Parrot , a software-only anti-spoofing defense system for the CAN bus

This paper describes a novel anti-spoofing system for in-car CAN bus networks. If an attacker compromises one of the car’s electronic control units (ECUs), and from there tries to attack another, more critical, ECU, the Parrot system blocks this lateral movement. Unlike previous firewall-based solutions or cryptography-based solutions, the attack messages are identified and destroyed by the legitimate message ID’s owner. Our method does not merely drop messages that are non-conforming with policy: the Parrot defense typically disconnects the compromised ECU from the bus. And unlike previous solutions, that require a modified controller (since they violate the CAN bus protocol), our method is able to shut down the attacker while obeying the protocol rules. Hence, the Parrot defense can be added as a software-only patch to any standard ECU. We implemented the Parrot system and tested its behavior in detailed experiments. With CAN controllers that are able to transmit fast enough we were able to disable the attacking ECU in 100% of experiments. For slower controllers, we showed a successful alternative.