The CAN protocol, established in the 1980s for industrial and automotive networks, lacks built-in sender identification and security features. As modern vehicles connect to the internet, they become vulnerable to attacks such as packet injection, flooding, and message spoofing, which can compromise critical functions like braking.
Engineers can utilize covert channels to authenticate messages in networks where packet size constraints prevent adding standard signatures. By encoding data into the time intervals between packets, systems can verify message integrity. If a receiver detects a mismatch between the expected MAC and the synchronized counter, the packet is rejected.
The effectiveness of time-based covert channels depends on accounting for system noise and potential interference. Malicious actors can disrupt these channels by flooding the network, causing timing jitters that lead to synchronization loss between the sender and receiver.
This concept was featured in a challenge for the National Technology Olympiad (NTO) in the cybersecurity track. Participants were tasked with analyzing a CAN FD traffic capture to extract a hidden message by identifying noise, applying K-means clustering to inter-packet delays, and decoding the data based on calculated cluster centers.
