Preface

The idea for this book was sparked by a conversation I had with a bright colleague who challenged me on the likelihood of a specific attack chain against an automotive ECU. When discussing cybersecurity risks, encountering doubtful minds is not exclusive to the automotive industry. I have heard from numerous friends who work in cloud and enterprise security that they often face skepticism when raising security concerns, especially when the remedy is costly or has an impact on performance or project schedule. But when that colleague shared his concern, it was obvious to me that this was not a simple case of disagreement over attack feasibility, but rather a disconnect with the reality of modern-day cyberattacks.

Prior to that day, I had many conversations with engineers about threats against all sorts of vehicle components, and the one striking theme was always their lack of imagination about what is possible. These engineers, while quite competent in their respective domains, often failed to imagine how a security weakness in their component could ever materialize into a full-blown exploit. To their credit, I too would be highly skeptical if it were not for the hundreds of news stories and papers illustrating how attackers took advantage of seemingly innocuous vulnerabilities to carry out their attack objectives.

Engineers focused on chip design, writing embedded software, or developing vehicle supporting systems may perceive the vehicle as a multi-layered fortress of electronic complexity that no one can penetrate. Heck, engineers can barely get their designs working, so it must be magnitudes more difficult for adversaries to work through that complexity and hack into the vehicle. Since rebutting this argument is not as straightforward as citing a few incidents in which that was not the case, we turn to the discipline of offensive cybersecurity to build our case. We cannot convince someone who has already made up their mind that attacking vehicles is theoretical work from the realm of science fiction rather than reality, but what we intend to do is show the evidence of what is possible and what has already happened and let you decide. While this book is focused on automotive systems, most of the concepts and attacks discussed can easily be applied to IoT systems, as the underlying architecture of edge and cloud computing is gradually converging between the two domains.

Throughout this book, you will learn real-life hacks targeting each layer of vehicle architecture to show how attackers successfully achieved their objectives. As we do so, we hope to convince you that modern vehicles are more like porous membranes, with information flowing in almost every direction, as opposed to isolated islands that are hard to breach.

After introducing the basic concepts of offensive cybersecurity and penetration testing, we will explore each layer of the connected vehicle architecture through case studies that show how attackers managed to bypass multiple layers of security to achieve their objectives, starting with the vehicle backend and ending with deeply embedded electronic control units and sensors. For those engineers who argued that their systems were sufficiently secure because they had built-in first-order security measures, we will see that their results were often no better than those who ignored security altogether. By the end of this book, we hope to convince you that security must be systematically integrated across all vehicle architecture layers, all development processes, and all vehicle lifecycles.

Rather than overwhelming you with technical explanations about coding vulnerabilities and insecure protocols, we will introduce these concepts in the respective chapters where they were exploited in real-life attacks. Before presenting the case studies, we offer a survey of security weaknesses that impact each architecture layer to highlight the concepts and technology aspects that must be understood to fully internalize how the attacks were possible. Also, since offensive security tools are a big part of the domain, we dedicated a full chapter to the topic. This should serve as a useful reference that you can return to when reading case studies or choosing to set up your own penetration testing environment.

In the final chapter, we lay out our vision for the future of defensive automotive cybersecurity, which must leverage artificial intelligence as an enabling technology not only to keep up with offensive AI capabilities, but also to finally eliminate entire classes of security weaknesses.

Who this book is for

This book is for automotive engineers who struggle with understanding how their systems may be hacked. You may have been developing automotive software and hardware that must meet certain cybersecurity requirements but never fully internalized how attackers could penetrate the vehicle to affect your component. You may also be quite familiar with defensive security measures but wonder how to improve the robustness of your security controls through penetration testing. Perhaps, you may be an established penetration tester in enterprise networks who is looking to transition to the domain of pen-testing automotive and IoT systems. Regardless of your background or your objective, this book will walk you through the vehicle architectural layers and highlight security weaknesses that resulted in real-life attacks so you may achieve two things: first understand how to perform effective penetration testing against those systems and second learn how to build more robust security controls.

What this book covers

Chapter 1, Offensive Security Basics, starts by providing the motivation for why offensive security is critical to developing secure automotive systems, dispelling common myths about vehicles being unhackable. To lay the foundation for attacks, it explores the anatomy of modern E/E architectures, as well as external interfaces and networking protocols The chapter also examines attacker motivations and capabilities ranging from script kiddies to nation-state actors. It introduces weaknesses, vulnerabilities, and threats, scoring systems, the basics of penetration testing, contrasting it with real-world attacks.

