1.

High-level descriptions of threats and relating vulnerability or attack method are listed in Table A1. Table A1 List of vulnerability or attack method related to the threats High-level and sub-level descriptions of vulnerability/ threat Example of vulnerability or attack method 4.3.1. Threats regarding back-end servers related to vehicles in the field 1 Back-end servers used as a means to attack a vehicle or extract data 1.1 Abuse of privileges by staff (insider attack) 1.2 Unauthorized internet access to the server (enabled for example by backdoors, unpatched system software vulnerabilities, SQL attacks or other means) 1.3 Unauthorized physical access to the server (conducted by for example USB sticks or other media connecting to the server) 2 Services from back-end server being disrupted, affecting the operation of a vehicle 2.1 Attack on back-end server stops it functioning, for example it prevents it from interacting with vehicles and providing services they rely on 3 Vehicle related data held on back-end servers being lost or compromised (‘data breach’) 3.1 Abuse of privileges by staff (insider attack) 3.2 Loss of information in the cloud. Sensitive data may be lost due to attacks or accidents when data is stored by third-party cloud service providers 3.3 Unauthorized internet access to the server (enabled for example by backdoors, unpatched system software vulnerabilities, SQL attacks or other means) 3.4 Unauthorized physical access to the server (conducted for example by USB sticks or other media connecting to the server) 3.5 Information breach by unintended sharing of data (e.g. admin errors) 4.3.2. Threats to vehicles regarding their communication channels 4 Spoofing of messages or data received by the vehicle 4.1 Spoofing of messages by impersonation (e.g. 802.11p V2X during platooning, GNSS messages, etc.) 4.2 Sybil attack (in order to spoof other vehicles as if there are many vehicles on the road) 5 Communication channels used to conduct unauthorized manipulation, deletion or other amendments to vehicle held code/data 5.1 Communications channels permit code injection, for example tampered software binary might be injected into the communication stream 5.2 Communications channels permit manipulate of vehicle held data/code 5.3 Communications channels permit overwrite of vehicle held data/code 5.4 Communications channels permit erasure of vehicle held data/code 5.5 Communications channels permit introduction of data/code to the vehicle (write data code) 6 Communication channels permit untrusted/unreliable messages to be accepted or are vulnerable to session hijacking/replay attacks 6.1 Accepting information from an unreliable or untrusted source 6.2 Man in the middle attack/ session hijacking 6.3 Replay attack, for example an attack against a communication gateway allows the attacker to downgrade software of an ECU or firmware of the gateway 7 Information can be readily disclosed. For example, through eavesdropping on communications or through allowing unauthorized access to sensitive files or folders 7.1 Interception of information / interfering radiations / monitoring communications 7.2 Gaining unauthorized access to files or data 8 Denial of service attacks via communication channels to disrupt vehicle functions 8.1 Sending a large number of garbage data to vehicle information system, so that it is unable to provide services in the normal manner 8.2 Black hole attack, in order to disrupt communication between vehicles the attacker is able to block messages between the vehicles 9 An unprivileged user is able to gain privileged access to vehicle systems 9.1 An unprivileged user is able to gain privileged access, for example root access 10 Viruses embedded in communication media are able to infect vehicle systems 10.1 Virus embedded in communication media infects vehicle systems 11 Messages received by the vehicle (for example X2V or diagnostic messages), or transmitted within it, contain malicious content 11.1 Malicious internal (e.g. CAN) messages 11.2 Malicious V2X messages, e.g. infrastructure to vehicle or vehicle-vehicle messages (e.g. CAM, DENM) 11.3 Malicious diagnostic messages 11.4 Malicious proprietary messages (e.g. those normally sent from OEM or component/system/function supplier) 4.3.3. Threats to vehicles regarding their update procedures 12 Misuse or compromise of update procedures 12.1 Compromise of over the air software update procedures. This includes fabricating the system update program or firmware 12.2 Compromise of local/physical software update procedures. This includes fabricating the system update program or firmware 12.3 The software is manipulated before the update process (and is therefore corrupted), although the update process is intact 12.4 Compromise of cryptographic keys of the software provider to allow invalid update 13 It is possible to deny legitimate updates 13.1 Denial of Service attack against update server or network to prevent rollout of critical software updates and/or unlock of customer specific features 4.3.4. Threats to vehicles regarding unintended human actions facilitating a cyberattack 15 Legitimate actors are able to take actions that would unwittingly facilitate a cyberattack 15.1 Innocent victim (e.g. owner, operator or maintenance engineer) being tricked into