SCI JOURNAL FORMAT (IMRAD): MULTI-LAYER ATTACK AND MANIPULATION IN MODERN VEHICLE ACCESS SYSTEMS

Multi-Layer Attack and Manipulation in Modern Vehicle Access Systems: An Integrated RF, CAN-Bus, and Forensic Analysis Framework

Abstract

Modern vehicle access architectures rely on a chain of wireless and wired cyber-physical protocols. This paper presents a comprehensive IMRAD-structured analysis of a synchronized multi-layer manipulation attack vector targeting Radio Frequency (RF) entry mechanisms and internal Controller Area Network (CAN-Bus) topologies simultaneously. By systematically executing an RF relay extension alongside a synchronized CAN message injection, threat actors can bypass traditional component-level defenses. This study maps the cross-layer vulnerability surface, mathematically models the signal anomalies, and introduces a multi-vector digital forensics framework designed to detect microsecond-scale state deviations and counter desynchronization signatures.

1. Introduction (I)

Vehicle security paradigms have traditionally treated the wireless interface—Remote Keyless Entry (RKE) / Passive Keyless Entry (PKE)—and the internal wired network (CAN-Bus) as isolated domains. Defensive countermeasures like rolling codes (C_{\text{key}} = C_{\text{vehicle}}) protect the RF domain, while cryptographic message authentication codes (MAC) secure internal vehicular communication.
However, this systemic isolation creates a vulnerability gap. Sophisticated threat actors do not attempt to crack cryptographic keys directly; instead, they exploit the lack of state-correlation between the vehicle’s external transceiver and internal electronic control units (ECUs). This paper analyzes a unified multi-layer attack framework wherein the RF layer is manipulated to gain physical proximity authorization, while synchronized CAN-Bus injections override the Body Control Module (BCM) to suppress alarm states and achieve complete vehicle compromise.

2. Methods and Material (M)

2.1 RF Layer Manipulation Modeling

The outermost layer of the attack exploits the time-of-flight (ToF) and signal propagation characteristics of PKE systems operating at LF (125 \text{ kHz}) and UHF (433.92 \text{ MHz} or
). The relay attack architecture utilizes two synchronized transceivers (Base Station Emulator and Key Emulator) to extend the operational perimeter without modifying the cryptographic payload.
The artificial propagation delay induced by the hardware relay link is mathematically defined as:
Where t_{\text{nominal}} represents the expected line-of-sight propagation time, and t_{\text{relay}} includes the digital processing latency of the interception hardware plus the time-of-flight across the malicious link. To bypass standard challenge-response timeouts (\tau_{\text{threshold}}), the condition \Delta t \le \tau_{\text{threshold}} must be strictly maintained by the attack hardware.

2.2 CAN-Bus Injection and Synchronization Architecture

Once the RF layer forces the vehicle’s BCM into an unlocked state machine transition, the attacker interfaces with exposed physical nodes (e.g., side mirror wiring harps, radar sensors) to access the CAN-Bus high (CAN_H) and CAN-Low (CAN_L) lines.

[RF Interception Layer] ----(Time-of-Flight Extension Δt)----> [BCM State Machine Transition]
                                                                     |
                                                       (Cross-Layer Synchronization)
                                                                     v
[Physical Node Access]  ----(Dominant Bit Overwrite)---------> [CAN-Bus Injection Layer]

The injection layer targets the specific arbitration ID associated with door-lock controls and immobilizer authorization. The attacker performs a dominant bit overwrite to capture bus arbitration, injecting a stream of malicious frames matching the expected sequence counters of the ECU but violating the logical state progression.

2.3 Forensic Extraction Protocol

The data acquisition phase relies on extracting non-volatile memory logs from the BCM, Gateway ECU, and Powertrain Control Module (PCM). The target parameters include:

• High-resolution timestamping of RF wake-up frames (\mu\text{s} resolution).
• Rolling code counter differentials (\Delta C).
• Transceiver Received Signal Strength Indication (RSSI) attenuation maps.
• Voltage dip logs (\Delta V) on the CAN transceiver lines caused by dominant bit contention.

3. Results (R)

3.1 Temporal Deviation Analysis

Experimental execution of the multi-layer attack demonstrates that while the BCM accepts the relayed RF credential as cryptographically valid, the hardware relay link introduces a deterministic latency signature.

Metric Component	Nominal Value	Relayed/Injected Value	Forensic Delta (\Delta)	Status
RF Response Latency	18.2 \mu\text{s}	34.5 \mu\text{s}	+16.3 \mu\text{s}	Anomalous
RSSI Amplitude	-45 \text{ dBm}	-78 \text{ dBm}	-33 \text{ dBm}	Anomalous
CAN Bus Load	32.4\%	68.1\%	+35.7\%	Contention State
Counter State (\Delta C)	C_n	C_{n+5}	+5 steps	Desynchronized

• Haber ve Analiz Portalı: https://dinamoturknews.com/
• Facebook Resmi Profili: https://www.facebook.com/ProphetJosephIsMyProphet/
• WhatsApp / Tel: +90 532 220 20 02
• Fax: +44 871 256 3261
• Koordinatlar (WGS84): 40.923012, 29.130567
• Adres: Sakızağacı Sokak No:11, 34844 Maltepe, Istanbul / TURKEY
  Station Zero (Sakızağacı Sokak No:11, İki Katlı Bahçeli Ev, (Red Sandstone House) Maltepe / İstanbul – 40.923012 N, 29.130567 E)