Identifying security vulnerabilities early in the ECU software development lifecycle

Paper #:
  • 2017-01-1657

Published:
  • 2017-03-28
Abstract:
In the past few years, automotive electronic control units (ECUs) have been the focus of many studies regarding the ability to affect the deterministic operation of safety critical cyber-physical systems. Researchers have been able to successfully demonstrate flaws in security design that have considerable, dramatic impacts on the functional safety of a target vehicle. With the rapid increase in data connectivity within a modern automobile, the attack surface has been greatly broadened to allow adversaries remote access to vehicle control system software and networks. This has serious implications, as a vast number of vulnerability disclosures released by security researchers point directly to common programming bugs and software quality issues as the root cause of successful exploits which can compromise the vehicle as a whole. In this paper, we aim to bring to light the most prominent categories of bugs found during the software development life cycle of an automotive ECU. We employ the method of static code analysis using reference coding standards such as MISRA and CERT C secure coding guidelines, to identify categories of software bugs which are most likely to remain in the vehicle, undetected as zero-day security vulnerabilities. We further examine the security issues originating from each category and provide an insight into the systematic elimination of crucial security-related bugs, much earlier in the software development life cycle. In the long term, we expect such an approach to drastically reduce the amount of attack vectors available for exploit in the ECU's software and limit the scope of damage possible by a malicious adversary.
Access
Now
SAE MOBILUS Subscriber? You may already have access.
Buy
Attention: This item is not yet published. Pre-Order to be notified, via email, when it becomes available.
Select
Price
List
Download
$22.00
Mail
$22.00
Members save up to 36% off list price.
Share
HTML for Linking to Page
Page URL

Related Items

Standard
2001-04-26
Standard
2006-09-12
Technical Paper / Journal Article
2011-10-06
Standard
2000-02-17