Seminar reports related to Electrical Engineering and Computer Science

Ghost Cars & Fake Obstacles: Automated Security Analysis of Self-driving

Car & Smart Traffic Light Systems

Qi Alfred Chen Department of Computer Science

A bit about me

• Qi Alfred Chen – Assistant Prof. in CS@UC Irvine – Ph.D., U of Michigan

• Area: Cybersecurity

2

Impact: Demo & vuln. report

3

NDSS’18 NDSS’18

NDSS’16 IEEE S&P’16

Euro S&P’17

Usenix Sec’14

NDSS’16

CCS’15

CCS’17

CCS’17

CCS’17

17,000 views a day!

Impact: Media coverage

4

IEEE S&P’16

Usenix Securiy’14 Euro S&P’17

Recent interest: Software security in smart transportation

5

Connected Vehicle (CV) Autonomous Vehicle (AV)

Recent interest: Software security in smart transportation

6

Connected Vehicle (CV) Autonomous Vehicle (AV)

[ISOC NDSS’18] First software security analysis of a CV-based transportation system

[Ongoing] First software security analysis of LiDAR-based AV perception

Recent interest: Software security in smart transportation

7

Connected Vehicle (CV) Autonomous Vehicle (AV)

[ISOC NDSS’18] First software security analysis of a CV-based transportation system

[Ongoing] First software security analysis of LiDAR-based AV perception

CV = Connected Vehicle OBU = On-Board Unit RSU = Road-Side Unit

Background: Connected Vehicle technology

• Wirelessly connect vehicles & infrastructure to dramatically improve mobility & safety

• Will soon transform transportation systems today – 2016.9, USDOT launched CV Pilot Program

8

RSU

OBU

CV technology Under

deployment

First security analysis of CV-based transp.

• Target: Intelligent Traffic Signal System (I-SIG) – Use real-time CV data for intelligent signal control – USDOT sponsored design & impl. – Fully implemented & tested in Anthem, AZ, & Palo Alto, CA

• ~30% reduction in total vehicle delay – Under deployment in NYC and Tampa, FL

9

I-SIG Control

Real-time CV data

RSU

CV = Connected Vehicle OBU = On-Board Unit RSU = Road-Side Unit

Threat model

• Malicious vehicle owners deliberately control the OBU to send spoofed data – OBU is compromised physically1, wirelessly2, or by malware3

• Can only spoof data, e.g., location & speed – Can’t spoof identity due to USDOT’s vehicle certificate system

10

I-SIG Influence signal control

Spoofed CV data

RSU

Malicious vehicle owner

Control

Real-time CV data

2 Checkoway et al.@Usenix Security'111 Koscher et al.@IEEE S&P’10 3 Mazloom et al.@Usenix WOOT’16

Attack goals

11

Traffic congestion Increase total delay of vehicles

in the intersection

Personal gain Minimize attacker’s travel time

(at the cost of others’)

Attack goals

12

Traffic congestion Increase total delay of vehicles

in the intersection

Personal gain Minimize attacker’s travel time

(at the cost of others’)

This work

Analysis approach overview

13

Analysis of Attack input data flow

Data spoofing strategies

Traffic snapshots from simulator

Congestion creation vuln.

Congestion creation exploit

Exploit construction

Dynamic analysis

Spoofing option enum

Increased delay calc

Spoofing w/ high delay inc

Source code

Analysis result summary

14

Analysis of Attack input data flow

Data spoofing strategies

Traffic snapshots from simulator

Congestion creation vuln.

Congestion creation exploit

Exploit construction

Dynamic analysis

Spoofing option enum

Increased delay calc

Spoofing w/ high delay inc

Source code

2 distinct types of algorithm-level vulnerabilities:

One single attack vehicle can greatly manipulate traffic control!

