Cloaking the Clock: Emulating Clock Skew in Controller Area Networks
Sang Uk Sagong, Xuhang Ying, Andrew Clark, Linda Bushnell, Radha, Poovendran

TL;DR
This paper introduces a cloaking attack that manipulates message timing in vehicle networks to mimic ECU clock skew, deceiving intrusion detection systems and exposing security vulnerabilities.
Contribution
It presents the first cloaking attack that can successfully deceive clock skew-based IDSs in in-vehicle networks, demonstrating a new threat model.
Findings
Cloaking attack can always deceive both tested IDSs.
The attack is effective on hardware testbeds and real vehicles.
Introduces the Maximum Slackness Index to measure attack effectiveness.
Abstract
Automobiles are equipped with Electronic Control Units (ECU) that communicate via in-vehicle network protocol standards such as Controller Area Network (CAN). These protocols are designed under the assumption that separating in-vehicle communications from external networks is sufficient for protection against cyber attacks. This assumption, however, has been shown to be invalid by recent attacks in which adversaries were able to infiltrate the in-vehicle network. Motivated by these attacks, intrusion detection systems (IDSs) have been proposed for in-vehicle networks that attempt to detect attacks by making use of device fingerprinting using properties such as clock skew of an ECU. In this paper, we propose the cloaking attack, an intelligent masquerade attack in which an adversary modifies the timing of transmitted messages in order to match the clock skew of a targeted ECU. The attack…
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
