# Security Threats in Intelligent Transportation Systems and Their Risk Levels
## 4 Risk Determination
To integrate malware, an attacker needs to: (1) find a vulnerability (OS, user...); (2) install malware that includes a remote-access backdoor; finally, (3) a bot may be installed later. Before executing the malware integration attack, the attacker needs to know where exactly the vulnerability is, then he needs to install the malware by sending emails, web page pop-ups or worms; therefore, he doesn't need specialized equipment. These types of attacks can be distributed and target physical assets, so the motivation of the attacker and asset impact are high. **Jamming Attack:** Jamming a radio frequency (RF) is a type of denial-of-service (DoS) attack that prevents wireless communication by transmitting interfering wireless signals in order to decrease the signal-to-noise ratio at the receiving vehicle, preventing it from hearing the good signal. There are many types of jamming attacks: legitimate frames, data sent at random times and reactive jamming. In order to be efficient, the attacker needs to be somewhere close. The jammer does not need specific information about the network; knowing that the radio frequency is open, he can simply broadcast interfering wireless signals. In reactive jamming, he needs to hear the network to know when communication has been launched. To generate interfering wireless signals, he needs to use bespoke equipment. This attack can be distributed, its intensity is therefore high as the asset to be protected is physical, which increases the attacker's motivation.. Therefore, the attack has a high impact. **Flooding Attack:** Flooding is a type of DoS attack that forces a service to fail or causes a system to be unavailable by overloading the service through taking advantage of a design vulnerability or a failure in software. In flooding, the attacker is able to track how much traffic is coming to the network and how much there is of what type. There are different types of floods: SYN floods, ping floods/ping scans, port floods/port scans (while identifying a machine, the attacker tries to identify which server is running on that machine: webserver, email server...). The result is that the attacker will know what is happening on the network and/or be able to deny services. There is some information that the attacker needs to know before launching a flooding attack: he needs to identify what infrastructure, servers and vehicles are running on the network. For the equipment needed to launch a flooding attack, the attacker needs specialized equipment to create useless data and useless control requests. These types of attack can be distributed and target physical assets, so the motivation of the attacker and asset impact are high. **Blackhole Attack/Man in the Middle:** In these two types of attack, the the cyber hacker will receive information from one vehicle, read it, and forward it on to another vehicle (MITM) or drop it (blackhole). The problem with this type of attack is that the attacker is completely invisible to the sender and receiver. They use ARP poisoning to create a man in the middle attack while sitting in the same IP subnet as other vehicles. For blackhole attacks in VANETs, an attacker vehicle could exploit routing protocols, such as claiming that it has the best path for the destination vehicle/RSU. The attacker needs to know the IP addresses of the sender and the receiver; he also need to have some specialized equipment to be able to execute the phishing. For a blackhole attack, even though the asset is information, the motivation and the asset impact are high because the information is dropped. A single instance can launch a blackhole or man in the middle attack. Based on this analysis, identified threats are ranked as shown in Table 3.