21 Erasure of data/code 21.1 Unauthorized deletion/manipulation of system event logs 22 Introduction of malware 22.2 Introduce malicious software or malicious software activity 23 Introduction of new software or 23.1 Fabrication of software of the vehicle control overwrite existing software system or information system 24 Disruption of systems or 24.1 Denial of service, for example this may be triggered operations on the internal network by flooding a CAN bus, or by provoking faults on an ECU via a high rate of messaging 25 Manipulation of vehicle 25.1 Unauthorized access of falsify the configuration parameters of vehicle’s key functions, such as parameters brake data, airbag deployed threshold, etc. 25.2 Unauthorized access of falsify the charging parameters, such as charging voltage, charging power, battery temperature, etc. 4.3.7 Potential 26 Cryptographic technologies can 26.1 Combination of short encryption keys and long vulnerabilities that be compromised or are period of validity enables attacker to break could be exploited if insufficiently applied encryption not sufficiently 26.2 Insufficient use of cryptographic algorithms to protected or protect sensitive systems hardened 26.3 Using already or soon to be deprecated cryptographic algorithms 27 or supplies could be 27.1 Hardware or software, engineered to enable an compromised to permit vehicles attack or fails to meet design criteria to stop an to be attacked attack 28 Software or hardware 28.1 Software bugs. The presence of software bugs can development permits be a basis for potential exploitable vulnerabilities. vulnerabilities This is particularly true if software has not been tested to verify that known bad code/bugs is not present and reduce the risk of unknown bad code/bugs being present. 28.2 Using remainders from development (e.g. debug ports, JTAG ports, microprocessors, development certificates, developer passwords, can permit …) access to ECUs or permit attackers to gain higher privileges 29 Network 29.1 design Superfluous introduces internet ports left open, providing vulnerabilities access to network systems
21 Erasure of data/code 21.1 Unauthorized deletion/manipulation of system event logs 22 Introduction of malware 22.2 Introduce malicious software or malicious software activity 23 Introduction of new software or overwrite existing software 23.1 Fabrication of software of the vehicle control system or information system 24 Disruption of systems or operations 24.1 Denial of service, for example this may be triggered on the internal network by flooding a CAN bus, or by provoking faults on an ECU via a high rate of messaging 25 Manipulation of vehicle parameters 25.1 Unauthorized access of falsify the configuration parameters of vehicle’s key functions, such as brake data, airbag deployed threshold, etc. 25.2 Unauthorized access of falsify the charging parameters, such as charging voltage, charging power, battery temperature, etc. 4.3.7 Potential vulnerabilities that could be exploited if not sufficiently protected or hardened 26 Cryptographic technologies can be compromised or are insufficiently applied 26.1 Combination of short encryption keys and long period of validity enables attacker to break encryption 26.2 Insufficient use of cryptographic algorithms to protect sensitive systems 26.3 Using already or soon to be deprecated cryptographic algorithms 27 or supplies could be compromised to permit vehicles to be attacked 27.1 Hardware or software, engineered to enable an attack or fails to meet design criteria to stop an attack 28 Software or hardware development permits vulnerabilities 28.1 Software bugs. The presence of software bugs can be a basis for potential exploitable vulnerabilities. This is particularly true if software has not been tested to verify that known bad code/bugs is not present and reduce the risk of unknown bad code/bugs being present. 28.2 Using remainders from development (e.g. debug ports, JTAG ports, microprocessors, development certificates, developer passwords, …) can permit access to ECUs or permit attackers to gain higher privileges 29 Network design introduces vulnerabilities 29.1 Superfluous internet ports left open, providing access to network systems