## 4 Experiments
### Penetration Testing Execution  
#### 4.4.1 Infotainment Test  
1. Bluetooth Test  
After scanning, only one Bluetooth device was detected in the infotainment system, and no unreported Bluetooth devices were found. The identified Bluetooth device utilizes LE Secure Connection mode. When other Bluetooth devices attempt to pair with the car's Bluetooth device, a 6-digit personal identification number (PIN) code is required for authentication. This verification process safeguards against potential security threats posed by malicious devices, however, when the simulated Bluetooth device connects to the in-vehicle Bluetooth system, it bypasses the pairing request verification mechanism, thereby introducing a cybersecurity vulnerability. 2. Wi-Fi Test  
The Wi-Fi hotspot utilizes the robust WPA2-Personal protocol, ensuring adequate authentication and encryption strength. The infotainment has no Wi-Fi proxy function. Thereby, malicious attackers cannot conduct man-in-the-middle attacks or hijacking communication traffic between the infotainment system and cloud platform. Disabling Wi-Fi results in network disconnection between the infotainment system and cloud platform, however, the vehicle remote control function remains operational. A conspicuous user prompt is displayed upon enabling Wi-Fi on the infotainment system. Conversely, there is an absence of a clear user prompt when utilizing Wi-Fi to transmit data, potentially leading to the unauthorized transmission of private information. 3. 4G Test  
By conducting scanning, the tester can acquire information such as frequency and frequency band of nearby base stations. Utilizing USRP B210 and the obtained base station information, an LTE pseudo base station and LTE interference equipment is constructed. The interference device transmits a significant amount of meaningless data on the communication frequency of the original base station to disrupt communication. Upon detecting deteriorated communication quality, the target vehicle initiates cell reselection mechanisms to ensure stable data services by selecting alternative cells. The vehicle prioritizes connection with carefully configured pseudo-base stations. Despite mutual authentication being required between terminal devices and base stations according to the LTE protocol, there is still necessary data exchange prior to authentication taking place. The terminal device's sent base station attachment request message includes international mobile subscriber identity (IMSI) which facilitates tracking of the vehicle's trajectory. In our experiment, unauthorized road usage by other terminal devices near the target vehicle causes interference, hence multiple IMSIs will be extracted by testers when it is not possible to remove SIM from the vehicle resulting in inability to determine corresponding relationship between vehicle and IMSI. 4. \"Vehicle-Cloud\" Network Test  
Preliminary testing reveals that the communication channels for infotainment and remote vehicle control are independent of each other. Even when 4G communication is disabled, remote vehicle control remains functional, indicating that it operates on a separate network. The infotainment system does not offer Wi-Fi proxy functionality, making it impossible for attackers to hijack its communication traffic based on this feature alone. Testers can monitor the infotainment's communication traffic by utilizing test equipment as a gateway. Analysis of the captured messages confirms that while the infotainment authenticates the cloud platform, there is no reciprocal authentication from the cloud platform to the infotainment. All transmission messages are encrypted within the communication channel and protected by an integrity check mechanism. Although channel encryption cannot completely prevent man-in-the-middle attacks, external certificates cannot be imported or installed in the infotainment system, rendering attackers unable to execute such attacks against its secure communication protocol or crack channel encryption.