taking an action to unintentionally load malware or enable an attack 15.2 Defined security procedures are not followed 4.3.5. Threats to vehicles regarding their external connectivity and connections 16 Manipulation of the connectivity of vehicle functions enables a cyberattack, this can include telematics; systems that permit remote operations; and systems using short range wireless communications 16.1 Manipulation of functions designed to remotely operate systems, such as remote key, immobilizer, and charging pile 16.2 Manipulation of vehicle telematics (e.g. manipulate temperature measurement of sensitive goods, remotely unlock cargo doors) 16.3 Interference with short range wireless systems or sensors 17 Hosted 3rd party software, e.g. entertainment applications, used as a means to attack vehicle systems 17.1 Corrupted applications, or those with poor software security, used as a method to attack vehicle systems 18 Devices connected to external interfaces e.g. USB ports, OBD port, used as a means to attack vehicle systems 18.1 External interfaces such as USB or other ports used as a point of attack, for example through code injection 18.2 Media infected with a virus connected to a vehicle system 18.3 Diagnostic access (e.g. dongles in OBD port) used to facilitate an attack, e.g. manipulate vehicle parameters (directly or indirectly) 4.3.6. Threats to vehicle data/code 19 Extraction of vehicle data/code 19.1 Extraction of copyright or proprietary software from vehicle systems (product piracy) 19.2 Unauthorized access to the owner’s privacy information such as personal identity, payment account information, address book information, location information, vehicle’s electronic ID, etc. 19.3 Extraction of cryptographic keys 20 Manipulation of vehicle data/code 20.1 Illegal/unauthorized changes to vehicle’s electronic ID 20.2 Identity fraud. For example, if a user wants to display another identity when communicating with toll systems, manufacturer backend 20.3 Action to circumvent monitoring systems (e.g. hacking/ tampering/ blocking of messages such as ODR Tracker data, or number of runs) 20.4 Data manipulation to falsify vehicle’s driving data (e.g. mileage, driving speed, driving directions, etc.) 20.5 Unauthorized changes to system diagnostic data 21 Erasure of data/code 21.1 Unauthorized deletion/manipulation of system event logs 22 Introduction of malware 22.2 Introduce malicious software or malicious software activity 23 Introduction of new software or overwrite existing software 23.1 Fabrication of software of the vehicle control system or information system 24 Disruption of systems or operations 24.1 Denial of service, for example this may be triggered on the internal network by flooding a CAN bus, or by provoking faults on an ECU via a high rate of messaging 25 Manipulation of vehicle parameters 25.1 Unauthorized access of falsify the configuration parameters of vehicle’s key functions, such as brake data, airbag deployed threshold, etc. 25.2 Unauthorized access of falsify the charging parameters, such as charging voltage, charging power, battery temperature, etc. 4.3.7. Potential vulnerabilities that could be exploited if not sufficiently protected or hardened 26 Cryptographic technologies can be compromised or are insufficiently applied 26.1 Combination of short encryption keys and long period of validity enables attacker to break encryption 26.2 Insufficient use of cryptographic algorithms to protect sensitive systems 26.3 Using already or soon to be deprecated cryptographic algorithms 27 Parts or supplies could be compromised to permit vehicles to be attacked 27.1 Hardware or software, engineered to enable an attack or fails to meet design criteria to stop an attack 28 Software or hardware development permits vulnerabilities 28.1 Software bugs. The presence of software bugs can be a basis for potential exploitable vulnerabilities. This is particularly true if software has not been tested to verify that known bad code/bugs is not present and reduce the risk of unknown bad code/bugs being present 28.2 Using remainders from development (e.g. debug ports, JTAG ports, microprocessors, development certificates, developer passwords, …) can permit access to ECUs or permit attackers to gain higher privileges 29 Network design introduces vulnerabilities 29.1 Superfluous internet ports left open, providing access to network systems 29.2 Circumvent network separation to gain control. Specific example is the use of unprotected gateways, or access points (such as truck-trailer gateways), to circumvent protections and gain access to other network segments to perform malicious acts, such as sending arbitrary CAN bus messages 31 Unintended transfer of data can occur 31.1 Information breach. Personal data may be leaked when the car changes user (e.g. is sold or is used as hire vehicle with new hirers) 32 Physical manipulation of systems can enable an attack 32.1 Manipulation of electronic hardware, e.g. unauthorized electronic hardware added to a vehicle to enable ‘man-in-the-middle’ attack Replacement of authorized electronic hardware (e.g., sensors) with unauthorized electronic hardware Manipulation of the information collected by a sensor (for example, using a magnet to tamper with the Hall effect sensor connected to the gearbox)