Cyber-Physical Systems Security—A Survey <s> 4) Smart Cars Controls: a) Restricted critical commands: <s> Modern automobiles are pervasively computerized, and hence potentially vulnerable to attack. However, while previous research has shown that the internal networks within some modern cars are insecure, the associated threat model--requiring prior physical access--has justifiably been viewed as unrealistic. Thus, it remains an open question if automobiles can also be susceptible to remote compromise. Our work seeks to put this question to rest by systematically analyzing the external attack surface of a modern automobile. We discover that remote exploitation is feasible via a broad range of attack vectors (including mechanics tools, CD players, Bluetooth and cellular radio), and further, that wireless communications channels allow long distance vehicle control, location tracking, in-cabin audio exfiltration and theft. Finally, we discuss the structural characteristics of the automotive ecosystem that give rise to such problems and highlight the practical challenges in mitigating them. <s> BIB001 </s> Cyber-Physical Systems Security—A Survey <s> 4) Smart Cars Controls: a) Restricted critical commands: <s> Todays in-vehicle IT architectures are dominated by a large network of interactive, software driven digital microprocessors called electronic control units (ECU). However, ECUs relying on information received from open communication channels created by other ECUs or even other vehicles that are not under its control leaves the doors wide open for manipulations or misuse. Thus, especially safety-relevant ECUs need effective, automotive-capable security measures that protect the ECU and its communications efficiently and dependably. Based on a requirements engineering approach that incorporates all security-relevant automotive use cases and all distinctive automotive needs and constraints, we present an vehicular hardware security module (HSM) that enables a holistic protection of in-vehicle ECUs and their communications. We describe the hardware design, give technical details on the prototypical implementation, and provide a first evaluation on the performance and security while comparing our approach with HSMs already existing. <s> BIB002 </s> Cyber-Physical Systems Security—A Survey <s> 4) Smart Cars Controls: a) Restricted critical commands: <s> The ultimate resource for making embedded systems reliable, safe, and secure Embedded Systems Security provides: A broad understanding of security principles, concerns, and technologies Proven techniques for the efficient development of safe and secure embedded software A study of the system architectures, operating systems and hypervisors, networking, storage, and cryptographic issues that must be considered when designing secure embedded systems Nuggets of practical advice and numerous case studies throughout Written by leading authorities in the field with 65 years of embedded security experience: one of the original developers of the world's only Common Criteria EAL 6+ security certified software product and a lead designer of NSA certified cryptographic systems. This book is indispensable for embedded systems and security professionals, new and experienced. An important contribution to the understanding of the security of embedded systems. The Kleidermachers are experts in their field. As the Internet of things becomes reality, this book helps business and technology management as well as engineers understand the importance of "security from scratch." This book, with its examples and key points, can help bring more secure, robust systems to the market. Dr. Joerg Borchert, Vice President, Chip Card & Security, Infineon Technologies North America Corp.; President and Chairman, Trusted Computing Group Embedded Systems Security provides real-world examples of risk and exploitation; most importantly the book offers clear insight into methods used to counter vulnerabilities to build true, native security into technology. Adriel Desautels, President and CTO, Netragard, LLC. Security of embedded systems is more important than ever. The growth in networking is just one reason. However, many embedded systems developers have insufficient knowledge of how to achieve security in their systems. David Kleidermacher, a world-renowned expert in this field, shares in this book his knowledge and long experience with other engineers. A very important book at the right time. Prof. Dr.-Ing. Matthias Sturm, Leipzig University of Applied Sciences; Chairman, Embedded World Conference steering board Gainan understanding of the operating systems, microprocessors, and network security critical issues that must be considered when designing secure embedded systemsContains nuggets of practical and simple advice on critical issues highlightedthroughout the textShort and to -the- point real case studies included to demonstrate embedded systems security in practice <s> BIB003 </s> Cyber-Physical Systems Security—A Survey <s> 4) Smart Cars Controls: a) Restricted critical commands: <s> Modern vehicles are increasingly being interconnected with computer systems, which collect information both from vehicular sources and Internet services. Unfortunately, this creates a nonnegligible attack surface, which extends when vehicles are partly operated via smartphones. In this letter, a hierarchically distributed control system architecture which integrates a smartphone with classical embedded systems is presented, and an ad-hoc, end-to-end security layer is designed to demonstrate how a smartphone can interact securely with a modern vehicle without requiring modifications to the existing in-vehicle network. Experimental results demonstrate the effectiveness of the approach. <s> BIB004 </s> Cyber-Physical Systems Security—A Survey <s> 4) Smart Cars Controls: a) Restricted critical commands: <s> Vehicle-IT convergence technology is a rapidly rising paradigm of modern vehicles, in which an electronic control unit (ECU) is used to control the vehicle electrical systems, and the controller area network (CAN), an in-vehicle network, is commonly used to construct an efficient network of ECUs. Unfortunately, security issues have not been treated properly in CAN, although CAN control messages could be life-critical. With the appearance of the connected car environment, in-vehicle networks (e.g., CAN) are now connected to external networks (e.g., 3G/4G mobile networks), enabling an adversary to perform a long-range wireless attack using CAN vulnerabilities. In this paper we show that a long-range wireless attack is physically possible using a real vehicle and malicious smartphone application in a connected car environment. We also propose a security protocol for CAN as a countermeasure designed in accordance with current CAN specifications. We evaluate the feasibility of the proposed security protocol using CANoe software and a DSP-F28335 microcontroller. Our results show that the proposed security protocol is more efficient than existing security protocols with respect to authentication delay and communication load. <s> BIB005
Koscher et al.  emphasized that legitimate parties require physical access to cars before issuing any "dangerous" commands. Although this could be an effective control, the term dangerous is relative, and its interpretation varies from one manufacturer to another, so that seemingly benign commands could result in serious attacks. If manufacturers decide to restrict the amount of commands that require physical access, flexibility and convenience will be affected. Therefore, we need solutions that consider all possible attacks resulting from critical or benign commands, while maintaining the existing flexibility. b) Bluetooth: Bluetooth connections between devices and cars can be exploited to launch different attacks such as compromising the TCU and consequently other ECUs BIB001 . Cars need an additional security layer to defend against Bluetooth-dependent attacks. Dardanelli et al. BIB004 showed the applicability of their proposed security layer to protect against smartphone-initiated Bluetooth attacks, with little impact on performance. Although their proposal was tested on a two-wheeled vehicle, it should also be applicable to cars. Furthermore, Woo et al. BIB005 proposed a security mechanism to efficiently authenticate connecting devices to smart cars in order to prevent wireless attacks exploiting vulnerabilities in smartphones. c) Cryptography: The use of cryptography provides a number of security properties such confidentiality, integrity, and authentication that cars lack. However, these mechanisms are computationally expensive for such systems with limited capabilities in cars. Thus, the deployment of efficient solutions is vital. Wolf and Gendrullis BIB002 and Escherich et al.  proposed hardware-based solutions that are designed specifically for cars' security. Wolf and Gendrullis BIB002 designed and implemented the hardware security module. They showed its applicability to secure communications of ECUs within a car, or even in V2V communications. Escherich et al.  presented the secure hardware extension, a standard for adding security properties, such as secret key protection and secure boot, to ECUs. d) Redefining trust: Koscher et al.  suggested two trust-related controls that would have prevented most, if not all, of their attacks. First, revoking trust from arbitrary ECUs so they cannot perform diagnostic and reflashing operations. Second, ECUs with diagnostic and reflashing capabilities must be authorized and authenticated before performing these tasks. To do that, trusted platforms, in addition to remote attestation, need to be deployed BIB003 .