Smart Black Box Fuzzing for Real-World Automotive ECUs
Researchers present smart black-box fuzzing for automotive ECUs, generating protocol-aware UDS CAN testcases and handling recovery without coverage feedback.
Summary
The Challenges of Black-Box Vehicle Fuzzing
Performing security fuzzing on production automotive ECUs is hindered by the inability to instrument binary coverage and the unpredictability of hardware crash states.
Generating Protocol-Aware UDS CAN Testcases
Soohwan Oh, Jonghyuk Song, and Jeongho Yang design testcase generators informed by Unified Diagnostic Services (UDS) message flows, service IDs, and frame formatting.
Detecting Sub-System Errors and Negative Response Codes
The speakers outline automated heuristics to detect silent ECU failures by tracking timeouts, Negative Response Codes (NRCs), and Diagnostic Trouble Codes (DTCs).
Automating Recovery and Continuous Testing
The authors demonstrate automated session reset procedures using `ClearDiagnosticInformation` and `ECUReset` commands to keep target ECUs alive during extended fuzzing runs.
Related talks
Car Hacking Village·40 min
Samir Bhagwat
Samir Bhagwat delivers an overview of automated fuzzing techniques for CAN and CAN FD electronic control units and in-vehicle networks.
HITCON 2025·1 hr 5 min
RAMN Testbeds
Analysts investigate attack surfaces and defenses concerning From CAN Bus to Compromised ECU: Hands-On Automotive Hacking with RAMN Testbeds.
Creator Stage·23 min
Seunghee Han
Uncovers safety-critical vehicle vulnerabilities via UDSonCAN diagnostic fuzzing, demonstrating unauthenticated vehicle acceleration and braking.