Automotive system security

Abstract

Modern automobiles are, among other things, sophisticated local area networks connecting multiple embedded computers. It is not rare for vehicles to be communications hubs with multiple wireless connections. Wireless connections may be with other vehicles, local infrastructure, or corporate servers. Some high profile research into the information security of automotive applications has been done. This research has been piece-meal, looking for vulnerabilities in specific implementations of isolated applications. Although most of this work concentrates on car theft, modern automotive systems are subject to a much wider range of potential abuses. We use the term automotive system to be inclusive, since, in addition to the automobile itself, applications like VANETs (ex. vehicle ad hoc networks), and online services (ex. On-Star, remote diagnostics) are subject to compromise. In this work, we consider the automotive system stakeholders and assets they need to protect. We use this security information to help map the automotive security research literature onto the taxonomy CERT uses to describe on-line security incidents, in order to find which threats are not being adequately addressed.