Project
- Scope and purpose
The purpose of the document is to detail the guidelines for threat analysis and risk assessment for the Assert of a Headlamp system of car. The scope of this guideline is applicable for all the cybersecurity relevant projects with Threat analysis and Risk Assessment in project scope.
2.Process Flow
3. Item definition
A headlamp is a lamp attached to the front of a vehicle to illuminate the road ahead. Headlamps are also often called headlights. Headlamp is the term for the device itself and headlight is the term for the beam of light produced and distributed by the device. Daytime Running Lights decrease the chance of a front-end collision and significantly reduce accidents during the day. When the engine is running, these lights stay on throughout the day and at night. These lights are faint and are located in the front bumper of the car or integrated inside the headlights.
BCM Unit: Meet Body Control Module (BCM), the brain behind Automotive Electronics. It manages the inter-ECU Communication between Power windows, Wipers, Automatic door lock, HVAC, Headlamps & Rear-Lamps (Automotive Lighting) & a host of other body electronics features.
Modern Headlamp accelerates the development of intelligent headlamps by validating control law behavior and testing potential edge cases early in design. . Increase your final product quality and strongly reduce the risk of finding issues late in the development process.
4. Asset Identification
[As.1] There is a CAN message for lamp ON/OFF request, in such as case CAN frame will be an asset
[As.2] Power distribution box provide power to the headlamp, so PDB is one of the assets for car headlamp
[As.3] Genivi – a standard for Linux based systems used for in-car infotainment systems. For example, a cable would run from the battery to a switch and on to the headlights.
5) Threat Scenarios identification
Name of Threat scenario: spoofing on CAN Bus
Cause of compromise: TC.1: spoofing
Acts on: CAN Bus
Compromises: Confidentiality, I: Integrity
Threatens: +
Attack Tree: AS.1
Realizes: DS.1: Headlamp turns off unexpectedly
DS.2: Headlamp turns on unexpectedly
Damped by: A.1
Name of Threat scenario: Tampering on CAN Message
Cause of compromise: TC.2: Tampering
Acts on: CAN Bus
Compromises: Confidentiality, I: Integrity
Threatens: +
Attack Tree: AS.2
Realizes: DS.1: Headlamp brightness increases suddenly
DS.2: Headlamp changes its focus randomly
Damped by: A.2
6) Impact Analysis
The damage shall be assessed for their impact on the stakeholders. Impact shall be analyzed for the impact categories are below
- Safety
- Financial
- Operational
- Privacy
Additional impact categories apart from S, F, O, P can be identified depending on the stakeholders The impact rating of the damage scenario shall be determined to be one of the following: - Severe; - Major; - Moderate; or - Negligible Safety related impacts shall be derived from ISO 26262-3:2018, 6.4.3 Classification of hazardous events.
Name of Threat scenario: spoofing on CAN Bus [TS.1]
Impact Analysis for spoofing on CAN Bus
|
Impact Rating |
Criteria for Safety Impact Rating |
|
Major |
S2: Severe and life-threatening injuries (survival probable) |
Table 1: Safety impact rating criteria
|
Moderate |
The financial damage leads to inconvenient consequences which the affected stakeholder will be able to overcome with limited resources. |
Table 2: Financial impact rating criteria
|
Impact Rating |
Criteria for Operational Impact Rating |
|
Moderate |
The operational damage leads to partial degradation of a vehicle function or performance. |
Table 3: Operational impact rating criteria
|
Impact Rating |
Criteria for Privacy Impact Rating |
|
Negligible |
Privacy damage leads to no effect or can create few inconveniences to the road user. In this case, the information regarding the road user is not sensitive and difficult to link to a PII principal |
Table 4: Privacy impact rating criteria
Table 5: Computation of impact rating value
|
Safety impact rating criteria |
Financial impact rating criteria |
Operational impact rating criteria |
Computation of impact ratting |
|
|
Impact |
||||
|
Negligible |
0 |
0 |
0 |
0 |
|
moderate |
10 |
1 |
1 |
1 |
|
major |
100 |
10 |
10 |
10 |
|
severe |
1000 |
100 |
100 |
100 |
Table 5: Computation of impact rating value
|
Safety impact rating criteria |
Financial impact rating criteria |
Operational impact rating criteria |
Computation of impact ratting |
|
|
Impact |
||||
|
Negligible |
0 |
0 |
0 |
0 |
|
moderate |
10 |
1 |
1 |
1 |
|
major |
100 |
10 |
10 |
10 |
|
severe |
1000 |
100 |
100 |
100 |
Name of Threat scenario: Tampering on CAN Message
Impact Analysis for Tampering on CAN Message [TS.2]
|
Impact Rating |
Criteria for Safety Impact Rating |
|
Major |
S2: Severe and life-threatening injuries (survival probable) |
Table 1: Safety impact rating criteria
|
Moderate |
The financial damage leads to inconvenient consequences which the affected stakeholder will be able to overcome with limited resources. |
Table 2: Financial impact rating criteria
|
Impact Rating |
Criteria for Operational Impact Rating |
|
Moderate |
The operational damage leads to partial degradation of a vehicle function or performance. |
Table 3: Operational impact rating criteria
|
Impact Rating |
Criteria for Privacy Impact Rating |
|
Negligible |
Privacy damage leads to no effect or can create few inconveniences to the road user. In this case, the information regarding the road user is not sensitive and difficult to link to a PII principal |
Table 4: Privacy impact rating criteria
Table 5: Computation of impact rating value
|
Safety impact rating criteria |
Financial impact rating criteria |
Operational impact rating criteria |
Computation of impact ratting |
|
|
Impact |
||||
|
Negligible |
0 |
0 |
0 |
0 |
|
moderate |
10 |
1 |
1 |
1 |
|
major |
100 |
10 |
10 |
10 |
|
severe |
1000 |
100 |
100 |
100 |
7) Attack paths analysis
.Via the on-board diagnostics (OBD) cable. You can find the OBD connector below the dashboard and see the 16-pin connector. By connecting this to the ECU or to any laptop, you can start sniffing all the CAN messages.
- Find the CAN bus in the car itself. The CAN bus is a twisted pair cable: CAN high and CAN low. Along with this, there is a ground connection as well. Hook these three wires onto the ECU and then you can start sniffing all the CAN messages
8) Attack paths feasibility
Attack vector-based approach
If an attack vector-based approach is used, it should evaluate the predominant attack vector (cf. CVSS) of the attack path. Attack feasibility rating will be higher the more remote (logically and physically) an attacker can be in order to exploit the attack path. The assumption is that the number of potential attackers can exploit a vulnerability using the internet is larger than the number of potential attackers that can exploit an attack path requiring physical access to the item or component.
spoofing on CAN Bus
|
Attack Feasibility Rating |
Determination Criteria |
|
Very low |
Physical: Threat agents require physical access to realize the attack path. |
Tampering on CAN Bus
|
Attack Feasibility Rating |
Determination Criteria |
|
Very low |
Physical: Threat agents require physical access to realize the attack path. |
9) Risk Value Determination
Value [Risk] = Impact x Feasibility [Attack path]
10) Risk treatment decision
R1: Denial of Service on Gateway ECU, Whitelist of CAN Messages | none | treated via AV: Avoidance | rationale considered impossible
R2: Spoofing of CAN Bus | 1 | treated via R: Reduction | rationale mitigated by controls
R3: Tampering on Gateway ECU,Whitelist of CAN messages | none | treated via R:Reduction | rationale Dumped by assumption