## 3 Methodology
### Threat Model: Addressing Security Attacks on ECUs
#### 3.1.1 Physical Attacks  
Due to numerous physical interfaces, Intelligent Transportation Systems (ITS) are highly susceptible to cyberattacks. These interfaces can provide direct access to the vehicle's IVNs, such as the CAN and LIN buses, as well as the ECUs, making it easier for an attacker to compromise the system. One such interface is the OBD-II port, commonly used by technicians to diagnose and program ECUs during inspections [12]. It should be noted that if an attacker already has physical access to the vehicle, especially in a service station context, executing an attack becomes significantly easier. Physical security measures are therefore crucial in such environments to prevent unauthorized access [30].  
CAVs are also vulnerable to physical access through additional interfaces like USB ports and Bluetooth communication, which could potentially be exploited by attackers. For instance, an attacker with physical access to a USB port can upload malicious firmware or software directly to the vehicle's ECU. Similarly, Bluetooth interfaces can be exploited to gain unauthorized access if not properly secured.  
Experimental investigations have been conducted on attacks targeting in-vehicle networks [31]. Various types of attacks on ECUs include [32; 33]:  
* **Frame sniffing**: Due to the broadcast-based communication protocol of CAN buses and the absence of designated sender and receiver addresses, every node in the network receives frames without any Message Authentication Code (MAC) or digital signature, resulting in insecure transmission [34; 35]. Frame sniffing is the starting point for all in-vehicle communication attacks. Since CAN frames are sent to all ECUs, a compromised ECU can intercept all frames transmitted through the CAN bus via interfaces like the OBD port, USB ports, and aftermarket devices [36; 37].
* **Frame falsifying**: If attackers possess extensive knowledge of legitimate CAN frames, they can construct attacks by transmitting counterfeit frames via the CAN bus. These fraudulent frames may contain falsified data that can trick authentic ECUs [12; 38].
* **Frame injection**: Attackers can initiate actions by exploiting a malicious node, such as a malware-infected laptop connected to the OBD port. In severe scenarios, the attacker may have reprogrammed the ECU and added wireless or remote communication capabilities such as Wi-Fi or Bluetooth [12].
* **Replay attack**: similarly to the attacks described earlier, attackers can use a malicious node to send commands resulting in legitimate frames being transmitted to the CAN bus at specific time intervals [12; 39].
* **DoS attack**: attackers can direct the malicious node to continuously broadcast high-priority frames, preventing other nodes from transmitting their frames if a higher-priority frame is present in the network [12].  
Given the ease with which physical access can facilitate these attacks, it is essential to implement robust physical security measures. This includes securing access to OBD-II ports and other interfaces, using tamper-evident seals, and conducting regular security audits to detect and mitigate potential vulnerabilities.