# Automotive Vulnerability Disclosure: Stakeholders, Opportunities, Challenges
## 3 Current Practice within the Automotive Environment  
In its \"Best Practices on Incident Response\" [30], AUTO-ISAC (with members like Volkswagen, GM, or Toyota) recommends that a manufacturer should integrate official third parties on a voluntary basis if the incident makes this seem appropriate. The early entry into force of the new UNECE regulation [7, 8] in conjunction with ISO/SAE 21434 [10] will significantly increase the pressure on the automotive industry to innovate on their security approach and to address all of the challenges mentioned above. The important role which access to the knowledge of the hacker community through VD can play in this context is highlighted by the work of [PERSON] et al. [31]. This work classifies such programs into the entire product life cycle and outlines their potential for optimization in the various phases of the product development process (e.g., threat and risk analyses, testing, access management). [PERSON] et al. [32] also highlight the benefit of a vulnerability database to extend the coverage of existing automotive coding rules by the automated migration. Several cases have been reported in recent years in which the discovery of critical vulnerabilities led to legal disputes between researchers and the manufacturers concerned. For example, the intention to publish a scientific paper by [PERSON] et al. [33] on the exploitation of a vulnerability in an immobilizer of several popular car brands in 2013 led to a two-year legal dispute with media impact [34]. While Volkswagen succeeded in a British court, this also meant a potential threat of vehicle theft for thousands of car owners for years. In another case from 2015, researchers revealed partial information about a critical vulnerability in the media after the manufacturer concerned failed to respond to their report. The researchers succeeded in gaining remote access to a number of critical functions of the vehicle via the built-in WIFI access point [35]. The result was an openly published vulnerability for which no patch was available. While we do not judge the legal assessment of such cases in this paper, these events are undesirable because they delay and hinder the elimination of vulnerabilities and can cause lasting damage to trust between the community of ethical hackers, the automotive industry and their customers. These cases once again demonstrate the need for strengthening responsible and coordinated disclosure processes in the automotive sector. However, there are also success stories in which disclosure of vulnerabilities by researchers in the automotive environment was carried out responsibly and fairly without any danger to users. In May 2018, researchers published their work in which they described the discovery of 14 vulnerabilities in BMW cars [36]. A total of seven CVE (Common Vulnerabilities and Exposures [37]) entries were assigned to this work. Between the vulnerability report to BMW and their report confirmation, only ten working days passed. Another nine days later BMW provided the planned technical mitigation measures for the reported vulnerabilities to the finder. Within a few weeks, security enhancements were distributed via over-the-air updates to the affected vehicles. Furthermore, BMW provided improvements in form of optional software updates, which were available through the BMW dealer network. In total, it took less than four months from the discovery of the vulnerabilities to the deployment of first countermeasures by BMW, so that the researchers could afterwards publish their work without endangering the public. In 2015, Tesla and a research team in the USA provided another positive example [38]. With physical access, the researcher gained root access to the infotainment systems of a Model S and conducted a multi-stage attack leveraging multiple vulnerabilities, which e.g., allowed them to start and stop the car.