[Automotive security] Security test for in-vehicle ECU

Spirent Communications, Inc.

Spirent Communications

[Automobile security] Security test for in-vehicle ECU

Security requirements for not only the entire vehicle but also for each ECU are increasing with the spread of connectivity cars. Under such circumstances, vulnerability diagnosis, fuzzing test, and penetration test are extremely effective in discovering vulnerabilities in target ECUs and determining whether or not they are likely to be attacked.

Types of security tests required for ECUs

Firmware diagnostic	We use tools to diagnose vulnerabilities inherent in ECU firmware (binaries are also supported). *For FW diagnosis, see here.
Vulnerability diagnosis	ECUs are manually checked for vulnerabilities according to predetermined diagnostic items from the perspective of hardware and network interfaces. Diagnosis is performed based on the ECU vulnerability test requirements specified by JASPAR.
fuzzing	Inject fuzz data into each IF of the ECU and check for vulnerabilities based on the results. It is listed as an action item in the ECU vulnerability test requirements specified by JASPAR.
Penetration	Each IF of the ECU is tested from an attacker's point of view. Penetration testing usually includes fuzz testing as well.

Target IF and ECU functions in penetration tests

Below is an example. It will be an estimate for each interface and function.
*Vulnerability diagnosis and fuzzing are the same.

Penetration test execution flow and report

We will do everything possible to create the report according to your schedule.
*Vulnerability diagnosis and fuzzing are the same.

You can check the test progress and report from the Spirent portal site.

Penetration test execution flow and report

Penetration test to in-vehicle ECU Past example

Target: CAN bus

Insert spoofed message
CAN bus fuzzing
Access to other sensors via CAN bus and verification of vehicle operation (including malfunction)
Other diagnostics to CAN bus

Target: CAN bus

Bluetooth implementation review and vulnerability identification
Fuzzing to USB ports
Crossover to secure bus via USB
Code execution via USB drive

Target: camera system

Possibility of capturing images taken by the camera from a distance
Responding to obstacles that were not read by the camera or registered by the automatic collision avoidance system
Obstacles to the automatic collision avoidance system

Target: Other ECU

Validation of hardware related to cryptographic algorithms, software implementations and RKE systems
Fuzz test to specific IF
Tests that focus on specific threats and goal fulfillment

If you would like to request a security test, or have any questions or concerns, please feel free to contact us using the form below.