Low-Level Automotive ECU Security

Vehicle Vulnerabilities What keeps an automotive electronic control unit (ECU) secure? A lot of this depends on its main MCU’s security, so in this article Colin investigates how electromagnetic fault injection (EMFI) can bypass security of a particular automotive MCU. Knowing this will help you make smarter decisions about building a device—even with the vulnerability present. Topics Discussed How can EMFI bypass security of a particular automotive MCU?How does the Boot Assist Module (BAM) work?What are the power analysis results? How to perform and attack using the CW308T-MPC5676R boardHow to analyze the attack as a real-life attackHow to deal with false positives Tech Used NXP MPC5676R MCUNXP MPC5777C MCUNewAE Technology CW308T-MPC5676R boardNewAE Technology ChipSHOUTER EMFI tool In this article, I will be looking at some work I started last year. In particular, this was driven by an interesting article headline I read that claimed the 2020 C8 Corvette would have an “unhackable” ECU [1]. Of course, such claims are going to generate immediate interest from me! Here, I'm exploring a slightly older device to understand where vulnerabilities lie. I grabbed an ECU from a Chevrolet Silverado 2500 HD, part number 12691652. In the model number lingo of GM ECUs, this is a E41 ECU, whereas the C8 Corvette is a E99 ECU. A photo of the main board of the E41 is shown in Figure 1 and the E99 is in Figure 2. The main difference here is the microcontroller (MCU) used. The E41 uses a NXP MPC5676R device from NXP Semiconductor and the E99 uses NXP's MPC5777C device. The newer MPC5777C has improved security features compared to the MPC5676R, so even with that tantalizing lead-in I am not actually looking at the E99 device! Instead, I am going to be looking at (what appears to be) one generation before the E99 ECU. There is still a lot to learn about this device. I will explore how a simple fault injection attack allows bypassing of se