Skip to content

Latest commit

 

History

History
113 lines (88 loc) · 9.95 KB

threat-modeling.md

File metadata and controls

113 lines (88 loc) · 9.95 KB

Threat Model Analysis for commaai/openpilot

Threat: Malicious CAN Bus Injection (Steering)

  • Threat: Malicious CAN Bus Injection (Steering)

    • Description: An attacker injects crafted CAN messages through a compromised openpilot component (Panda firmware or openpilot software) to override openpilot's steering commands. The attacker leverages a vulnerability within openpilot to send malicious steering requests.
    • Impact: Loss of steering control, unintended turns, potential for high-speed collisions, vehicle veering off the road.
    • Affected Component: Panda firmware, can.cc (CAN message handling), controlsd (control logic).
    • Risk Severity: Critical
    • Mitigation Strategies:
      • CAN Message Authentication: Implement cryptographic message authentication codes (MACs) for all safety-critical CAN messages originating from openpilot.
      • Panda Firmware Hardening: Secure boot, code signing, vulnerability patching, and regular security audits of the Panda firmware.
      • Input Validation: Rigorous input validation and range checking within controlsd and can.cc to reject out-of-bounds or implausible steering commands received from other openpilot components.
      • Intrusion Detection: Monitor the CAN bus for anomalous message patterns originating from the Panda indicative of injection attacks.

Threat: Malicious CAN Bus Injection (Acceleration/Braking)

  • Threat: Malicious CAN Bus Injection (Acceleration/Braking)

    • Description: An attacker injects CAN messages via a compromised openpilot component to control the vehicle's acceleration or braking. This relies on a vulnerability within openpilot itself to send unauthorized commands.
    • Impact: Sudden, unintended acceleration or braking, rear-end collisions, loss of control, potential for injury or death.
    • Affected Component: Panda firmware, can.cc, controlsd.
    • Risk Severity: Critical
    • Mitigation Strategies: (Same as Malicious CAN Bus Injection (Steering), plus):
      • Redundant Braking System Monitoring: Implement independent monitoring within openpilot of brake system commands and compare them to expected values.

Threat: Sensor Spoofing (Radar) - Impacting openpilot's Processing

  • Threat: Sensor Spoofing (Radar) - Impacting openpilot's Processing

    • Description: An attacker transmits false radar signals, and openpilot's processing of this data leads to incorrect decisions. The vulnerability lies in openpilot's inability to detect or mitigate the spoofed data.
    • Impact: Unnecessary braking, failure to detect actual obstacles, collisions.
    • Affected Component: radard (radar processing), perception algorithms within camerad and dmonitoringd (if sensor fusion is used).
    • Risk Severity: High
    • Mitigation Strategies:
      • Sensor Fusion: Combine radar data with camera and other sensor data within openpilot to cross-validate obstacle detection.
      • Plausibility Checks: Implement algorithms within openpilot to detect physically impossible radar readings.
      • Radar Signal Analysis: Analyze radar signal characteristics within openpilot to identify potential spoofing attempts.

Threat: Sensor Spoofing (Camera) - Impacting openpilot's Processing

  • Threat: Sensor Spoofing (Camera) - Impacting openpilot's Processing

    • Description: An attacker projects images or uses bright lights, and openpilot's camera-based perception system misinterprets the driving environment. The core issue is openpilot's susceptibility to manipulated visual input.
    • Impact: Incorrect lane detection, failure to recognize traffic signals, leading to incorrect driving decisions.
    • Affected Component: camerad (camera processing), perception algorithms, lane detection models.
    • Risk Severity: High
    • Mitigation Strategies:
      • Temporal Filtering: Analyze image sequences over time within openpilot to detect sudden changes or inconsistencies.
      • Redundant Cameras: Use multiple cameras and process data within openpilot for redundancy and cross-validation.
      • Adversarial Training: Train openpilot's perception models on adversarial examples.
      • Light Level Monitoring: Detect sudden changes in light levels within openpilot's camera processing.

