Stop! Camera Spoofing Via the in-Vehicle IP Network

Autonomous driving and advanced driver assistance systems (ADAS) rely on cameras to control driving. In many prior approaches, an attacker that gained access to the vehicle's internal network intending to stop the vehicle had to send messages on the specialized and better-defended CAN bus. We suggest an easier alternative: manipulate the IP-based network communication between the camera and the ADAS logic, inject fake images of stop signs or red lights into the video stream, and let the ADAS stop the car safely. We created such an attack tool that successfully exploits the GigE Vision protocol. Then we analyze two classes of passive anomaly detectors to identify such attacks: protocol-based detectors and videobased detectors. We implemented multiple detectors of both classes and evaluated them on data collected from our test vehicle and also on data from public corpus. Our results show that such detectors are effective against naive adversaries, but sophisticated adversaries can evade detection, by making modifications to small portions of the frame. Finally, we propose a novel class of active defense mechanisms that randomly adjust camera parameters during the video transmission and verify that the received images obey the requested adjustments. Within this class, we focus on a specific implementation, the width-varying defense, which randomly modifies the width of every frame. Beyond its function as an anomaly detector, this defense is also a protective measure against certain attacks: by distorting injected image patches, it prevents their recognition by the ADAS logic. We demonstrate the effectiveness of the width-varying defense through theoretical analysis and by an extensive evaluation of several types of attack in a wide range of realistic road driving conditions. The best the attack was able to achieve against this defense was injecting a stop sign for a duration of 0.2 seconds, with a success probability of 0.2 %, while stopping a vehicle takes about 2.5 seconds.