Chapter 2, Penetration Testing Phases, provides a detailed look at each phase of the penetration testing lifecycle: planning, discovery, attack, and reporting. You will learn how to properly define the engagement scope and rules of engagement, as well as the essential legal and documentation frameworks. The chapter also explores mapping trust relationships and techniques for both passive and active reconnaissance and examines attack chain construction using established frameworks like MITRE ATT&CK and CAPEC. Finally, it will also cover the process of responsibly reporting vulnerabilities, including the structure for findings and post-remediation activities like root cause analysis to ensure lasting security.

Chapter 3, Building the Tool Arsenal, surveys the offensive security tool ecosystem across every layer of vehicle architecture and serves as a reference for tools used in both the discovery and exploitation phases, covering network scanners, binary analyzers, reverse engineering frameworks, and fault injection hardware. It explores specific toolsets for the vehicle backend, wireless interfaces, in-vehicle networks, both MCU and SoC-based ECUs, and vehicle sensors and AI systems. Furthermore, the transformative role of AI in offensive security, highlighting how AI-assisted and AI-driven tools accelerating bottlenecks like binary triage and fuzz harness generation are also discussed. This chapter is meant to be your guide for selecting the proper tool whenever you are attacking a specific aspect of the connected vehicle.

Chapter 4, Attacking the Vehicle Backend, explores one specific aspect of the vehicle architecture and its operational environment and begins by describing vehicle backend cloud architectures, their common building blocks, and connectivity protocols like MQTT and REST APIs. Common weaknesses affecting these systems, such as insecure API design, broken authentication, and cloud infrastructure flaws, are discussed. After outlining penetration testing techniques tailored for the backend, the chapter moves to real-life case studies involving major OEMs and security best practices to fortify backend infrastructure.

Chapter 5, Attacking the Wireless Vehicle Systems, explores the wireless networking interfaces that enable powerful remote attacks, starting by surveying the diverse wireless protocol landscape, then detailing common weaknesses such as unauthenticated RF transmissions, software vulnerabilities in wireless-facing components, and unsafe legacy control paths. Specialized penetration testing techniques for RF signal capture, protocol analysis, and fuzzing are discussed and to ground these concepts, real-life case studies involving cloning remote keyless entry key fobs, 4G module hacking, and a zero-click Wi-Fi exploit on an infotainment system are studied. The chapter also provides best practices for securing these interfaces, emphasizing isolation, credential protection, and semantic input validation.

Chapter 6, Attacking the In-Vehicle Communications, focuses on the in-vehicle network protocols that form the communication backbone of the connected vehicle. The chapter examines the physical, data link, and application layers of protocols and delves into their inherent weaknesses, including the lack of source authentication and encryption. Penetration testing techniques, demonstrating how to perform passive monitoring, message injection, and bus-off attacks are also included. Through real-life case studies, the chapter illustrates the severe consequences of these vulnerabilities. The chapter concludes with best practices for hardening network communications using established security protocols.

Chapter 7, Attacking MCU-Based Embedded ECUs, dives into the offensive security domain of the embedded devices, beginning with an overview of their hardware anatomy and common software stacks like AUTOSAR Classic, followed by examining common hardware weaknesses and software vulnerabilities. The chapter outlines a comprehensive attack methodology, from physical reconnaissance to firmware extraction, escalation, and persistence. Finally, real-world case studies illustrate these techniques, including bypassing an ECU password via EMFI and exfiltrating SecOC keys.

Chapter 8, Attacking the High-Performance ECUs, builds upon the embedded concepts from the previous chapter to explore the larger attack surface of these centralized units and examines the hardware and software anatomy of HPCs and mixed-criticality domains. The chapter identifies critical weaknesses such as weak hardware isolation, GPU vulnerabilities, kernel CVEs, and guest-to-host escape paths, then detail a penetration testing flow that covers code extraction, software composition analysis (SCA), and privilege escalation. Several sophisticated case studies are shared, including a zero-click Bluetooth RCE on an IVI system and a multi-stage Pwn2Own exploit chain.

Chapter 9, Attacking Vehicle Sensors and AI/ML, explores the unique security challenges the components face when vehicles move toward higher levels of autonomy, and how the integrity of sensor inputs and AI systems become paramount to vehicle safety. These are categorized into ECU-attached sensors, network-attached sensors, externally mounted sensors, and AI and ML systems, explaining the operating principles of radar, LiDAR, camera, and ultrasonic systems alongside ADAS perception and planning pipelines and in-vehicle AI assistants. The chapter analyzes weaknesses such as camera saturation, LiDAR spoofing via pulse replay, and prompt injection in AI assistants. It also discusses specialized penetration testing techniques for generating adversarial ML examples and manipulating RF or acoustic inputs with real-world case studies grounding these concepts.

