further attacks on in-vehicle networks. In this study, we investigate the prevalence of such exposed vehicular devices. We propose a discovery method that utilizes an Internet-wide scan engine and a regular web search engine to find Internet-facing OBE. Using the proposed method, we discovered 2,532 devices of 12 different OBE products across 27 countries. We also investigated the potential cyber-attack risks against the discovered devices. 11 out of the 12 products have security concerns for remote compromises, such as running Telnet or outdated server programs. Moreover, we found that nine products have the capability to connect to the in-vehicle network. We could confirm from the information displayed in their user interface that at least two of them indeed connected to the in-vehicle network. Additionally, we noticed three products expose privacy-sensitive information such as GPS location. We believe this result provides a lower bound of the security risk of Internet-facing vehicular devices.

References

[1]
[1] A. Greenberg, ”Hacker remotely kill a jeep on the highway - with me in it” in Wired, 21 July 2015.
[2]
[2] Upstream Auto, ”Global Automotive Cybersecurity Report 2021,” in 2020, pp. 12-28
[3]
[3] ”Censys”, https://censys.io
[4]
[4] ”Shodan”, https://shodan.io
[5]
[5] ”Zoomeye”, https://www.zoomeye.org
[6]
[6] M. Bada, and I. Pete, ”An exploration of the cybercrime ecosystem around Shodan”, in 2020 7th International Conference on Internet of Things: Systems, Management and Security(IOTSMS), 2020.
[7]
[7] J. Bugeja, D. Jonsson, and A. Jacobsson, ”An investigation of vulnerabilities in smart connected cameras.” in 2018 IEEE International Conference on Pervasive Computing and Communications Workshops(PerCom Workshops), 2018.
[8]
[8] N. Vlajic and D. Zhou, ”IoT as a land of oppotunity for ddos hackers.”, Computer, vol.51 no. 7, pp. 26-24, in 2018.
[9]
[9] B. Ur, J. Jung, S. Schechter, ”The Current State of Access Control for Smart Devices in Homes,” Workshop on Home Usable Privacy and Security (HUPS).” in 2013.
[10]
[10] T. Sasaki, A. Fujita, C.H. Ganan, M. van Eeten, K. Yoshioka, and T. Matsumoto, ”Exposed Infrastructures: Discovery, Attacks and Remediation of Insecure ICS Remote Management Devices”, in 2022 IEEE Symposium on Security and Privacy, San Francisco, CA, US, 2022 pp. 1308-1325.
[11]
[11] A. Mirian, Z. Ma, D. Adrian, M. Tischer, T. Chuenchujit, T. Yardley, R. Berthier, J. Mason, Z. Durumeric, J.Alex Halderman, and M. Bailey, ”An internet-wide view of ics devices,” in 2016 14th Annual Conference on Privacy, Security and Trust (PST), 2016, pp.96-103.
[12]
[12] J.Carlos Norte, ”Hacking industrial vehicle from the Internet”, http://jcarlosnorte.com/security/2016/03/06/hacking-tachographs-from-the-internets.html
[13]
[13] S. Checkoway, D. McCoy, B. Kantor, D. Anderson, H. Shacham, S. Savage, K. Koscher, A. Czeskis, F. Roesner, and T. Kohno ”Comprehensive experimental analysis of automotive attack surface,” USENIX in 2021.
[14]
[14] C. Miller and C. Valasek, ”Remote exploitation of unaltered passenger vehicle,” https://illmatics.com/Remote%20Car%20Hacking.pdf
[15]
[15] Tencent Keen Security Lab. ”Car Hacking Research: Remote Attack Tesla Motors,” https://keenlab.tencent.com/en/2016/09/19/Keen-Security-Lab-of-Tencent-Car-Hacking-Research-Remote-Attack-to-Tesla-Cars/
[16]
[16] Tencent Keen Security Lab. ”Experimental Security Assessment of BMW Cars: A Summary Report,” https://keenlab.tencent.com/en/whitepapers/Experimental_Security_Assessment_of_BMW_Cars_by_KeenLab.pdf
[17]
[17] Tencent Keen Security Lab. ”Tencent Keen Security Lab: Experimental Security Assessment on Lexus Cars,” https://keenlab.tencent.com/en/2020/03/30/Tencent-Keen-Security-Lab-Experimental-Security-Assessment-on-Lexus-Cars/
[18]
[18] S.Sharma and A. Kaul, ”A surbey on intrusion detection system and honeypot based proactive security mechanisms in VANETs and VANET cloud,” Vehicular Communications, vol. 12, pp. 138-164, 2018.
[19]
[19] Y.Maria. Schmitz, ”A strategy for vehicular honeypots,” https://www.researchgate.net/publication/333132722_A_strategy_for_vehicular_honeypots
[20]
[20] S. Panda, S. Rass, S. Moschoyiannis, K. Liang, G. Loukas, and E. Panaousis, ”HoneyCar: A Framework to Configure Honeypot Vulnerabilities on the Internet of Vehicles,” https://arxiv.org/abs/2111.02364
[21]
[21] ”Nmap”, https://nmap.org
[22]
[22] ”Selenium”, https://www.selenium.dev
[23]
[23] ”ssdeep”, https://ssdeep-project.github.io/index.html
[24]
[24] ”scipy”, https://scipy.org

