Authors - Lakshmi BV, Anupriya S, Ningappa B, Diganth SD, RoopaRavish, Prasad B Honnavalli Abstract - Modern car infotainment head unit has become a highly connected cyber-physical system, incorporating Wi-Fi, Bluetooth, USB ports, and the Controller Area Network (CAN) bus. While such capabilities enhance the user experience, they also raise the susceptibility of the vehicle to attacks, and hence there is a need to assess the security of the vehicle. This paper performs a comprehensive penetration test on an infotainment system, examining wireless, wired, and in-car communication channels. For the Wi-Fi component, we performed a series of attacks such as Distributed Denial-of-Service (DDoS), deauthentication, MAC and IP spoofing attacks, creating fake access points, and WPA-based attacks to determine the robustness of the system against network-level threats. Bluetooth attacks included device snarfing, replay attacks, manual packet injection attacks, and unauthorized access to data. USB attacks were employed to analyze the dangers posed by connected devices, including the extraction of GPS information, log files, SMS messages, and access to the microphone and camera. For the CAN bus, we performed replay attacks, flooding attacks, manual frame injection attacks, and manipulation of sensor information such as humidity and temperature readings. The outcome of each of these attacks indicates that the infotainment system can serve as a means through which attackers gain access to the vehicle's network, and hence the need for enhanced authentication, improved security for the interfaces, and real-time monitoring for security breaches. This paper provides valuable information for enhancing the security of modern car infotainment systems and contributes to the efforts being made in the field of automotive cybersecurity.
Open Zoom