## 3 Black-Box Penetration Testing Framework for ICVs
### Penetration Testing Case Set in ICVTest  
From the perspective of the in-vehicle bus, cybersecurity attacks on ICVs can be categorized into two groups: accessible bus cybersecurity attacks and inaccessible bus cybersecurity attacks. Accessible bus cybersecurity attacks have the potential to infiltrate the bus network and target other ECUs within it. On the other hand, inaccessible bus cybersecurity attacks focus on targets that are not connected to the bus network. Even if these targets are compromised, they cannot access or pose a threat to other ECUs within the same network. In scenarios where vehicle dismantling is not involved, potential entry points for accessible bus cybersecurity attacks include:  
1. OBD-II  
The second on-board diagnostics (OBD-II) interface serves as a crucial interface for ICVs to offer diagnostic services and presents an accessible approach for daily maintenance and ECU programming [32]. Various handheld scanning tools have been developed by automobile manufacturers and have been equipped with dedicated software that enables access to the in-vehicle bus network through the OBD-II interface for querying or programming ECUs within the in-vehicle network. However, if these tools fall under malicious control, unauthorized manipulation of ECU configuration becomes possible. 2. Sensors  
ICVs are equipped with a diverse range of sensors to perceive both the surrounding environment and their own state, encompassing tire pressure monitoring sensors, global positioning systems, and ultrasonic sensors, among others. These sensors collaborate with numerous ECUs to form an in-vehicle network. Consequently, malevolent attackers can exploit vulnerabilities within these sensors as a means to infiltrate the in-vehicle network. 3. Infotainment system  
ICVs offer infotainment functionalities such as navigation and multimedia playback. The ECU responsible for these functions exhibits a complex architecture, encompassing numerous physical and wireless communication interfaces, thereby expanding the potential attack surface. Once an adversary successfully compromises the infotainment system, they can exploit it to further infiltrate the in-vehicle network. 4. Wireless Communication  
Wireless communication units, such as Wi-Fi, Bluetooth, radio frequency identification (RFID), tire pressure monitoring system (TPMS), and dedicated short range communication (DSRC), can be directly connected to ECUs like infotainment systems and telematics boxes (T-Box). Attackers may exploit these ECUs through wireless access points to launch further attacks on the in-vehicle bus network. The objective of cybersecurity attacks on ICVs is to manipulate the vehicular behaviors by attacking the ECU. Cybersecurity attacks on ICVs typically consist of two stages. In the first stage, when disassembling the vehicle is not feasible, attackers can only gain access to externally exposed interfaces provided by the vehicle. This includes wireless communication interfaces such as Wi-Fi, Bluetooth, and cellular networks, as well as physical interfaces like OBD-II and universal serial bus (USB). If any of these in-vehicle communication modules possess a cybersecurity vulnerability, an attacker can exploit it to target the specific ECU through these mentioned interfaces. Subsequently, in the second stage, once an ECU has been compromised successfully, it serves as a gateway for attackers to infiltrate and control other ECUs within the in-vehicle network. The attack path in ICVs encompasses various nodes, including cloud platforms, mobile phone applications (APPs), sensors, key ECUs, as well as physical and wireless communication channels facilitating node-to-node communication. The nodes involved in the attack path of ICVs are abstracted into 10 fields within ICVTest: hardware boards, ECU firmware, ECU operating systems, in-vehicle buses, network communications, cloud platforms, mobile devices, sensors, and private data.