On the Feasibility of Remotely Triggered Automotive Hardware Trojans

Modern vehicles are comprised of many separate computer systems running on Electronic Control Units, or ECUs. These ECUs allow for functionalities as diverse as advanced computer-aided safety features to browsing the web. However, the explosion of ECU-enabled capabilities has presented flaws that allow adversaries to literally stop vehicles in their tracks without physical access to said vehicles. Normally, causing of unintended behavior would require physical access to the ECU and/or exploitation of vulnerabilities present in the ECU's software. In this paper, we discuss how Hardware Trojans can act as the physical access intermediates to allow the remote triggering of malicious payloads embedded in ECUs, through seemingly benign wireless communication. We demonstrate a proof of concept ECU hardware trojan (HT) on a RISC-V based processor emulating an ECU. The HT takes advantage of benign radio functionality, emulated by TCP packet transmission, to provide a triggering pathway for disabling the ECU and thus, the host vehicle. This attack vector, enabled by deep and often opaque international supply chains common in the automotive industry, provides a stealthy way to conduct both targeted and fleet-wide remote attacks against vehicles.