USE CASE

Mapping Automotive
Threats to Perform
Threat Investigations

Copyright © 2022 VicOne. All rights reserved.

Mapping automotive threats
VicOne refers to MITRE ATT&CK®, a curated knowledge base of adversarial
tactics, techniques, and procedures (TTPs) to highlight threats in the ATT&CK
Matrix that could be used by threat actors to launch cyberattacks on connectedcars. VicOne breaks down the life cycle of a cyberattack into its component
stages and provides a simulation of an automotive cyberattack based on Trend
Micro’s global threat intelligence and automotive expertise. By understanding
what attackers are trying to achieve and their attack methods, security analysts
can gain a clear picture of the attack scope and implement necessary
remediation and improvement plans.

tmicon-target T a c t i c s
The objective behind an attack,whichexplains

thereasonforusing a particular techniquetmicon-task-list-o T e c h n i q u e s
How a threat actor achieves theirtactic

At the CanSecWest 2021 Conference, a German research team presented how itcompromised Tesla and gained control of its in-vehicle infotainment (IVI)
system. In the next section, we explore and map the hacking stages to theATT&CK Matrix on the right-hand side of each hacking stage.

Mapping Automotive Threats to Perform Threat Investigations

2

Dissecting the attack flow ofan IVI system hack
1. Establish connection with Tesla through a Wi-Fi network.
Most Tesla models automatically connect to a
Wi-Fi network called "Tesla Service" when thevehicles park at a Tesla Service Center. The
researchers built an unauthorized access point
using the same name and leaked credentials.

tmicon-target Manipulate Environment
tmicon-task-list-o Rogue Wi-Fi Access Point

2. Attack zero-day vulnerabilities to access theIVI system.
Tesla uses ConnMan, an open-source network
manager, to manage network connection for
its IVI system. The researchers exploited two
zero-day vulnerabilities in ConnMan to gain
access to the IVI system.

tmicon-target Lateral Movementtmicon-task-list-o Exploitation of Remote Services

3. Obtain elevated privileges for the IVI system.
The researchers took advantage of a bug inthe Wi-Fi system on a chip (SoC) that has
existed since 2017. They were able to insert
unauthorized code to gain access to the IVI
system with higher privileges.

tmicon-target Privilege Escalation
tmicon-task-list-o Exploit OS Vulnerability
tmicon-task-list-o Code Injection

4. Control the IVI system over Wi-Fi.
With root access to the IVI system, theresearchers can send crafted Controller Area
Network (CAN bus) messages to control the IVIsystem.

tmicon-target Affect Vehicle Function
tmicon-task-list-o Manipulation of CAN Bus Message

5. Take control of the vehicle remotely.
The researchers could control actions available
on the IVI console, such as unlocking the doors,changing seat positions, and modifying
steering and acceleration modes.

tmicon-target Impact
tmicon-task-list-o Loss of Control

Mapping Automotive Threats to Perform Threat Investigations

3How can VicOne help?
Mapping threats in automotive cyberattacks helps to understand the goal of threat
actors and their reasons for using a particular technique in every hacking stage. This
step-by-step breakdown helps car manufacturers outline an attack flow and evaluate theeffectiveness of their defense tools. In this section, we discuss how VicOne can help
manufacturers prevent attacks and secure their systems throughout a vehicle’s life cycle.

xNexus, our vehicle security operation center (VSOC), has security features that allow
manufacturers to monitor and analyze unusual vehicle events and maps threats to the
ATT&CK Matrix. Based on what we learned from this hacking project, VicOne can help
boost automotive cybersecurity in the following ways:

1 . M a n i p u l a t e

Environment

2. Lateral

Movement

3. Privilege

Escalation

4. Affect Vehicle 
Function

5 . I m p act

Manipulate Environment

Exploitation of Remote Services

Exploit OS Vulnerability

Unintended Vehicle Control Message

Loss of Control

Rogue Cellular Base StationExploit ECU for Lateral Movement

Code Injection

Manipulation CAN Bus Message

Loss of Safety

Rogue Wi-Fi Access Point

Abuse UDS for Lateral Movement

Exploit TEE Vulnerability

Trigger System Function

Denial of Control

Loss of Availability

Vehicle Content Theft

Hardware Fault Injection

Jamming or Denial of Service  
anomaly  Manipulate Device Communication

Downgrade to Insecure Protocols

ADAS Sensors Attack

CAN busVulnerability management

Application  detectioncontrol

Discover vulnerabilities and mitigate risks at an early stage.
xZETA

canidentify

softwarevulnerabilities

inelectronic

controlunits(ECUs),

while

xCarbon can provide virtual patching for manufacturers to mitigate risks before an
official patch becomes available.

Prevent privilege escalation with application control.
xCarbon also provides application control to restrict the applications that can run invehicles. This helps prevent privilege escalation attacks or unauthorized application
execution.
Identify malicious CAN bus messages to protect vehicle function.

a g and analyzing vehicle telematics and profile, xNexus can identify anomalousvehicle events, such as unusual on-board diagnostics (OBD-II) connection, unauthorized
updates, and malicious CAN bus messages.
By comp rin

Mapping Automotive Threats to Perform Threat Investigations
Use case: How to Detect Electronic Power Steering ECU Firmware Modification

4

About VicOne  
Automotive Security
Our Automotive Security team offers comprehensive protection against cyberattacks
targeting connected vehicles through xNexus, a cloud-based vehicle security operationcenter (VSOC). By leveraging extended detection and response (XDR) capabilities,
automotive threat intelligence, OEM data, and xCarbon in-vehicle sensors, xNexus
ensures compliance with UN Regulation No. 155 (UN R155), maps threats to the ATT&CK
Matrix, highlights threats applicable to automotive cyberattacks, and keeps up with thelatest automotive cybersecurity incidents.

Detection
ActionDetection

Receives data or security notifications
from various sources

AnalysisxNexusConducts broad-spectrum correlation
analysis of threats

ActionAnalysis

Visualizes analysis results in a unified view
to assist in further investigations ormitigation

For more information:
Website: 
https://www.vicone.com/
Contact:  https://www.vicone.com/contact-us

Copyright © 2022 VicOne. All rights reserved.