# A Multi-Tier Security Analysis of Official Car Management Apps for Android
## 2 Related Work  
Thus, far, considerable work has been devoted to addressing security and privacy in vehicular network systems for intelligent transportation system (ITS) usages [8]. Nevertheless, while in this ecosystem, connected car apps are a popular subject, little research has been conducted so far towards evaluating them under the security and privacy prisms. [PERSON] et al. [9] presented a static analysis approach to discover software vulnerabilities in Android auto infotainment apps [10]. They examined more than 20 infotainment apps available in Google Play at that time, and concluded that nearly 80% of them were potentially vulnerable. [PERSON] et al. [11] examined the OpenXC library ([[http://openxcplatform.com/](http://openxcplatform.com/)]([http://openxcplatform.com/](http://openxcplatform.com/)) (accessed on 20 February 2021)), which provides Android apps with a way, i.e., API, to interact with the car's hardware, and showed how this library can be exploited in the context of injection attacks. Furthermore, the authors proposed a static analysis approach which, according to the authors, nips such attacks in the bud. Recently, [PERSON] et al. [12] proposed a cost-effective and automatic, i.e., no human intervention required, system called CANHUNTER, for reverse engineering of CAN bus commands using just connected car apps. These apps fundamentally rely on the CAN bus commands to engage with the vehicle and achieve compatibility with existing in-vehicle systems. The authors evaluated CANHUNTER by testing it on more than 200 on-board diagnostics (OBD) dongle and in-vehicle infotainment car apps acquired from both the official iOS and Android app markets. Furthermore, when focusing on the regulation and standardization activities [13], one realises that no progress has been made so far on shaping commonly accepted methods and frameworks, including software libraries, APIs, and possibly common criteria (as that of ISO/IEC 15408), that can be used for the sake of regulating the development and maintenance of such automotive apps. For instance, while European Union regulations, including EU 2017/1151 and 2018/1832, address key issues regarding vehicle tampering, and regulate access to vehicle security features from a rather high-level standpoint, yet, they do not touch upon connected cars apps. The same stands true for the under development ISO/SAE DIS 21434 standard titled \"Road vehicles--Cybersecurity engineering\", which aims at ensuring that original equipment manufacturers (OEMs) and all the involved parties in the supply chain have established structured processes that endorse a security-by-design process. Recently, the Task Force on Cyber Security and OTA issues of the Working Party on Automated/Autonomous and Connected Vehicles (GRVA) of the United Nations Economic Commission for Europe (UNECE), has drafted on Feb. 2020 two important United Nations proposed regulations and one amendment regarding the cybersecurity of the vehicles [14]. The proposal titled \"Proposal for a new UN Regulation on uniform provisions concerning the approval of vehicles with regard to cyber security and of their cybersecurity management systems\" [15] along with its \"Proposal for the 01 series of amendments\" [16], proposes certain provisions \"for the approval of cybersecurity management systems as well as of vehicles with regard to cyber security\". Especially, the Annex 5 of the document titled \"Proposal for amendments to ECE/TRANS/WP.29/GRVA/2020/3\" [17], sets out a detailed and full-fledged list of threats, vulnerabilities or attack methods related to the threats, and possible mitigation strategies.