开车进入未知领域:调查和解决车辆信息娱乐系统的安全漏洞
Minrui Yan1, George Crane2, Dean Suillivan2
1School of Science, Computing and Emerging Technologies, Swinburne University of Technology, Hawthorn Campus, Melbourne, VIC 3122, Australia.
Sensors (Basel, Switzerland)
|January 10, 2026
概括
连接车辆信息娱乐系统中的硬编码凭证构成了车队范围内的安全风险. 一个新的框架有效地发现和利用这些漏洞,使得远程控制车辆,并促使快速修补.
科学领域:
- 网络安全 网络安全
- 汽车工程 汽车工程
- 软件安全 软件安全
背景情况:
- 连接和自动化车辆依赖车载信息娱乐 (IVI) 系统作为车辆网络和云服务的关键环节.
- 在IVI固件中的硬编码凭据存在重大安全漏洞,可能允许本地漏洞远程损害整个车队.
研究的目的:
- 开发和评估一个新的跨层安全框架,用于识别和缓解汽车IVI系统中具有高影响的网络漏洞.
- 证明该框架在发现系统安全漏洞和实现现实世界漏洞的有效性.
主要方法:
- 拟议的框架整合了固件提取,符号执行和有针对性的模糊,以模拟IVI到后端通信.
- 这种方法重建系统交互以发现诸如服务器端请求伪造 (SSRF) 和受损的访问控制等漏洞.
主要成果:
- 该框架应用于来自主要OEM (梅赛德斯-奔,特斯拉,SAIC,FAW-VW,Denza) 的七个不同的汽车系统,一级供应商 (博世) 和ADAS供应商 (Minieye).
- 它成功识别了23个漏洞,包括7个CVE,导致了一个被证明的漏洞,可以远程控制大约600万辆梅赛德斯-奔汽车.
- 所有发现的漏洞都在披露后一个月内被修复.
结论:
- 该研究强调了汽车IVI安全架构中的系统反模式.
- 该研究强调,对于封闭的汽车生态系统,安全评估的有效性应通过发现可操作的全车队攻击路径而不是仅仅通过代码覆盖来衡量.
更多相关视频
11:21Methodology for Establishing a Community-Wide Life Laboratory for Capturing Unobtrusive and Continuous Remote Activity and Health Data
Published on: July 27, 2018
8.6K
06:32Author Spotlight: Automated Deep Brain Stimulation for Parkinson's Disease - Exploring the Possibilities and Challenges of Home Monitoring
Published on: July 14, 2023
1.8K
相关概念视频
01:14Design Example: Automobile Ignition System
521
The automobile's ignition system plays a vital role by ensuring the timely ignition of the fuel-air mixture in each cylinder. This ignition is facilitated by a spark plug, which is composed of two electrodes separated by an air gap. A spark forms across this air gap when a substantial voltage is generated between the electrodes, leading to the ignition of the fuel.
One can generate a large voltage using a car battery of 12 volts with the help of inductors. Inductors are known for opposing...
One can generate a large voltage using a car battery of 12 volts with the help of inductors. Inductors are known for opposing...
521
01:25Control Systems: Applications
1.1K
Electrical engineering plays a pivotal role in our daily lives, with control systems at the heart of many applications, from home appliances to sophisticated space shuttles. Control systems manage and regulate the behavior of devices and processes, ensuring they function safely, correctly, and efficiently.
In modern vehicles, control systems manage various functions to enhance performance and safety. The steering wheel and accelerator are primary inputs in a car's control system. The...
In modern vehicles, control systems manage various functions to enhance performance and safety. The steering wheel and accelerator are primary inputs in a car's control system. The...
1.1K
01:25Ethical Standards I
1.5K
The American Nurses Association (ANA) created and implemented the first nationally accepted Code of Ethics for Nurses with Interpretive Statements. The Code of Ethics is a living document regularly updated by the ANA and establishes an ethical standard that is non-negotiable for nurses in all roles and settings.
The Code of Ethics provisions outline the nurse's duty to the patient, the healthcare team, the profession, and society. The Code's fundamental principles include advocacy,...
The Code of Ethics provisions outline the nurse's duty to the patient, the healthcare team, the profession, and society. The Code's fundamental principles include advocacy,...
1.5K
01:21Electrical Systems
721
In electrical engineering, the analysis of networks composed of passive linear components — resistors (R), capacitors (C), and inductors (L) — is fundamental. These components are organized into circuits where the relationship between input and output can be analyzed using transfer functions. The transfer function of an RLC circuit, which relates the voltage across a capacitor to the input voltage, can be derived using Kirchhoff's laws.
To derive the transfer function, consider an RLC...
To derive the transfer function, consider an RLC...
721
01:23Radial System Protection
416
Radial systems employ time-delay overcurrent relays to reduce load interruptions. When a fault occurs, the nearest breaker opens first, while upstream breakers remain closed due to longer delay settings. This approach ensures minimal disruption to the rest of the system.
In a radial system with a fault downstream of the third breaker, ideally, only the third breaker will open, isolating the fault and interrupting the load connected beyond it. The second breaker has a longer delay setting,...
In a radial system with a fault downstream of the third breaker, ideally, only the third breaker will open, isolating the fault and interrupting the load connected beyond it. The second breaker has a longer delay setting,...
416
01:30Health Information Technology and Healthcare Information System
3.3K
Health Information Technology (HIT)
Health Information Technology, commonly called HIT, integrates advanced information systems and technology in healthcare settings. Its primary functions include:
Health Information Technology, commonly called HIT, integrates advanced information systems and technology in healthcare settings. Its primary functions include:
3.3K