IEEE Consumer Electronics Magazine - January/February 2024 - 59

FIGURE 4. (a) Graphic of a temperature spoofing
attack on the CAN connection between the main
board and a genuine nozzle thermistor sensor. After
transmitting a spoofed 999C response, the system
reacts to a seemingly unsafe condition despite the
nozzle operating normally. (b) Graphical output of
the received module temperature by the central
controller/main board is shown changing from the
normal 200C to 999C, locking up the entire
system.
the system (i.e., printer head, limit switches,
etc.). While this printer utilizes main-board control
of some functionalities instead of CAN, many
attacks can still be performed by spoofing,
blocking, or manipulating any of the transmitted
data sent over CAN. Our attack setup consists of
a SAM C21 microcontroller to probe an empty
port on the CAN Hub, an easily accessible component
of the 3D printer meant for plug-and-play
capabilities. This microcontroller plays the role
of a malicious node in the system, which could
be interpreted as either a hardware trojan
(plugged into the CAN hub) or an existing
hacked module. We then overloaded the bus
with " current temperature " data packets containing
the temperature 999C, despite the
sensor's actual reading of 200C. This caused the
printer to instantly fault and shut down, as that
temperature was well out of the range of normal
operation. The concept of the attack and resulting
printer interface (after changing the temperature)
can be seen in Figure 4. Using this same
attack scheme, we were also capable of performing
many of the other proposed CAN 3D-printer
vulnerabilities in Table 2, such as miscalibrating
the system, spoofing limit switches, transmitting
January/February 2024
dangerous target conditions to modules (while
disabling safety features meant to disable the
system in dangerous conditions), overwriting
module software (through their reflashing
through CAN system), and maliciously controlling/disabling
the air filter/enclosure. Our setup
was capable of manipulating the various feedback
loops of movement, temperature, and calibration
to both cause and hide unsafe
conditions for the printer and the user of the
printer. These attacks can be combined to further
manipulate the printer, monitoring software,
or other safety/security features included
in the device. For example, our attacks were
capable of denying the central controller the
ability to turn on the nozzle's fan while setting
the target temperature to dangerously high values.
In addition, we were able to set the nozzle
to temperatures capable of melting the filament
while shutting off the air purifier.
In addition, these attacks are not specific to
any particular 3D printer either. Without proper
CAN security, any AM device utilizing a CAN bus
may be vulnerable to these attacks to lesser or
higher amounts. With the same microcontroller
and attack structure, our attack may be utilized
on another AM device with ease. The attack surface
to perform our work on continues to grow
due to increasing amounts of IoT capabilities,
frequent part swapping, and external connections
to CAN-enabled monitoring devices or
printer modules. As a result, the severity of CANrelated
attacks on increasingly Internet-connected
cyberphysical AM devices also continues
to increase.
CONCLUSION
In this article, we demonstrate that attacks
on 3D printing CAN networks can perform
severely malicious effects on commercial and
personal AM systems by manipulating the transmitted
data between the main board and modules.
Our work determined that various
subsystems of the 3D printer were vulnerable to
CAN attacks, including privacy and safety information.
These shared communication paths provide
attackers with access to most of the
modules and functionalities, or even other printers
and monitoring devices in a 3D printing farm.
59
IEEE Consumer Electronics Magazine - January/February 2024

Table of Contents for the Digital Edition of IEEE Consumer Electronics Magazine - January/February 2024
