Automotive cybersecurity: our demonstrator for hands-on vehicle security
The automotive industry has changed fundamentally: purely mechanical machines have become complex, connected computing platforms on wheels. An average new vehicle holds up to 150 electronic control units and more than 100 million lines of code, more than a modern airliner. Connectivity over CAN, Ethernet, Bluetooth, RFID, Wi-Fi and mobile networks opens up a great many new ways in.
That brings real risks with it:
-
Vehicle safety: manipulation of safety-critical systems such as brakes or steering, with potentially life-threatening consequences
-
Privacy: unauthorised access to personal data such as driving behaviour and location
-
Theft protection: defeating immobilisers and keyless entry systems
-
Financial damage: the cost of recalls and the damage to reputation
-
Regulation: tighter legal requirements through UN Regulations 155 and 156 and ISO/SAE 21434
The Jeep Cherokee hack of 2015 demonstrated all of this at once. The researchers Charlie Miller and Chris Valasek gained remote access to a moving vehicle through a weakness in the Uconnect infotainment system. They could manipulate critical functions such as braking and acceleration, which led to a recall of 1.4 million vehicles and got the industry’s attention.
Current threats to connected vehicles
As connected car services and over-the-air updates spread, new attack paths open. Modern vehicles receive software updates regularly, and if those are not properly secured they are a way in. Infotainment systems keep getting more capable and more complex, which enlarges their attack surface. Third-party apps and cloud services in the vehicle add to it. That is why security monitoring and defensive measures are part of building a connected vehicle rather than an addition to it.
The automotive case demonstrator: a training system for real threats
In the FINESSE project, funded by the German Federal Ministry of Education and Research (BMBF), we built an automotive demonstrator. The compact, mobile setup reproduces the security architecture of a connected vehicle and makes the cybersecurity risks in automotive visible and testable.
The technical architecture
The system is built into a transportable case and contains:
- Emulated ECUs: several vehicle components with authentic CAN communication
- An authentic vehicle network: real communication protocols, CAN bus and Unified Diagnostic Services (UDS)
- An OBD-II interface: real diagnostic devices and analysis tools can be connected
-
A layered dashboard system:
- Vehicle dashboard: a fully interactive digital instrument cluster with live readings for speed, revs, temperature, fuel level and warning lights, plus simulated engine sound
- Attacker dashboard: an interface for CAN message injection, speed manipulation, horn and light control, with its own message log
- IDS monitor: watches CAN bus traffic in real time and raises visual alarms on suspicious activity
- CARLA 3D simulation: the open-source autonomous driving simulator, used to show what an attack does
- Xbox controller: for driving the virtual vehicle
- Keyless entry system: for demonstrating replay attacks against keyless access
- Anker power station: so the case runs independently at demonstrations and training sessions
Realistic attack and defence scenarios
The demonstrator supports a range of scenarios and suits red team and blue team exercises:
Red team
From the offensive side:
- CAN bus injection: manipulated messages that change vehicle functions such as speed or sensor values
-
UDS exploitation: structured attacks on the diagnostic interface, including:
- service scanning, to identify which services are available
- memory scanning, to read protected memory regions
- subservice scanning, to determine which subfunctions are supported
- Fuzzing: systematic testing for unknown weaknesses by feeding in unexpected data
- Replay attacks: recording and replaying radio signals to defeat the keyless entry system
Blue team
From the defensive side:
- Intrusion detection system: detecting anomalous communication patterns on the CAN bus
- Visualising attempts: showing deviations from normal communication graphically
- Real-time monitoring: continuous analysis of network traffic with configurable detection thresholds
- Detailed logging: recording suspicious activity for later forensics
A worked example: CAN injection and IDS detection
In a demonstration for automotive clients we showed an undetected CAN injection attack manipulating the speedometer while the IDS recognised and visualised the anomaly immediately. Through the attacker dashboard a speed of 0 km/h was injected while the vehicle in the simulation was travelling at 50 km/h. The speedometer showed the false figure; the IDS recognised the manipulation through pattern detection and rendered the anomaly live as a spike in the graph. It is a concise illustration of what intrusion detection is for in a vehicle.
Vehicle Security Operations Center (VSOC)
A central part of our approach is the Vehicle Security Operations Center. Unlike a traditional IT SOC, a VSOC is built for the specific requirements of vehicle security:
- Monitoring across the vehicle: central collection and correlation of security events from different vehicle systems
- Security information and event management: aggregating and analysing the security data so threats are recognisable
- Manual and assisted response: workflows for the typical threat scenarios, built around what is possible in a vehicle
- Machine learning: used to recognise complex attack patterns
Vehicle Adversarial Tactics, Techniques, and Expert Knowledge (VATT&EK)
For structured threat analysis we use the VATT&EK framework. It is built for automotive security and follows the established MITRE ATT&CK framework from IT security. VATT&EK provides a categorisation of attack tactics in the vehicle context, one vocabulary for security teams to share, and a basis for threat modelling and risk analysis.
Where it is used
The automotive demonstrator suits several purposes:
- Training security specialists: hands-on work in automotive cybersecurity with realistic attack scenarios
- Briefing decision makers: showing what the risks to a connected vehicle actually look like
- Developing and testing countermeasures: evaluating new protection concepts in a controlled environment
- Red team and blue team exercises: rehearsing attack and defence to improve how a team responds
- Supporting regulatory compliance: demonstrating measures under UN R155/R156 and ISO/SAE 21434
What comes next
The threat landscape for connected vehicles keeps moving, and autonomous vehicles, vehicle-to-everything communication and software-defined vehicles each add to it.
We keep the demonstrator current with those developments, so it stays useful both for research and for teaching automotive cybersecurity.
Talk to us.
A first conversation usually takes 30 minutes. We look at where you stand and say plainly whether we are the right partner.
The project: FINESSE, attack detection for road and rail