motivations for, an 19.2 Unauthorized access to the owner’s privacy attack information such as personal identity, payment account information, address book information, location information, electronic ID, etc. vehicle’s 19.3 Extraction of cryptographic keys 20 Manipulation of vehicle 20.1 Illegal/unauthorised changes to electronic vehicle’s data/code ID 20.2 For example if a user wants to Identity fraud. display another identity when communicating with toll systems, manufacturer backend 20.3 Action to circumvent monitoring systems (e.g. hacking/ tampering/ blocking of messages such as ODR Tracker data, or number of runs) 20.4 Data manipulation to falsify driving data vehicle’s (e.g. mileage, driving speed, driving directions, etc.) 20.5 Unauthorised changes to system diagnostic data 21 Erasure of data/code 21.1 Unauthorized deletion/manipulation of system event logs 22 Introduction of malware 22.2 Introduce malicious software or malicious software activity 23 Introduction of new software or 23.1 Fabrication of software of the vehicle control overwrite existing software system or information system 24 Disruption of systems or 24.1 Denial of service, for example this may be triggered operations on the internal network by flooding a CAN bus, or by provoking faults on an ECU via a high rate of messaging 25 Manipulation of vehicle 25.1 Unauthorized access of falsify the configuration parameters parameters of functions, such as vehicle’s key brake data, airbag deployed threshold, etc. 25.2 Unauthorized access of falsify the charging parameters, such as charging voltage, charging power, battery temperature, etc. 4.3.7 Potential 26 Cryptographic technologies can 26.1 Combination of short and long encryption keys vulnerabilities that be compromised or are period of validity enables attacker to break could be exploited if insufficiently applied encryption not sufficiently 26.2 Insufficient use of cryptographic algorithms to protected or protect sensitive systems hardened 26.3 Using already or soon to be deprecated cryptographic algorithms 27 Parts or supplies could be 27.1 Hardware or software, engineered to enable an compromised to permit attack or fails to meet design criteria to stop an vehicles to be attacked attack
motivations for, an attack 19.2 Unauthorized access to the owner’s privacy information such as personal identity, payment account information, address book information, location information, vehicle’s electronic ID, etc. 19.3 Extraction of cryptographic keys 20 Manipulation of vehicle data/code 20.1 Illegal/unauthorised changes to vehicle’s electronic ID 20.2 Identity fraud. For example if a user wants to display another identity when communicating with toll systems, manufacturer backend 20.3 Action to circumvent monitoring systems (e.g. hacking/ tampering/ blocking of messages such as ODR Tracker data, or number of runs) 20.4 Data manipulation to falsify vehicle’s driving data (e.g. mileage, driving speed, driving directions, etc.) 20.5 Unauthorised changes to system diagnostic data 21 Erasure of data/code 21.1 Unauthorized deletion/manipulation of system event logs 22 Introduction of malware 22.2 Introduce malicious software or malicious software activity 23 Introduction of new software or overwrite existing software 23.1 Fabrication of software of the vehicle control system or information system 24 Disruption of systems or operations 24.1 Denial of service, for example this may be triggered on the internal network by flooding a CAN bus, or by provoking faults on an ECU via a high rate of messaging 25 Manipulation of vehicle parameters 25.1 Unauthorized access of falsify the configuration parameters of vehicle’s key functions, such as brake data, airbag deployed threshold, etc. 25.2 Unauthorized access of falsify the charging parameters, such as charging voltage, charging power, battery temperature, etc. 4.3.7 Potential vulnerabilities that could be exploited if not sufficiently protected or hardened 26 Cryptographic technologies can be compromised or are insufficiently applied 26.1 Combination of short encryption keys and long period of validity enables attacker to break encryption 26.2 Insufficient use of cryptographic algorithms to protect sensitive systems 26.3 Using already or soon to be deprecated cryptographic algorithms 27 Parts or supplies could be compromised to permit vehicles to be attacked 27.1 Hardware or software, engineered to enable an attack or fails to meet design criteria to stop an attack