M.S. Thesis Defense

Internal Penetration Test of a Simulated Automotive Ethernet Environment

Kenneth Owen Truex

11:15 Tuesday, 21 November 2017, ITE325, UMBC

The capabilities of modern day automobiles have far exceeded what Robert Bosch GmbH could have imagined when it proposed the Controller Area Network (CAN) bus back in 1986. Over time, drivers wanted more functionality, comfort, and safety in their automobiles — creating a burden for automotive manufacturers. With these driver demands came many innovations to the in-vehicle network core protocol. Modern automobiles that have a video based infotainment system or any type of camera assisted functionality such as an Advanced Driver Assistance System (ADAS) use ethernet as their network backbone. This is because the original CAN specification only allowed for up to 8 bytes of data per message on a bus rated at 1 Mbps. This is far less than the requirements of more advanced video-based automotive systems. The ethernet protocol allows for 1500 bytes of data per packet on a network rated for up to 100 Mbps. This led the automotive industry to adopt ethernet as the core protocol, overcoming most of the limitations posed by the CAN protocol. By adopting ethernet as the protocol for automotive networks, certain attack vectors are now available for black hat hackers to exploit in order to put the vehicle in an unsafe condition. I will create a simulated automotive ethernet environment using the CANoe network simulation platform by Vector GmbH. Then, a penetration test will be conducted on the simulated environment in order to discover attacks that pose a threat to automotive ethernet networks. These attacks will strictly follow a comprehensive threat model in order to narrowly focus the attack surface. If exploited successfully, these attacks will cover all three sides of the Confidentiality, Integrity, Availability (CIA) triad.

I will then propose a new and innovative mitigation strategy that can be implemented on current industry standard ECUs and run successfully under strict time and resource limitations. This new strategy can help to limit the attack surface that exists on modern day automobiles and help to protect the vehicle and its occupants from malicious adversaries.

Committee: Drs. Anupam Joshi (chair), Richard Forno, Charles Nicholas, Nilanjan Banerjee

M.S. Thesis Defense

Internal Penetration Test of a Simulated Automotive Ethernet Environment

Kenneth Owen Truex

11:15 Tuesday, 21 November 2017, ITE325, UMBC

The capabilities of modern day automobiles have far exceeded what Robert Bosch GmbH could have imagined when it proposed the Controller Area Network (CAN) bus back in 1986. Over time, drivers wanted more functionality, comfort, and safety in their automobiles — creating a burden for automotive manufacturers. With these driver demands came many innovations to the in-vehicle network core protocol. Modern automobiles that have a video based infotainment system or any type of camera assisted functionality such as an Advanced Driver Assistance System (ADAS) use ethernet as their network backbone. This is because the original CAN specification only allowed for up to 8 bytes of data per message on a bus rated at 1 Mbps. This is far less than the requirements of more advanced video-based automotive systems. The ethernet protocol allows for 1500 bytes of data per packet on a network rated for up to 100 Mbps. This led the automotive industry to adopt ethernet as the core protocol, overcoming most of the limitations posed by the CAN protocol. By adopting ethernet as the protocol for automotive networks, certain attack vectors are now available for black hat hackers to exploit in order to put the vehicle in an unsafe condition. I will create a simulated automotive ethernet environment using the CANoe network simulation platform by Vector GmbH. Then, a penetration test will be conducted on the simulated environment in order to discover attacks that pose a threat to automotive ethernet networks. These attacks will strictly follow a comprehensive threat model in order to narrowly focus the attack surface. If exploited successfully, these attacks will cover all three sides of the Confidentiality, Integrity, Availability (CIA) triad.

I will then propose a new and innovative mitigation strategy that can be implemented on current industry standard ECUs and run successfully under strict time and resource limitations. This new strategy can help to limit the attack surface that exists on modern day automobiles and help to protect the vehicle and its occupants from malicious adversaries.

Committee: Drs. Anupam Joshi (chair), Richard Forno, Charles Nicholas, Nilanjan Banerjee

Cybersecurity Challenges to American Local Governments

In this paper we examine data from the first ever nationwide survey of cybersecurity among American local governments. We are particularly interested in understanding the threats to local government cybersecurity, their level of preparedness to address the threats, the barriers these governments encounter when deploying cybersecurity, the policies, tools and practices that they employ to improve cybersecurity and, finally, the extent of awareness of and support for high levels of cybersecurity within their organizations. We found that local governments are under fairly constant cyberattack and are periodically breached. They are not especially well prepared to prevent cyberattacks or to recover when breached. The principal barriers to local cybersecurity are financial and organizations. Although a number of policies, tools and practices to improve cybersecurity, few local governments are making wide use of them. Last, local governments suffer from too little awareness of and support for cybersecurity within their organizations.

Cybersecurity Challenges to American Local Governments

In this paper we examine data from the first ever nationwide survey of cybersecurity among American local governments. We are particularly interested in understanding the threats to local government cybersecurity, their level of preparedness to address the threats, the barriers these governments encounter when deploying cybersecurity, the policies, tools and practices that they employ to improve cybersecurity and, finally, the extent of awareness of and support for high levels of cybersecurity within their organizations. We found that local governments are under fairly constant cyberattack and are periodically breached. They are not especially well prepared to prevent cyberattacks or to recover when breached. The principal barriers to local cybersecurity are financial and organizations. Although a number of policies, tools and practices to improve cybersecurity, few local governments are making wide use of them. Last, local governments suffer from too little awareness of and support for cybersecurity within their organizations.

