# A Connected and Autonomous Vehicle Reference Architecture for Attack Surface Analysis
## 5 Case Studies
### Tesla Exploitation  
An example of an attack that needed to compromise multiple components to gain further control of the vehicle was presented in Reference [45]. The default behaviour of the vehicle was to connect to an unprotected WiFi hotspot and opening a website in the infotainment. By setting up an alternate WiFi hotspot with the same SSID but broadcasting at a higher power, the vehicle instead connected to the alternate hotspot, which allowed traffic to be redirected to a custom server. This means an attacker with semi-local presence could perform this attack. To perform the initial attack the adversary needed to identify a vulnerability in the web browser running in the infotainment system. By chaining together multiple browser vulnerabilities the adversary could execute arbitrary code through the compromised browser. Privilege escalation was then required to affect the system in substantial ways. Without gaining the privilege escalation the adversary would have little ability to affect the internal systems. However, read access to memory storage was provided through the browser exploit, which revealed debug information that included procedures for upgrading firmware. This allowed a custom firmware to be flashed to certain components, which is capable of performing arbitrary tasks. So the summarised steps are as follows, with functional components and **implementations** of those components formatted differently (see more details of reference model in Figures 8 and 9):  
1. External Communications connects to popular **WiFi** hotspot
2. A malicious **WiFi** hotspot spoofs the SSID with a greater signal strength
3. Compromise **browser** in Infotainment
4. Privilege escalation in **Operating System**
5. Storage access
6. Flash **firmware** (change Storage)
7. Custom **firmware** eavesdrops/transmits/blocks messages on the **CAN bus** (Internal Communications)  
Even with access to the CAN bus safety features limited the adversary's ability to perform certain actions. For example, the authors attempted to open the trunk while the vehicle was in motion but this was prevented. However, the authors found a way to block certain CAN message which allowed them to open the trunk or to disable automatic locking of doors when the vehicle was moving. In response to this vulnerability several controls were added to reinforce the security of Tesla vehicles, including (see Figure 10):  
* C1: Greater isolation of the Infotainment web browser from being able to interact with other parts of the system
* C2: Page Table Isolation (which prevents the kernel from accessing user mode memory and thus preventing the adversary from executing code in user space)
* C3: Code Signing (to prevent untrusted code execution)  
To the best of our knowledge, this kind of attack has only been reported three times, twice by the Tencent researchers in 2016 and 2017 and once by Reference Checkoway et al. [56]. For each attack, the authors reported the step-by-step hacking actions, while the producers quickly provided patches/fixes to the vulnerabilities. Attack tree analysis is an effective framework to address the implications of these attacks and how effective the patches/fixes are in eliminating the risks. Firstly, it can represent and simplify the attack, while highlighting the relevant components and their relations. Secondly, the attack can be understood in greater detail by identifying alternatives in the attack surface that could be used to achieve the similar goals. Thirdly, attack implications can be drawn from considering all the related threat agents and their motivations. Finally, the controls that manufacturers added to the CAV can also be verified and the attack trees can also suggest other effective controls to be considered in mitigating the threats. The security analysis from Reference [45] is extended by our attack tree analysis in Table 4 and Figure 10, with alternatives to browser attacks being identified as part of the attack surface.