I-SIG system

15

I-SIG 1

2 3

4

5

67

8

COP (Controlled Optimization of Phases)

16

I-SIG

5

5 sec 5

Signal plan (green light length & order) with lowest total delay

Input: All vehicles’ location & speed

Output:

37

2

3

Delay = 15

Delay = 0Delay = 0 1

1: 5 sec 2: 3 sec 1: 7 sec (total delay: 15 sec)

Dynamic programming

5

3

1

COP (Controlled Optimization of Phases)

17

I-SIG

5

5

37

2

3

Delay = 15

Delay = 0Delay = 0 1

5

3

1

Data from one single vehicle: Very hard to affect signal plan

+3×n • Commonly, 1 vehicle vs > 25 vehicles’

delay in 5 conflicting lanes • Can’t change even 1 sec

+n

1

+n

537

Vuln #1: Last vehicle advantage

• Attack: Spoof to arrive as late as possible to increase the delay of queuing vehicles in other lanes

18

9

9 Delay = 15

Delay = 0Delay = 0

5

3

1

+12

I-SIG…

40

+105

5

1

2

Cause: Effectiveness & timeliness trade-off

• COP on RSU = 4-5 sec decision time < 3 sec • To meet timeliness requirement, customize COP to limit the

# of servings per lane – By default, only serve each lane once

19

9 Delay = 15

Delay = 0Delay = 0

5

3

1

+12

I-SIG

Timeliness

Security

Effectiveness Sub-optimal COP also good

537 9

5

Unexpectedly exposed vuln.

Sub-optimal COP

1

2

RSU = Road-Side Unit

Vuln #2: Curse of transition period

• I-SIG has 2 operation modes based on PR: – PR ≥ 95%, full deployment: Directly run COP – PR < 95%, transition: COP becomes ineffective, use an unequipped

vehicle estimation algorithm as pre-processing step

20

PR ≥ 95%

Unequipped vehicle estimation

COP algorithm

Yes (full deployment period)

No (transition period)

PR = Penetration Rate

Unequipped vehicle estimation algorithm

21

PR ≥ 95%

Unequipped vehicle estimation

COP algorithm

Yes (full deployment period)

No (transition period)

PR = Penetration Rate

Queuing regionSlow-down regionFree flow region

Vulnerable

Vulnerable queue estimation

• Data from one single attack vehicle can add 30-50 “ghost” vehicles to COP input

• Dramatically increase length of (wasted) green light

22

Spoof the vehicle location!

Est. queue length = 3

Est. queue length = 7

Attack video demo

• Demo time!

23

Lessons learned & defense discussion

• Domain-specific problem: Transition period vuln. exposure – Defense direction: Design robust algorithm for transition period

• Need joint research efforts in both transportation & security • General problem in real-time IoT/CPS: Security vs timeliness

– Defense direction: Speed-up COP to avoid sub-optimal customization

• E.g., offload computation to a nearby workstation or cloud, or use FPGA to accelerate COP

• General problem in IoT/CPS: Sensor data spoofing – Defense direction: Data spoofing detection by cross-checking

OBU data validity using infrastructure-controlled sensors • E.g., loop detectors, cameras

24 OBU = On-Board Unit

Summary

• The first software security analysis of a Connected Vehicle based transportation system, I-SIG – Discovered new types of security vulnerability at control

algorithm level – Uncovered problem causes: Traffic control algorithm

implementation & configuration choices

• Reported to USDOT CV Pilot Program office & sites (NYC, Tampa)

25 CV = Connected Vehicle USDOT = United States Department of Transportation

https://tinyurl.com/congestion-attack

Recent interest: Software security in smart transportation

26

Connected Vehicle (CV) Autonomous Vehicle (AV)

[ISOC NDSS’18] First software security analysis of a CV-based transportation system

[Ongoing] First software security analysis of LiDAR-based AV perception

Recent interest: Software security in smart transportation

27

Connected Vehicle (CV) Autonomous Vehicle (AV)

[ISOC NDSS’18] First software security analysis of a CV-based transportation system

[Ongoing] First software security analysis of LiDAR-based AV perception

Background: Autonomous Vehicle technology

• Equip vehicles with various types of sensors to enable self driving

28

Background: Autonomous Vehicle technology

• Under active development in huge number of companies, some already made into production

29

Goal: First security analysis of AV software

• New attack surface: Sensors – Key input channel for critical control decisions – Public channel shared with potential adversaries

• Fundamentally unavoidable attack surface!

