## 4 Experiments
### Penetration Testing Execution
#### 4.4.3 Remote Vehicle Control Test  
1. APP Test  
When the APP resets the PIN code, it securely transmits the new PIN code along with the verification code to the cloud service platform. The cloud service platform receives both codes simultaneously and performs a successful verification of the received verification code before resetting the user's PIN code. In case of an unsuccessful verification, the request to reset the PIN code is rejected. The conducted tests demonstrate that no security vulnerability related to bypassing verification codes exists in the APP. 2. Authentication Test  
The APP initiates a vehicle control request in the remote vehicle control scenario. In response to the request, the cloud server transmits remote vehicle control instructions to the vehicle. It is necessary to assess whether the communication between the APP and the cloud server possesses adequate security measures to prevent unauthorized forging of a malicious vehicle control request. Packet capturing tools like Fiddler can be utilized for intercepting communication packets exchanged between these two entities. The certificate contained within packets serves as crucial identity authentication data, enabling us to determine whether both entities have successfully authenticated each other's identities. By analyzing the communication packets, the cloud service platform sends a certificate to the APP as proof of its identity. The APP then verifies the identity of the cloud service platform and initiates a session key negotiation for encrypting communication data. However, it is noteworthy that during the handshake phase, no certificate is requested from the APP to verify its identity. Figure 7: Power ECU access: (**a**) speed; (**b**) voltage; (**c**) motor load; (**d**) electric pedal depth. 3 Encryption Test  
The captured communication packets between apps and cloud servers can be analyzed using tools such as Wireshark. The packets reveal that the communication between the APP and the cloud service platform utilizes the TLS1.2 protocol, ensuring secure transmission of data. While the communication channel encrypts the data to maintain its confidentiality, it is important to note that complete security of transmitted data cannot be guaranteed solely through channel encryption. Potential attackers may exploit man-in-the-middle attacks to decrypt transmitted data and gain access to communication content. Further evaluation is required to determine if data payload undergoes encryption prior to being encapsulated into the communication channel. In our test scenario, we successfully decrypted the transmitted data payload that was encrypted in the communication channel, which contains multiple plaintext fields. However, crucial data payload has been encrypted before entering and being encapsulated within the channel, thereby enhancing security protection strength. 4. Integrity Test  
Following the transmission of the request message to the cloud service platform, a response is generated by the platform, providing a verification outcome for the PIN code. If any unauthorized modification occurs in the encrypted PIN code within the request message, and this tampered request message is forwarded to the cloud service platform, an error in signature validation will be returned by the platform. Consequently, it can be inferred that the data integrity check was not successfully passed by this manipulated request message. While ensuring APP data integrity through its examination there exists a lack of integrity verification on cloud server data from APP's end. This vulnerability enables potential attackers to manipulate response data from the cloud service platform. 5. Replay Test  
Following the testing phase, it has been determined that in order to successfully execute the remote control command of a vehicle, the tester needs to replay both the PIN code verification request message and the control command request message.