Security Threat Analysis for Remote Monitoring and Control Functions of Connected Car Services
1
조회
0
다운로드
0
인용
0
참고문헌
키워드
초록
The connected car services are one of the most widely used services in the Internet of Things environment, andthey provide numerous services to existing vehicles by connecting them through networks inside and outsidethe vehicle. However, although vehicle manufacturers are developing services considering the means to securethe connected car services, concerns about the security of the connected car services are growing due to theincreasing number of attack cases. In this study, we reviewed the research related to the connected car servicesthat have been announced so far, and we identified the threats that may exist in the connected car servicesthrough security threat modeling to improve the fundamental security level of the connected car services. As aresult of performing the test to the applications for connected car services developed by four manufacturers, wefound that all four companies' applications excessively requested unnecessary permissions for applicationoperation, and the apps did not obfuscate the source code. Additionally, we found that there were stillvulnerabilities in application items such as exposing error messages and debugging information.
Abstract
The connected car services are one of the most widely used services in the Internet of Things environment, andthey provide numerous services to existing vehicles by connecting them through networks inside and outsidethe vehicle. However, although vehicle manufacturers are developing services considering the means to securethe connected car services, concerns about the security of the connected car services are growing due to theincreasing number of attack cases. In this study, we reviewed the research related to the connected car servicesthat have been announced so far, and we identified the threats that may exist in the connected car servicesthrough security threat modeling to improve the fundamental security level of the connected car services. As aresult of performing the test to the applications for connected car services developed by four manufacturers, wefound that all four companies' applications excessively requested unnecessary permissions for applicationoperation, and the apps did not obfuscate the source code. Additionally, we found that there were stillvulnerabilities in application items such as exposing error messages and debugging information.
참고문헌 (17)
- S. Lenfle, "The launch of innovative product-related services : lessons from automotive telematics", Research Policy, 38(1), pp.156~169 (2009)[DOI]
- A. Akram, "Value network transformation by digital service innovation in the vehicle industry", Proceedings of the 15th Pacific Asia Conference on Information Systems (PACIS) (2011)
- "Embedded Telematics in the Automotive Industry" (2011)[URL]
- J. Ohlsson, "BPM - Driving Innovation in a Digital World", pp.85~101 (2015), Springer
- J. E. Park, "Hyper-connected society and future services", Information & Communications Magazine, 31(4), pp.3~9 (2014)
- S. Vimalkumar, "A review on smart IOT car for accident prevention", Asian Journal of Applied Science and Technololgy, 2(1), pp.287~292 (2018)
- "The quest for Telematics 4.0" (2013)[URL]
- S. G. Kim, "Rapid market expectations for connected cars under IoT", M2M technology environment, 2014, pp.4(2), 3~6
- T. UcedaVelez, "Real world threat modeling using the pasta methodology", Proceedings of the OWASP AppSec Research Conference (2012)
- S. R. Do, "Trends in cybersecurity standards and threat analysis techniques", Weekly Tech Trends, 2019(1918), pp.2~15 (2019)
- A. Shostack, "Threat Modeling" (2016), Acorn Publishing Co
- "Intelligent vehicle security threats and countermeasures report" (2017)[URL]
- "A brief survey on autonomous vehicle possible attacks, exploits and vulnerabilities" (2018)[URL]
- I. Rouf, "Security and privacy vulnerabilities of In-Car wireless networks: a tire pressure monitoring system case study", Proceedings of 19th USENIX Security Symposium (USENIX Security 10) (2010)
- J. Petit, "Revisiting attacker model for smart vehicles", Proceedings of 2014 IEEE 6th International Symposium on Wireless Vehicular Communications (WiVeC), pp.1~5 (2014)
- J. Petit, "Remote attacks on automated vehicles sensors : experiments on camera and LiDAR", Proceedings of the Black Hat Europe (2015)
- K. Koscher, "Experimental security analysis of a modern automobile", Proceedings of 2010 IEEE Symposium on Security and Privacy, pp.447~462 (2010)