Chapter 10, A Path Forward, is the final chapter and it pivots from offensive techniques to the defensive domain, charting a forward-looking strategy for automotive cybersecurity. It contrasts reactionary ad-hoc security with a managed approach centered on a Cybersecurity Management System (CSMS). The chapter emphasizes a secure-by-design philosophy, applying core principles like domain separation, least privilege, and defense in depth through established design patterns. It also explores how organizations can leverage Generative AI to move toward structural vulnerability elimination rather than mere reactive patching and discusses maintaining the security posture across the entire lifecycle, from secure production and supply chain protection to post-deployment monitoring and eventual decommissioning.

To get the most out of this book

To make the most out of this book, it is recommended that you are familiar with automotive embedded software, networking protocols, cloud-based development, and vehicle electronic components. We assume that you already understand the fundamentals of coding defects as these form the basis for the security weaknesses that will be exploited. We also expect that you have a background in embedded systems architecture both at the hardware and software levels. Additionally, you will benefit from a basic awareness of the automotive V-cycle and standard engineering management systems.

While this book does not offer step by step instructions on how to carry out attacks, you are encouraged to set up your own environment using a salvaged ECU and install some of the open-source tools cited throughout the book. To do so, you will need a Linux-based environment (preferably Ubuntu or a similar distribution) for example, to take advantage of native SocketCAN support and the can-utils suite. Depending on the layer of the architecture you are testing, you will require specialized hardware, including USB-to-CAN adapters for network access, Software-Defined Radios (SDRs) for wireless and sensor-layer reconnaissance, and J-Link or OpenOCD-compatible debug probes for ECU hardware analysis. For software analysis, ensure you have set up protocol analyzers like Wireshark and reverse engineering frameworks such as Ghidra.

While we have tried our best to share as much context about the attack classes as possible, we realize that attempting to provide a comprehensive list of every security weakness and why it is exploitable would make the book too verbose causing you to lose interest. So, we erred on the side of brevity with the hope that we will spark interests in you to pursue further learning after establishing the foundation in this book. Due to the diversity of topics presented in this book, you are advised to supplement this reading with other resources wherever you see a topic that requires pre-requisites which you currently lack.

The views, opinions, and statements expressed in this book are solely those of the authors and do not necessarily reflect the views, policies, or positions of the authors' current or former employers, affiliated organizations, or any other entities with which the authors are or have been associated.

Download the color images

Your purchase includes a color, DRM-free PDF copy of this book, ideal for viewing color images, screenshots, and diagrams. Refer to Free benefits with your book section at the end of the Preface to unlock your PDF copy.

Conventions used

There are a number of text conventions used throughout this book.

CodeInText: Indicates code words in text, database table names, folder names, filenames, file extensions, pathnames, dummy URLs, user input, and X handles. For example: "When the user in a mobile app presses the Unlock Car button, the backend issues an MQTT publish on topic vehicles/<VIN>/commands/unlock."

A block of code is set as follows:

"if(password_correct)
proceed;
else reset;"

Any command-line input or output is written as follows:

#define ITEM_SIZE 64
#define MAX_ITEMS 10
#define BUFFER_SIZE (ITEM_SIZE * MAX_ITEMS)

Bold: Indicates a new term, an important word, or words that you see on the screen. For instance, words in menus or dialog boxes appear in the text like this. For example: "As evident by the list of use cases, these services create opportunities for attackers to cause severe safety, financial, operational, and privacy damages if compromised."

Get in touch

Feedback from our readers is always welcome.

General feedback: If you have questions about any aspect of this book or have any general feedback, please email us at [email protected] and mention the book's title in the subject of your message.

Errata: Although we have taken every care to ensure the accuracy of our content, mistakes do happen. If you have found a mistake in this book, we would be grateful if you reported this to us. Please visit http://www.packt.com/submit-errata, click Submit Errata, and fill in the form. All valid errata will be timely updated on GitHub: https://github.com/PacktPublishing/Offensive-Automotive-Cybersecurity

Piracy: If you come across any illegal copies of our works in any form on the internet, we would be grateful if you would provide us with the location address or website name. Please contact us at [email protected] with a link to the material.

If you are interested in becoming an author: If there is a topic that you have expertise in and you are interested in either writing or contributing to a book, please visit http://authors.packt.com/.