## 4 Experiments
### Scope Determination and Information Collection  
Testers are authorized to conduct comprehensive penetration testing on the target vehicle without disassembling the vehicle's ECUs or interfering with the normal services of the cloud platform. The scope of penetration testing for the TOT is as follows:  
* Testers can access and interact with the vehicle, but they are not permitted to dismantle it in order to obtain the ECU. Due to this limitation, hardware security testing in ICVTest cannot be fully implemented.
* Testers are not allowed to perform penetration tests on the cloud platform so as not to disrupt regular business operations.
* Testers possess physical keys and legal user accounts that enable them to log into the cloud platform. However, since they cannot physically damage or alter the vehicle, all its functions remain black-boxes for testers. With limited information available, testers can only control input parameters of vehicle functions and observe their responses.
* Despite these constraints, testers need to carry out a comprehensive penetration testing for the entire vehicle.  
The process of information collection is iterative in nature. As the penetration testing progresses, testers can continuously obtain new information to establish a foundation for subsequent testing phases. Prior to conducting the penetration testing, the publicly available information regarding the vehicle includes:  
* Infotainment: the infotainment system features a large touch screen and operates on the Android operating system, offering numerous applications and supporting an extensive range of infotainment experiences. It provides network functionalities such as Bluetooth, 4G, Wi-Fi, and hotspot connectivity. Additionally, it enables communication with cloud platforms and mobile devices.  
* Mobile device remote vehicle control: users have the ability to remotely control certain vehicular functions through a dedicated app installed on their mobile devices. Following user identity verification, operations like door unlocking, lighting control, and air conditioning adjustment can be performed remotely.
* Bluetooth digital key: users have the option to activate the Bluetooth digital key functionality which allows their mobile devices to function as virtual keys. However, it should be noted that this feature has not been activated in our experimental vehicle.
* OTA: the target vehicle can remotely upgrade certain functions through OTA.
* When the user approaches the vehicle with the physical key, passive keyless entry allows for automatic unlocking. The engine will only start when the physical key is detected inside the vehicle.
* TPMS: TPMS equipped in the vehicle sends a warning message to the driver when there is a significant deviation from normal tire pressure.
* An ultrasonic sensor installed in the vehicle alerts the driver of obstacles during reversing maneuvers.
* With traffic sign recognition enabled by a high-definition camera, road traffic signs are recognized to assist drivers in making informed decisions while driving.
* Vehicle diagnosis is facilitated through an OBD-II diagnostic interface, allowing for fault detection and localization when connected to diagnostic equipment.