Securing Software-Defined Vehicles: From Threat Awareness To Holistic Cybersecur... Dennis Kengo Oka

### Overview In this presentation, Dennis Kengo Oka, Global Technical Cybersecurity Adviser at engineering services provider IV, addresses the expanding cybersecurity challenges in Software-Defined Vehicles (SDVs). As modern vehicles incorporate advanced autonomous driving software, electric vehicle platforms, and multiple connectivity interfaces (cellular, Wi-Fi, Bluetooth, V2X), the automotive attack surface extends well beyond individual Electronic Control Units (ECUs). Oka emphasizes moving away from siloed security thinking to a defense-in-depth approach covering the entire ecosystem—including vehicles, cloud backends, and user mobile devices.

### Key Topics - **Expanding SDV Threat Landscape:** Automotive vulnerability reports have sharply increased, growing from only a few per year around 2014–2016 to over 500 published vulnerabilities in the past year, targeting IT/backend systems, infotainment (IVI), and ADAS. - **Ecosystem Architecture & Attack Surface:** Modern vehicle ecosystems integrate on-board software (Linux, Android, AGL, AGL SDV, Zephyr, virtual machines), cloud backends and APIs, and user devices running features like Phone-as-a-Key, remote diagnostics, and smart parking. - **Post-Quantum Cryptography (PQC) & Crypto Agility:** Quantum computing advancements (e.g., Shor's and Grover's algorithms) threaten traditional cryptography (RSA, ECC, AES). Organizations must plan for cryptographic agility and long-term migration using PQC algorithms like CRYSTALS-Kyber, CRYSTALS-Dilithium, Falcon, SPHINCS+, and HQC. - **Organizational Security & Lifecycle Engineering:** Managing vehicle security requires formal governance (CSMS under UNECE UN R155, ISO/SAE 21434), DevSecOps CI pipelines, cross-functional collaboration, and ongoing operations via Vehicle Security Operations Centers (VSOC) and Over-The-Air (OTA) updates.

### Technical Details - **Case Study: Backend & Dealer Portal Attack:** Oka details a real-world multi-step exploit reported in June 2024 (patched ~2 months later) that bypassed vehicle-level defenses entirely via cloud infrastructure: 1. *Unrestricted Dealer Registration:* The OEM's dealer web portal lacked access restrictions and approval verification, allowing an attacker to register a fake dealer account. 2. *Privileged API Exposure:* Client-side JavaScript exposed access to restricted administrative backend APIs. 3. *Missing Authorization & Object-Level Checks:* Using Burp Suite to analyze traffic, an attacker invoked an `assign owner` API call. Due to absent authorization validation and lack of rate limiting, the attacker assigned an arbitrary Vehicle Identification Number (VIN) to their standard mobile app account. 4. *Unauthorized Vehicle Control & Data Leakage:* The attacker gained secondary-owner capabilities to unlock doors, start the engine, track location history, and exfiltrate sensitive owner PII (names, phone numbers, email addresses, vehicle models). - **Four-Layer Defense-in-Depth:** 1. *External Interfaces:* Wireless interfaces secured by firewalls, TLS, and strong authentication. 2. *E/E Architecture:* Domain gateways implementing firewalls and Intrusion Detection Systems (IDS). 3. *In-Vehicle Network Communication:* Bus-level protection using protocols such as SecOC (Secure Onboard Communication) and secure Ethernet. 4. *ECU Hardening:* Secure boot, Hardware Security Modules (HSM), and Trusted Execution Environments (TEE). - **Engineering & Testing Tools:** The lifecycle utilizes Threat Analysis and Risk Assessment (TARA) tools (e.g., itemis Security Analyst) tied to requirement tracking (DOORS, Jira). Testing integrates code reviews, fuzzing, penetration testing, software analysis (IDA Pro, Nessus), network inspection (Wireshark, Nmap, SDRs), hardware fault injection/side-channel analysis, and RF shielding test chambers. - **Open-Source PQC Library:** IV released an open-source C-based library (with Rust planned) implementing NIST-standardized algorithms, compatible with an AUTOSAR Classic crypto driver wrapper.

### Takeaways - **Holistic Security Beyond the Vehicle:** Protecting vehicle-side hardware and software is insufficient; vulnerabilities in cloud APIs, dealer web portals, and mobile apps can grant attackers full vehicle control. - **Vulnerability Disclosure Programs (VDP):** OEMs and Tier 1 suppliers must maintain active VDPs and defined incident evaluation and patching processes. - **Proactive Crypto Agility:** Due to long automotive lifespans (10–15 years), engineers must plan hardware constraints (RAM, ROM, CPU) and migration strategies today to allow future transitions from RSA/ECC to PQC.