1

A car sharing company provides a fleet of 20 vehicles, with the following features:

  • Each user of the sharing scheme has an individual smart-card enabling them to open the car, as long as they have booked the car for the corresponding period (see for instance how Co-Wheels operates).

  • The company provides a 24/7 emergency service, where an employee can come and unlock a car if needed. All vehicles are electric and must be returned to Vehicle-to-Grid charger at the end of the rental period.

  • All vehicles have a constant GPS tracking, in case of car theft, as well as external noise and pollution sensors monitoring surrounding traffic, which feed into the local Data Observatory

This is for an assignment for a Network Security module. I'm not asking anyone to do it for me, I just need this to start it off and I've been staring at the spec for a few hours and I can't think of a valid security risk. We can also make assumptions as long as they are reasonable.

Answering Peter's points here:

  1. We don't have much information about that but I would assume that once a car is not booked but in motion the GPS tracking will flag it and someone will look into it (although that isn't stated)
  2. That is a good one but I think every user and the service people will have their own smartcard so the system will know who has unlocked the car
  3. In this case, there should be a penalty to the user who failed to return the car in time but he should still be able to return it.
  4. For this, I would say it tracks the location at all times. As for outages, nothing is said but how would you use that in an attack?
  5. I think it will be encrypted with a private key so theoretically, it should be safe.
  6. I think it's safe to assume it's nonrepudable
  7. The system admin will be able to monitor all cars and individuals will only see the location of where the car they have booked will be available to pick up let's say a few hours prior to booking
  8. You will have to pay when you book the car so this is not a problem
  9. If you can think of a legit way to obtain them then I guess it could work Thanks for your suggestions, overall they seem to go into too much detail about how the system works which is not wrong, I just think that for the assignment we need to look more globally. For example, a possible attack is stealing a smart card to obtain access to a car but then the booking requirements takes care of that case and I can't think of anything like that.
  • 1
    What is the threat model? And are there any more details? For example, if a smart card remains valid even after the person no longer has the car, then there's the obvious risk of theft, but that would require a buggy implementation. In other words, we'd need to see the spec to answer this. – forest Apr 22 '18 at 9:59
  • 1
    @CaffeineAddiction I think that edit was unnecessary. This is for a network security module, which means it is most likely hypothetical. There is no need to censor the location of a hypothetical company to protect it from a hypothetical vulnerability that OP has been tasked to find. – forest Apr 22 '18 at 10:05
  • Given that OP asked not to have the problem solved for him, would the prof look down upon that? I guess removing the hypothetical location is useful if it's a watermark for him to find cheaters... heh – forest Apr 22 '18 at 10:11
  • @CaffeineAddiction I had changed the name of the city already so it was a made-up one (The Simpsons) but I appreciate your edit. As for your last question, this is all the details we have but as I said we can make assumptions as long as they aren't far fetched. For threat model we use STRIDE. I would also like to state that the purpose of the assignment is doing the risk modeling for a security risk found in the system. My problem is I can't find any risks so I can't even start. – DiscoPigeon Apr 22 '18 at 10:35
  • @forest As for your last question, this is all the details we have but as I said we can make assumptions as long as they aren't far-fetched. For threat model we use STRIDE. Apologies for messing up the comments here, it's my first time posting in such forum. – DiscoPigeon Apr 22 '18 at 10:42
2
  1. If access to cars is not logged (entering and exiting), you can't say whether one of the users stole it or someone got in by "lockpicking".
  2. If access to cars is not logged, you can't say whether the user, who booked the car, or one of the emergency service people stole the car.
  3. What happens if user does not return the car in time with a legitimate reason, such as traffic jam, cops, etc. Will his access be revoked and he will be unable to return the car? Will he retain the access? Will it be logged? Also special consideration of how to log this with point 6.
  4. Do you store last known GPS location? Do you monitor for outages and what is the response? Do you check the sanity of the data? There are GPS jamers out there.
  5. How is data sent by car authenticated? Can an attacker spoof logs with/without access to the car?
  6. Are access logs to the car nonrepudable, for example by signing the log entry by the smart card? How do you solve exiting the car, extensions of time and other data, where the smart-card may not be available anymore.
  7. Who can monitor the location and use of the cars? For example, could other user spy on a user by checking that he has the car reserved and where the car is? When can the users see the position of the car, as I assume they would need to to know where the car they want to reserve is parked.
  8. What happens if someone reserves a car and does not use it? How do you prevent denial of service by reservation of the cars?
  9. Can someone with access to the car retrieve its crypto keys, or abuse them?
  • I have edited the question with answers to your points :) – DiscoPigeon Apr 22 '18 at 13:32
  • @DiscoPigeon Well, if you assume everything is perfect than yes, there is no attack, but there are practical problems with making everything perfect. For example in point 6, how? That may not even be possible for all data. As for 4, I would just jamm/spoof the GPS and drive away with the car. If I can further somehow manipulate the logs not to show it was me or steal a smart card, your car is gone. – Peter Harmann Apr 22 '18 at 13:59
  • @DiscoPigeon Also, in 1 I meant while it is booked but not used. Parking while shopping or before it is picked up or other such situation. In 3, how do you determine this? How do you handle it if a user has it booked right after? – Peter Harmann Apr 22 '18 at 14:04
  • Those are all fair points and sadly the spec does not go into enough details. The idea about GPS jamming is something I can base my attack on so thanks for your time, Peter! – DiscoPigeon Apr 22 '18 at 19:05
0

I would add the following to the list.

If the user of the car, joins their phone to the car you might have access to all the content of the contact if the car does not scrub the list at the end of the rental period. Usually I do this when I leave a rental car in case I get a call when connected, the numbers are erased.

If a nasty user installed a USB injection device into the car, the follow along users, when they plug in their USB could be contaminated. This is why I use a car chargers on rental cars, never the USB plug. Yes, this is a real issue!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.