## 4 Experiments
### Penetration Testing Execution
#### 4.4.3 Remote Vehicle Control Test
All vehicle remote control commands such as air-conditioning activation/deactivation, seat heating adjustment, lighting toggling, and door opening/closing operations are susceptible to potential replay attacks. Subsequent testing revealed a time window of 30 s within which replay attacks can be executed successfully. If the time interval between consecutive replay control commands exceeds this 30 s threshold, the replay attack will fail. 6. PIN code Test  
The testers efficiently generated 50 PIN code verification requests within a limited timeframe, all of which received accurate responses from the cloud service platform. Notably, the cloud service platform does not impose any restrictions on the number of attempts for entering the PIN code, thereby facilitating potential brute force attacks. 4.4.4. Sensor Test  
1. PKES Test  
PKES are extensively utilized in ICVs due to their convenience. However, the utilization of both low-frequency and very high-frequency channels for communication exposes PKES to potential relay attacks. These attacks involve a relay device that extends the communication range between the key and the vehicle, enabling an attacker to gain unauthorized access without detection by the owner. In our experiment, we positioned a low-frequency receiving antenna on the vehicular door handle as part of the vehicle-side relay device. Simultaneously, another tester carried a key-end relay device equipped with a high-power, low-frequency transmitting coil while following the vehicle owner. As depicted in Figure 8a,b, when appropriately positioned, the low-frequency receiving antenna successfully captures broadcast beacons from the vehicle and relays communications between the key and vehicle, resulting in successful door opening by testers. Furthermore,as shown in Figure 8c, placing the low-frequency receiving antenna inside the vehicle simulates scenarios where keys are located within it, allowing the testers to start the vehicle and drive off with ease. 2. GPS Test  
When designed, GPS did not take into account the complexities of electromagnetic environment interference and cybersecurity attacks. It lacks encryption, integrity verification, and identity authentication mechanisms, making it convenient for attackers to forge GPS signals. In a GPS spoofing attack, the attacker can manipulate location-specific navigation messages based on ephemeris data. Due to the absence of an identity authentication mechanism, the attacker can generate stronger GPS signals to deceive receivers. The GPS test primarily assesses whether the vehicle has implemented security measures to mitigate the risk of spoofing by counterfeit GPS signals. In the experiment, the attacker used HackRF to generate false GPS signals, and sent them with strong power to observe whether the target vehicle could be tricked into the set position. As depicted in Figure 9a, prior to the attack, the vehicle was situated in a park near our laboratory with relatively strong satellite signal strength. However, during the attack process shown in Figure 9b, there is a noticeable decline in satellite signal strength due to significant interference caused by GPS spoofing. Consequently, as illustrated in Figure 9c, although it is shown that the vehicle is located in Taipei City, the vehicle's surroundings still indicate its presence within our laboratory's park area. This successful spoofing attack effectively deceived the vehicle's GPS system. Figure 8: PKES relay test scenario: (**a**) tester follows vehicle owner; (**b**) tester is close to the vehicle; (**c**) tester opens the door and starts the vehicle. Camera Test  
Attacks based on adversarial examples have emerged as a potent means to compromise the integrity of deep neural networks (DNNs). This technique introduces carefully crafted perturbations into images, which can disrupt the functioning of ICV image classifiers and lead to erroneous decisions in traffic sign recognition systems.