5.3 Communications channels permit overwrite of vehicle held data/code 5.4 Communications channels permit erasure of vehicle held data/code 5.5 Communications channels permit introduction of data/code to the vehicle (write data code) 6 Communication channels 6.1 Accepting information from an unreliable or permit untrusted/unreliable untrusted source messages to be accepted or are 6.2 Man in the middle attack/ session hijacking vulnerable to session hijacking/replay attacks 6.3 Replay attack, for example an attack against a communication gateway allows the attacker to downgrade software of an ECU or firmware of the gateway 7 Information can be readily 7.1 Interception of information / interfering radiations disclosed. For example through / monitoring communications eavesdropping on 7.2 Gaining unauthorised access to files or data communications or through allowing unauthorized access to sensitive files or folders 8 Denial of service attacks via 8.1 Sending a large number of garbage data to vehicle communication channels to information system, so that it is unable to provide disrupt vehicle functions services in the normal manner 8.2 Black hole attack, in order to disrupt communication between vehicles the attacker is able to block messages between the vehicles 9 An unprivileged user is able to 9.1 An unprivileged user is able to gain privileged gain privileged access to access, for example root access vehicle systems 10 Viruses embedded in 10.1 Virus embedded in communication media infects communication media are able vehicle systems to infect vehicle systems 11 Messages received by the 11.1 Malicious internal (e.g. CAN) messages vehicle (for example X2V or 11.2 Malicious V2X messages, e.g. infrastructure to diagnostic messages), or vehicle or vehicle-vehicle messages (e.g. CAM, transmitted within it, contain DENM) malicious content 11.3 Malicious diagnostic messages 11.4 Malicious proprietary messages (e.g. those normally sent from OEM or component/system/function supplier) 4.3.3. Threats to 12 Misuse or compromise of 12.1 Compromise of over the air software update vehicles regarding update procedures procedures, This includes fabricating system their update update program or firmware
5.3 Communications channels permit overwrite of vehicle held data/code 5.4 Communications channels permit erasure of vehicle held data/code 5.5 Communications channels permit introduction of data/code to the vehicle (write data code) 6 Communication channels permit untrusted/unreliable messages to be accepted or are vulnerable to session hijacking/replay attacks 6.1 Accepting information from an unreliable or untrusted source 6.2 Man in the middle attack/ session hijacking 6.3 Replay attack, for example an attack against a communication gateway allows the attacker to downgrade software of an ECU or firmware of the gateway 7 Information can be readily disclosed. For example through eavesdropping on communications or through allowing unauthorized access to sensitive files or folders 7.1 Interception of information / interfering radiations / monitoring communications 7.2 Gaining unauthorised access to files or data 8 Denial of service attacks via communication channels to disrupt vehicle functions 8.1 Sending a large number of garbage data to vehicle information system, so that it is unable to provide services in the normal manner 8.2 Black hole attack, in order to disrupt communication between vehicles the attacker is able to block messages between the vehicles 9 An unprivileged user is able to gain privileged access to vehicle systems 9.1 An unprivileged user is able to gain privileged access, for example root access 10 Viruses embedded in communication media are able to infect vehicle systems 10.1 Virus embedded in communication media infects vehicle systems 11 Messages received by the vehicle (for example X2V or diagnostic messages), or transmitted within it, contain malicious content 11.1 Malicious internal (e.g. CAN) messages 11.2 Malicious V2X messages, e.g. infrastructure to vehicle or vehicle-vehicle messages (e.g. CAM, DENM) 11.3 Malicious diagnostic messages 11.4 Malicious proprietary messages (e.g. those normally sent from OEM or component/system/function supplier) 4.3.3. Threats to vehicles regarding their update 12 Misuse or compromise of update procedures 12.1 Compromise of over the air software update procedures, This includes fabricating system update program or firmware
GRVA-01-17.docx