# Security Threats in Intelligent Transportation Systems and Their Risk Levels
## 4 Risk Determination  
We suppose that the identification and development of threats needs between one day and one week, the attackers are experts and the window of opportunity is moderate because of mobility. We also assume that the motivation of the attacker is related to the asset impact, so for physical assets such as RSUs and vehicles we associate high attacker motivation. **Sybil Attack/ Impersonation Attack:** a vehicle pretends to be another vehicle, using information from dumpster diving, phishing, or from a third party to attempt to build a certain level of trust. The Sybil attacker needs to have restricted information, such as the identities of the target nodes (IPs); he also need to have some specialized equipment to be able to generate new IDs or to execute dumpster diving and/or phishing. For the intensity of the attacks, even if two attacks can be distributed, Sybil attack is more dangerous than impersonation attack. **Eavesdropping/ID Disclosure:** Eavesdropping on wired and wireless networks is part of information gathering, where the attacker tries to capture the packets that cross the network. This type of attack can also perform radio frequency monitoring to determine the vehicles and the type of communication techniques used in the network. For a successful eavesdropping attack, no matter where the attacker is located, he must use specialized tools to easily capture and read encrypted information. The attacker captures the packets and records them, using Wireshark, for example, or records the packets and puts them in a capture file. Wireless networks can be captured and their encryption cracked to access the data using Aircrack, for example. For motivation of the attacker, information as an asset is not as important as infrastructure or vehicles, so for eavesdropping the motivation is medium, for ID disclosure, even though it is information, the motivation is high because the ID of the vehicle is private and very important. Since these attack cannot be distributed, a single instance is sufficient to launch it. **Spoofing Attack:** There are several types of spoofing: IP address spoofing; MAC address spoofing; application or service spoofing (DHCP, DNS, routing protocols, email, etc.). Spoofing is when the attacker pretends to be something he is not (fake web server, fake DNS server...); for example, for email address spoofing, the sending address of an email is not really the sender. An example of MAC spoofing would be when an attacker changes the MAC address of an interface to appear like another vehicle in the network. Another type of spoofing is IP spoofing, which take the IP address of a legitimate vehicle and acts as if an update is coming from that vehicle, comparable to ARP poisoning or DNS amplification. The spoofing attacker needs to capture the MAC address and the IP address of the vehicles, which are sensitive information, so he needs specialized software and equipment such as simulators to generate false position messages. In this type of attack, the asset is the information, thus the motivation of the attacker and the impact of the attack are medium. They can be launched from a single instance. **Malware Integration:** Malware is malicious software that can gather information (keystrokes), participate on a botnet, show you advertising or act as a virus or worm. There are several types of malware: viruses, crypto-malware, ransomware, worms, Trojan horses, \begin{table}
\begin{tabular}{c c c} \hline \hline
**Impact** & **Explanation** & **Value** \\ \hline Low & The concerned party is not harmed very strongly; the possible damage is low & 1 \\ \hline Medium & The threat addresses the interests of providers/subscribers and cannot be neglected & 2 \\ \hline High & A basis of business is threatened and severe damage might occur in this context & 3 \\ \hline \hline \end{tabular}
\end{table} 
Table 7: Asset impact. rootkits, keyloggers, adware/spyware and botnets.