Impair Defenses: CAN Restrict

Adversaries may exploit the CAN Restrict attack technique in vehicle cybersecurity to bypass restrictions on the Controller Area Network (CAN) bus. The CAN bus is a critical component of modern vehicles, responsible for transmitting messages between different electronic control units (ECUs) within the vehicle. The CAN bus transmit chip typically restricts the types of messages that can be transmitted on the network to prevent unauthorized access and manipulation. However, adversaries can rewrite or exploit the firmware or driver of the CAN bus transmit chip to bypass these restrictions and transmit arbitrary CAN messages on the network.

ID: T2032.001
Sub-technique of:  T2032
Tactic: Defense Evasion
Version: 1.0
Created: 03 December 2023
Last Modified: 03 December 2023

Mitigations

This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features.