• LiDAR

30

Background: LiDAR basics

31

Background: LiDAR attacks

• Known attack: LiDAR spoofing1 – Shoot laser to LiDAR to inject points

32 1 Shin et al.@CHES’17

How to use this to attack AV software control logic?

First security analysis of LiDAR-based perception in AV

• Target: Baidu Apollo AV software system – Production-grade system, drive some buses in China already – Open sourced (“Android in AV ecosystem”) – Partner with 100+ car companies, including BMW, Ford, etc.

• Attack: LiDAR spoofing attack from road-side laser shooting devices to create fake objects – Trigger undesired control operations, e.g., emergency brake

33

Set up road-side device to shoot laserFake

object

LiDAR input workflow in Apollo

34

ROI filter Data

aggregation Deep learning

model Point cloud

data Objectness

LiDAR input workflow with attack

35

ROI filter Data

aggregation Deep learning

model Point cloud

data

Spoofed data points from LiDAR spoofing

Objectness

LiDAR input workflow with attack

36

ROI filter Data

aggregation Deep learning

model Point cloud

data Objectness

Data trace of LiDAR spoofing

Attack parameters: - Rotation - Scale - Height

Attack data synthesis

Analysis approach

37

ROI filter Data

aggregation Deep learning

model Point cloud

data Objectness

Data trace of LiDAR spoofing

Attack parameters: - Rotation - Scale - Height

Attack data synthesis

Gradient descent

Input: Math function

Increase

Change

Analysis approach

38

ROI filter Data

aggregation Deep learning

model Point cloud

data Objectness

Data trace of LiDAR spoofing

Attack parameters: - Rotation - Scale - Height

Attack data synthesis

Gradient descent

Input: Math function

Increase

Change

Math function for pre-processing steps

Model

Analysis results

• Successfully find attack input that can inject fake object!

39

That’s good. But…why?

Only a line of floating points are injected

40

x

y

Real obstacle’s point cloud should look very different

41

x

y

Real obstacle’s point cloud should look very different

42

Why the detection process is making such mistakes?

Likely cause: Vulnerable pre-processing step

• Pre-processing step for deep learning aggregates heights per cell

43

Likely cause: Vulnerable pre-processing step

• Pre-processing step for deep learning aggregates heights per cell

44

Average height

Likely cause: Vulnerable pre-processing step

• Pre-processing step for deep learning aggregates heights per cell

45

Average height

Average height

The injected line of floating points appears to be a even bigger object!

Likely cause: Vulnerable pre-processing step

• Pre-processing step for deep learning aggregates heights per cell – Maybe designed to increase the efficiency of deep

learning by reducing the feature size – However, unexpectedly become vulnerable to

attacks that even inject a line of floating points

46

Security implication: Emergency brake attack

47

• Cause AV to decrease speed from 43km/h to 0 km/h within 1 sec!

Security implication: Car “freezing” attack

48

• “Freeze” an AV at an intersection forever!

Defense discussion

• Improve the pre-processing step for the deep learning process – Direct patch: Filter a line of floating points

• Limited to specific sensor attack pattern – Some new attacks can generate a wall of points

– More general solution: Add learning features to describe more fine-grained info. about point distributions in a cell

• How to select the right granularity may be challenging

49

Summary & future work

• First software security analysis of LiDAR-based perception in a production-grade AV system – Discovered malicious sensor attack input that can inject fake

obstacles – Uncovered likely problem cause: DNN feature design choice – Identified two concrete attack scenarios to demonstrate attack

impact at AV driving decision level • Future work

– Understand attack practicality in real world – Understand attack generality

• Study other LiDAR-based AV perception design – Explore concrete design of defense solutions

50

Conclusion

• Initiated the first research efforts to perform systematic software security analysis of CAV systems

• Discovered new attacks, analyzed root causes, and demonstrated security & safety implications

• Only the beginning of CAV software security research – Inherently an inter-disciplinary direction, always open to

collaboration!

Contact: Qi Alfred Chen Computer Science, UC Irvine Email: [email protected] Homepage: https://www.ics.uci.edu/~alfchen/