Threat: Driver Monitoring System (DMS) Bypass (Video/Image) - Defeating openpilot's DMS

  • Threat: Driver Monitoring System (DMS) Bypass (Video/Image) - Defeating openpilot's DMS

    • Description: An attacker uses a static image or video to trick openpilot's DMS, allowing inattentive driving while openpilot remains engaged.
    • Impact: openpilot remains engaged even when the driver is inattentive, increasing the risk of accidents.
    • Affected Component: dmonitoringd (driver monitoring), DMS algorithms, face detection and gaze estimation models.
    • Risk Severity: High
    • Mitigation Strategies:
      • Liveness Detection: Implement techniques within dmonitoringd to distinguish between a live face and a static image/video.
      • Infrared (IR) Camera: Use an IR camera and integrate its data into dmonitoringd for liveness detection.
      • Contextual Awareness: Consider other factors within openpilot's decision-making (steering wheel input, vehicle speed) to assess driver attentiveness.

Threat: openpilot Software Vulnerability (Buffer Overflow) - Exploitable within openpilot

  • Threat: openpilot Software Vulnerability (Buffer Overflow) - Exploitable within openpilot

    • Description: A buffer overflow vulnerability within an openpilot component allows an attacker to overwrite memory and potentially execute arbitrary code on the openpilot device.
    • Impact: System crash, unpredictable behavior, potential for remote code execution, complete compromise of the openpilot device.
    • Affected Component: Any component with insufficient input validation or memory safety checks (e.g., can.cc, camerad, radard, controlsd).
    • Risk Severity: High
    • Mitigation Strategies:
      • Code Audits: Conduct regular code reviews and security audits of openpilot's codebase.
      • Memory-Safe Languages: Consider using memory-safe languages for critical openpilot components.
      • Input Validation: Implement rigorous input validation and sanitization within all openpilot components.
      • Fuzz Testing: Use fuzz testing to test openpilot components for vulnerabilities.
      • Stack Canaries: Use stack canaries within openpilot's compiled code.
      • Address Space Layout Randomization (ASLR): Enable ASLR on the openpilot device.

Threat: Compromised OTA Update (Malicious Firmware) - Targeting openpilot Directly

  • Threat: Compromised OTA Update (Malicious Firmware) - Targeting openpilot Directly

    • Description: An attacker compromises the openpilot update server or intercepts the update process to deliver malicious firmware specifically to openpilot devices.
    • Impact: Widespread compromise of openpilot devices, installation of backdoors, loss of control.
    • Affected Component: Update client on the openpilot device, communication channel with the update server.
    • Risk Severity: Critical
    • Mitigation Strategies:
      • Code Signing: Digitally sign all openpilot firmware updates and verify the signature on the device.
      • Secure Boot: Implement secure boot on the openpilot device.
      • HTTPS: Use HTTPS for all communication with the openpilot update server.
      • Two-Factor Authentication: Require two-factor authentication for access to the openpilot update server.
      • Regular Security Audits: Conduct regular security audits of the openpilot update server infrastructure.
      • Rollback Mechanism: Implement a secure rollback mechanism within the openpilot device.

Threat: Use of Malicious/Untested Fork (Unpredictable Behavior)

  • Threat: Use of Malicious/Untested Fork (Unpredictable Behavior)

    • Description: A user installs a community-developed fork of openpilot that contains unintentional bugs, untested features, or even intentionally malicious code, directly affecting openpilot's behavior.
    • Impact: Unpredictable vehicle behavior, potential for accidents, disabling of safety features.
    • Affected Component: All openpilot components (depending on the modifications in the fork).
    • Risk Severity: High
    • Mitigation Strategies:
      • User Education: Strongly advise users against installing unofficial forks unless they are experienced developers and understand the risks.
      • Code Review (for developers): Encourage thorough code review and testing of community forks before they are shared widely.
      • Sandboxing (potential future mitigation): Explore the possibility of sandboxing or isolating experimental features to limit their impact on the core system.
      • Official Fork Management: Comma.ai could provide a mechanism for managing and vetting community forks, perhaps with different levels of trust.