Software and Hardware Attacks of AUTOSAR
White Papers
The Automotive Open System Architecture (AUTOSAR) development partnership is a worldwide initiative aiming to jointly develop and establish an open industry standard for automotive E/E software architectures. The automotive industry is rapidly adopting this standard, and therefore it is important to understand the attack surface of AUTOSAR-based electronic control units (ECUs).
In this paper, we describe several scenarios of how software and hardware attacks can compromise the security of AUTOSAR-based ECUs. We consider an attacker with physical access to the ECU that is capable of exploiting both software and hardware vulnerabilities. We discuss how an attacker can use different attack techniques to exploit these vulnerabilities.
Moreover, we describe a case study in full detail where we execute arbitrary code on an AUTOSAR-based demonstration ECU by performing a voltage fault injection attack on the AUTOSAR communication stack. Several automotive threats may materialize if an attacker is able to execute arbitrary code on an ECU. For example, it will be possible to persistently modify the ECU’s functionality if its code is not authenticated using a Secure Boot.