Michelle R. Scott, associate professor of history and Director of the Historical Studies Graduate Program, has received the 2017 Letitia Woods Brown Article Prize from the Association of Black Women Historians for her article, “These Ladies Do Business with a Capital B: The Griffin Sisters As Black Businesswomen in Early Vaudeville,” published in the Journal of African American History.

“Michelle Scott has done extensive research and beautifully written a compelling article to tell a story of black women in business which has been ignored,” says Sharon Harley, associate professor of African American Studies at the University of Maryland, College Park and the chair of the Letitia Woods Brown Article Prize. “She has also taken it further by showing how the Griffin Sisters used vaudeville to fight for racial equality, which is an area not often associated with the movement.”

Scott had to sift through census information, obituaries, newspapers, and entertainment materials in independent archives across the country and the Library of Congress to weave and verify the Griffin sister journey. “I found the Griffin sisters in a footnote in a journal article while working on my current book about the Theatre Owner’s Booking Association circuit from the 1920s to 1931,” remembers Scott.

Emma and Mabel Griffin were famous for their acts as singers, comedians, and dancers between 1900 and 1918 in Washington, D.C., San Francisco, and Chicago. The sister act gained prominence as independent artists and businesswomen by becoming theatre owners, vaudeville circuit owners, and agents of their own entertainment contracts. They used their showmanship and business skills to fight for racial equality as labor organizers for the rights of black vaudeville artists. The Griffin Sisters created a template for future generations of black show business artists to gain control over their wages and art at a time when black women managers were unheard of.

“Emma and Mabel Griffin used the legal system, their celebrity, the fact that they were respected and beloved by black communities, and black newspapers to agitate for change in management, production, and racial equality,” said Scott. The article gained the attention of prominent historians of African American history on the board of the Letitia Woods Brown Prize who felt the article was worthy of acknowledgment.

Letitia Woods Brown was an African American researcher and historian who was the first black woman to earn a Ph.D. from Harvard University in history and was the primary consultant for the Schlesinger Library’s Black Woman Oral History project. She personally donated the money for the book, anthology, and article awards.

The accolade is personally significant for Scott who studies twentieth-century U.S. history, African American history, women’s history, black musical culture, and civil rights. “The Griffin sisters article was an opportunity for me to reveal the often forgotten women who did civil rights work. What does it mean when you study an event like WWII and you leave gender out, or even the construction of the 1960s Civil Rights Act and add the word ‘sex’ to it? The narrative changes and the full story must be told.”

Banner image: Michelle Scott, associate professor of history and Director of the Historical Studies Graduate Program. Photo by Marlayna Demond ‘11 for UMBC.

Since 2014, UMBC has used crowdfunding to support both philanthropic endeavors and entrepreneurial projects – everything from purchasing new instruments for the Down and Dirty Dawg Band, to creating educational opportunities for future Retrievers. The continued success of fundraising efforts like these has now led to the creation of Gritstarter, a custom-designed crowdfunding platform UMBC hopes will encourage student, faculty, and staff to serve as their own champions for fundraising.

“This is a tool that connects the UMBC community with donors and helps everyone on campus understand how philanthropy works and how they can be involved on both sides,” said Leanna Powell ’08, assistant director of Annual Giving.

Launched in August 2017, Gritstarter has already raised over $7,000 for student and campus-wide projects, with additional projects currently in the funding stage. One of the most successful campaigns came from UMBC’s mock trial team, who require funds to travel to the national championships in states as far reaching as California and Minnesota.

“We knew we had a number of people – family, friends, alumni, local attorneys –  who were interested in supporting us financially, but we didn’t have an easy way to collect that money and encourage others to give. That’s where Gritstarter came in,” said Ben Garmoe ’13, mock trial head coach, who worked with Powell to build a crowdfunding page that highlighted the work and personal sacrifices the students made to get to nationals.

“We tried to emphasize how even a small donation can make a significant difference, and how our organization works hard to make every dollar we receive go as far as possible,” he said.

The Gritstarter platform comes equipped with a wealth of information for novice fundraisers, with everything from suggestions on how to promote to potential funders, to ideas and guidelines for video creation. By giving students control of their own fundraising efforts – and supporting them with training from the Annual Giving office –  they’re afforded the ability to gain vital skills such as business management and strategic outreach, said Powell. This platform will also be an integral fundraising aid for UMBC’s inaugural Giving Day in February 2018.

In addition to traditional goal and deadline-driven fundraising efforts, Gritstarter also serves as a home for continued goodwill efforts like the Stay Black and Gold Student Emergency Fund. All donations to this fund serve to directly offset unexpected financial burdens for UMBC students.

Collaboration has been the driving force throughout the process of creating Gritstarter. On-campus departments and students were consulted to determine what the aesthetic of the platform would be and how it would fit into the established brand of UMBC.

“We wanted it to look like something for students and that’s why we worked with [student designers at] commonvision to design it because we wanted students to immediately see themselves in it and know it was for them,” said Powell.

Melissa Prather ’18, environmental science and design, and Samual Buettner ’18, design, were initially tapped for their design input as commonvision employees but eventually became the duo responsible for designing Gritstarter’s look and feel.

“Everyone ended up agreeing that it did make sense to have such a student centric thing also made by students,” explained Prather. The pair took inspiration from the landscape of UMBC to create dynamic imagery and logos, dedicating nearly five months to collaborating on the finished product.

Several academic departments, athletic teams, and student organizations are already taking advantage of the new crowdfunding platform but Powell has high hopes that interest will continue to grow. “I want every student organization to meet their fundraising goal and I want every student organization to fundraise with us,” she said.

Photo by Marlayna Demond ‘11 for UMBC.