Cited By

View all
  • (2025)Hacking Exposed: Leveraging Google Dorks, Shodan, and Censys for Cyber Attacks and the Defense Against ThemComputers10.3390/computers1401002414:1(24)Online publication date: 15-Jan-2025
  • (2024)Penetration Testing of In-Vehicle Infotainment Systems in Connected Vehicles2024 IEEE Vehicular Networking Conference (VNC)10.1109/VNC61989.2024.10575976(156-163)Online publication date: 29-May-2024
  • (2024)Who Left the Door Open? Investigating the Causes of Exposed IoT Devices in an Academic Network2024 IEEE Symposium on Security and Privacy (SP)10.1109/SP54263.2024.00117(2291-2309)Online publication date: 19-May-2024
  • Show More Cited By

Recommendations

Comments

Information & Contributors

Information

Published In

cover image ACM Other conferences
ARES '22: Proceedings of the 17th International Conference on Availability, Reliability and Security
August 2022
1371 pages
ISBN:9781450396707
DOI:10.1145/3538969
Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than the author(s) must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from [email protected].

Publisher

Association for Computing Machinery

New York, NY, United States

Publication History

Published: 23 August 2022

Permissions

Request permissions for this article.

Check for updates

Author Tags

  1. Censys
  2. Connected cars
  3. Discovery
  4. Exposed cars
  5. Internet-wide scan

Qualifiers

  • Research-article
  • Research
  • Refereed limited

Funding Sources

Conference

ARES 2022

Acceptance Rates

Overall Acceptance Rate 228 of 451 submissions, 51%

Contributors

Other Metrics

Bibliometrics & Citations

Bibliometrics

Article Metrics

  • Downloads (Last 12 months)359
  • Downloads (Last 6 weeks)50
Reflects downloads up to 19 Feb 2025

Other Metrics

Citations

Cited By

View all
  • (2025)Hacking Exposed: Leveraging Google Dorks, Shodan, and Censys for Cyber Attacks and the Defense Against ThemComputers10.3390/computers1401002414:1(24)Online publication date: 15-Jan-2025
  • (2024)Penetration Testing of In-Vehicle Infotainment Systems in Connected Vehicles2024 IEEE Vehicular Networking Conference (VNC)10.1109/VNC61989.2024.10575976(156-163)Online publication date: 29-May-2024
  • (2024)Who Left the Door Open? Investigating the Causes of Exposed IoT Devices in an Academic Network2024 IEEE Symposium on Security and Privacy (SP)10.1109/SP54263.2024.00117(2291-2309)Online publication date: 19-May-2024
  • (2024)ZBanner: Fast Stateless Scanning Capable of Obtaining Responses over TCP2024 IEEE International Performance, Computing, and Communications Conference (IPCCC)10.1109/IPCCC59868.2024.10850469(1-6)Online publication date: 22-Nov-2024
  • (2024)A Comprehensive Review of Open Source Intelligence in Intelligent Transportation Systems2024 International Conference on Intelligent Environments (IE)10.1109/IE61493.2024.10599907(109-116)Online publication date: 17-Jun-2024
  • (2023)MENDER: Multi-level Feature Fusion Discovery Framework for Exposed ICS Remote Management Devices in the Wild2023 IEEE 22nd International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom)10.1109/TrustCom60117.2023.00160(1173-1180)Online publication date: 1-Nov-2023
  • (2023)EV Charging Infrastructure Discovery to Contextualize Its Deployment SecurityIEEE Transactions on Network and Service Management10.1109/TNSM.2023.331840621:1(1287-1301)Online publication date: 4-Oct-2023
  • (2023)Identifying Exposed ICS Remote Management Device using Multimodal Feature in the Wild2023 IEEE International Performance, Computing, and Communications Conference (IPCCC)10.1109/IPCCC59175.2023.10253862(220-227)Online publication date: 17-Nov-2023

View Options

View options

PDF

View or Download as a PDF file.

PDF

eReader

View online with eReader.

eReader

HTML Format

View this article in HTML Format.

HTML Format

Login options

Figures

Tables

Media

Share

Share

Share this Publication link

Share on social media