http://www.autosec.org/pubs/cars-usenixsec2011.pdf
Our experimental analyses focus on a representative,
moderately priced sedan. We iteratively refined an auto-
motive threat model framework and implemented com-
plete, end-to-end attacks along key points of this frame-
work. For example, we can compromise the car?s ra-
dio and upload custom firmware via a doctored CD, we
can compromise the technicians? PassThru devices and
thereby compromise any car subsequently connected to
the PassThru device, and we can call our car?s cellular
phone number to obtain full control over the car?s telem-
atics unit over an arbitrary distance. Being able to com-
promise a car?s ECU is, however, only half the story: The
remaining concern is what an attacker is able to do with
those capabilities. In fact, we show that a car?s externally-
facing I/O interfaces can be used post-compromise to
remotely trigger or control arbitrary vehicular functions
at a distance and to exfiltrate data such as vehicle lo-
cation and cabin audio. Finally, we consider concrete,
financially-motivated scenarios under which an attacker
might leverage the capabilities we develop in this pa-
per.
