## 4 Experiments
### Cybersecurity Risk Assessment  
1. Remote diagnosis service information leakage and ECU control vulnerability  
The remote diagnosis service exposes information leakage vulnerability and ECU control vulnerability. Attackers can exploit the UDS service whose ID is 22 to remote obtain some data in ECU, such as VIN code, hardware version, and firmware version. With the help of UDS service whose ID is 11, malicious attackers can manipulate the electronic control unit (ECU) into resetting. However, successful exploitation of cybersecurity vulnerability requires prior compromise of the vehicle's internal network. Considering the high strength of Wi-Fi passwords, attempting brute force attacks to guess passwords for invading the vehicle network becomes economically and temporally expensive. Consequently, due to the low probability of converting this cybersecurity threat into an actual attack, its associated risk is correspondingly low. 2. In-vehicle USB unauthorized access vulnerability  
The infotainment system of vehicles lacks proper restrictions on accessing USB peripherals, thereby exposing a serious unauthorized access vulnerability. Attackers can employ BadUSB devices with malicious attack script that emulate unauthorized keyboards and mice to take control over various functions within the vehicle, including making phone calls. 3. ADB information leakage vulnerability  
By enabling ADB debugging in engineering mode, attackers can acquire shell privileges over the infotainment system. Although the file system remains in read-only mode, attackers can still obtain configuration files, script files, shared library files, as well as various APK files through vulnerability mining techniques. The aforementioned files offer vital information for attackers to methodically analyze the vehicle and subsequently devise sophisticated attack strategies. 4. Unauthorized APP installation vulnerability  
The vehicle under test was permitted to install the APP without authorization. Once ADB debugging is enabled, attackers have two options: pulling files from the infotainment system, and uploading APK files to specific directories within the file system. By utilizing specific command-line tools effectively, attackers can install malicious applications onto targeted systems leading to significant cybersecurity risks. Figure 11: Ultrasonic radar attack scenario: (**a**) attack device; (**b**) no attack and no pedestrians; (**c**) no attack and pedestrians; (**d**) attack and no pedestrians. PIN brute-force cracking vulnerability  
The vehicle does not impose a limit on the number of PIN code entries for remote vehicle control. Although the cloud service platform can only process PIN code verification requests at a limited speed within a specific time window, an attacker can still generate numerous real-time PIN code verification requests to perform brute force attacks and crack the PIN code. Once the PIN code is compromised, the attacker gains access to the remote vehicle control password, resulting in significant harm. However, this attack requires logging into the user's account with SMS assistance. It is challenging for an attacker to traverse all SMS verification codes within 5 min, thereby presenting a moderate cybersecurity risk. Additionally, remote vehicle control commands can be replayed within a 30 s timeframe. Insecure in-vehicle CAN bus communication vulnerability  
The in-vehicle CAN bus lacks encryption, authentication, and integrity verification mechanisms to safeguard communication data. Attackers can monitor bus data, reverse engineer communication matrices, construct unauthorized vehicle control commands, and launch offline attacks and diagnostic attacks against vehicles' systems through physical access to the CAN bus network. Nevertheless, due to requiring physical proximity for exploitation purposes, the direct exploitation of this vulnerability poses significant challenges. The vulnerability is usually used as an attack point in an attack chain initiated from outside to achieve vehicle control.