In this work, we present an approach to support penetration tests by combining safety and security analyses to enhance automotive security testing. Our approach includes a new way to combine safety and threat analyses to derive possible test cases. We reuse outcomes of a performed safety analysis as the input for a threat analysis. We show systematically how to derive test cases, and we present the applicability of our approach by deriving and performing test cases for a penetration test of an automotive electronic control unit (ECU). Therefore, we selected an airbag control unit due to its safety-critical functionality. During the penetration test, the selected control unit was installed on a test bench, and we were able to successfully exploit a discovered vulnerability, causing the detonation of airbags.
Enhancement of Automotive Penetration Testing with Threat Analyses Results
Sae Int. J. Transp. Cyber. and Privacy
2018-11-02
22 pages
Conference paper
English
Enhanced Penetration Testing for Automotive Cybersecurity
British Library Conference Proceedings | 2022
|Enhanced Penetration Testing for Automotive Cybersecurity
SAE Technical Papers | 2022
|Automotive Information Security: A threat with an end?
British Library Conference Proceedings | 2007
|