## 4 Experiments
### Penetration Testing Execution
#### 4.4.1 Infotainment Test
Consequently,it can be concluded that cybersecurity protection measures implemented in the network communication of this particular infotainment system possess sufficient strength. In-vehicle Operating System Test  
Network scanning reveals that the vehicle exposes DoIP-data service to external connections, which is utilized for remote vehicle diagnostics. If an attacker infiltrates the internal network of the vehicle, they can exploit the diagnostic service to access ECU internal data such as voltage and mileage and even manipulate ECU internal data like fault codes. Regarding account permissions, user login authentication in the vehicle relies on a QR code-based identification method and a mobile phone verification code. The system settings do not provide an option to enable USB debugging as observed during testing. With respect to application permission testing, system applications clearly prompt users with explicit indications when making calls, sending text messages, recording audio or video content, and accessing location information. However, users are not explicitly notified when utilizing location services. USB Test  
The on-board USB interface does not restrict the connectivity of external USB devices, thereby enabling potential security risks for users as attackers can exploit BadUSB to emulate an external keyboard and mouse, gaining control over the vehicular infotainment system. This vulnerability could be exploited to manipulate in-vehicle Bluetooth functionality, such as initiating unauthorized phone calls. CAN Bus Test  
CAN Frame Reverse Test  
CAN frames are capable of controlling vehicle functions and status through specific segments in the data field, exhibiting certain characteristic features. As the state of the vehicle changes so do these characteristics, which can be analyzed to obtain a communication matrix. Through testing, we have identified the control segment in the data field of CAN frames (as shown in Table 3) which attackers can exploit to manipulate vehicular behaviors. Replay Attack Test  
In the CAN frames replay test, the testers replicated the CAN frames generated by various vehicle actions, including activating the left turn signal, engaging high beam headlights, adjusting air conditioner settings, modifying multimedia volume levels, and opening windows. As depicted in Figure 5, when these replicated CAN frames were injected into the in-vehicle CAN bus system, corresponding expected vehicle behaviors were observed. \begin{table}
\begin{tabular}{c c c} \hline
**CAN ID** & **CAN Segment** & **Function** \\ \hline
0 \(\times\) 375 & [28; 29] & left turn signal \\ \hline
0 \(\times\) 37d & [51; 51] & high beam \\ \hline
0 \(\times\) 3a5 & [20; 20] & air conditioner \\ \hline
0 \(\times\) 1a3 & [19; 21] & player volume \\ \hline
0 \(\times\) 379 & [21; 22] & right window \\ \hline \end{tabular}
\end{table} 
Table 3: The control segment in CAN frame data field. Drop-Off Attack Test  
The CAN bus protocol employs a priority-based arbitration mechanism, whereby the transmission of high-priority messages can lead to the blocking of low-priority messages resulting in denial of service for ECUs. According to the CAN Frame Reverse Test, the tester constructed CAN frames for a drop-off attack as presented in Table 4. The testers continuously transmitted the constructed data frames to the vehicle's CAN bus at a specific rate, rendering both the high beam and left turn signal non-functional as shown in Figure 6. By injecting CAN frames for an air-conditioning drop-off attack into the CAN bus, the testers observed a significant weakening of engine sound when running the air-conditioning system. Simultaneously, in-vehicle air conditioning ceased cooling, although its status displayed on the infotainment system screen remained unchanged. While volume adjustment was still possible during offline attacks, it could not be accurately reflected on the display. Additionally, window control commands were ineffective under offline attacks.