Free IP, Free Chaos DHCP Assisted Flooding Auto Ethernet

The talk looks at automotive Ethernet, which modern cars use for UDS diagnostics, and at how DHCP support on the diagnostic port can let an outsider obtain a valid address and reach gateway and ECU interfaces. The speaker contrasts this with static addressing, where an attacker would need both the correct target and the source address the device expects. With DHCP, the vehicle simply asks for an address and the attacker's laptop answers.

The central contribution is a way to measure flooding on Ethernet. Chinese and UN vehicle rules require denial-of-service tests, but they define no metric or threshold for Ethernet, so the speaker proposes packets per second. A sweep in 5,000 pps steps showed the vehicle reacting around 50,000 pps. The sender split the target rate across CPU cores so the rate stayed exact and repeatable. Floods aimed at an unused address had no effect, so the load landed only on the host that owned the assigned IP. On one production vehicle, a stationary flood at 50,000 pps shut off the engine and produced false warnings. A flood during slow driving caused a sudden stop at very low speed. At one million pps the instrument cluster went dark and stayed that way until the unit powered down. An open diagnostic port also answered an ECU reset sent over it.

The takeaways are to define a packets-per-second threshold for Ethernet denial-of-service testing and to restrict or disable DHCP on diagnostic interfaces, or limit it to authenticated testers. The speaker says the case was disclosed to the manufacturer, with a fix scheduled for November 2026.