books/awesome-connected-things-sec
1
0
Fork 0
mirror of https://github.com/V33RU/awesome-connected-things-sec.git synced 2026-04-10 12:33:45 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
master
awesome-connected-things-sec/docs/Automotive/automotive-security.md
`Mr-IoT` 5a4a214417 Update automotive-security.md
2025-07-26 17:26:32 +05:30

228 lines
20 KiB
Markdown
Raw Permalink Blame History

This file contains ambiguous Unicode characters
This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.
# Car Hacking Resources: From Origins to Today
A historical and up-to-date guide to the world of automotive security and car hacking covering foundational breakthroughs, major attacks, community growth, tools, and essential resources.
---
## Table of Contents
- [Early Days: 1990s–2000s](#early-days-1990s2000s)
- [2010–2014: Proof-of-Concepts and Recognition](#20102014-proof-of-concepts-and-recognition)
- [2015–2018: Mainstream Awareness and Escalation](#20152018-mainstream-awareness-and-escalation)
- [International Automotive Cybersecurity Standards — Regional Table](#international-automotive-cybersecurity-standards-regional-table)
- [2019–2021: Community, Tools, and Remote Exploits](#20192021-community-tools-and-remote-exploits)
- [2022–2025: Modern Era and Emerging Frontiers](#20222025-modern-era-and-emerging-frontiers)
- [Essential Learning & Research Resources](#essential-learning--research-resources)
- [Getting Started with Car Hacking (Today)](#getting-started-with-car-hacking-today)
- [Summary Timeline of Milestones](#summary-timeline-of-milestones)
- [Curated Modern Automotive Security List (2025)](#curated-modern-automotive-security-list-2025)
---
## Early Days: 1990s–2000s
- **First Hacking Points:** OBD (On-Board Diagnostics) port introduction enabled access to engine management with custom hardware and proprietary protocols.
- **Key Focus:** Wired access to in-vehicle networks, mainly CAN (Controller Area Network, [CAN Wikipedia](https://en.wikipedia.org/wiki/CAN_bus), standardized 1991).
- **Barriers:** Highly proprietary, isolated systems; vehicle-specific strategies required.
---
## 2010–2014: Proof-of-Concepts and Recognition
- Researchers began hacking ECUs through direct access, quickly moving to remote attacks via Bluetooth, CD, cellular, and more.
- Notable exploits included 2011 Chevy Malibu remote hacks ([Wired Article](https://www.wired.com/2011/03/hackers-car/)) and proof that almost any connected vehicle could be at risk.
- **Open-source tools and low-cost OBD-II USB adapters** made experimentation accessible.
---
## 2015–2018: Mainstream Awareness and Escalation
- **Landmark Hacks:**
- 2013: [Miller and Valasek](https://illmatics.com/carhacking.html) controlled Ford Escape and Toyota Prius (acceleration, steering, GPS spoofing).
- 2015: [Jeep Cherokee/UConnect hack](https://www.wired.com/2015/07/hackers-remotely-kill-jeep-highway/) allowed full remote takeover - leading to million-vehicle recall.
- Tesla ([2016 hack](https://www.wired.com/2016/09/tesla-hack-can-remote-control-brakes-and-more/)), BMW ([ConnectedDrive hack](https://www.wired.com/2015/01/hackers-remotely-unlock-dozens-bmw-models/)), and Nissan ([Nissan Leaf hack](https://www.troyhunt.com/controlling-vehicle-features-of-nissan/)) also targeted through remote and telematics attacks.
- **Ecosystem Milestones:**
- [Instrument Cluster Simulator (ICSim)](https://github.com/zombieCraig/ICSim) released.
- [DEF CON Car Hacking Village](https://www.carhackingvillage.com/) - a global hub for car security research.
---
## 2019–2021: Community, Tools, and Remote Exploits
- **Events:** [Car Hacking Village (DEF CON)](https://www.carhackingvillage.com/) and [Car Hacking Village @ DefCamp](https://def.camp/car-hacking-village/) expand globally.
- [Open Garages](https://github.com/openGarages) and online forums centralize tutorials, datasets, and collaborative research.
- Tools like [can-utils](https://github.com/linux-can/can-utils), [python-can](https://pypi.org/project/python-can/), and [Scapy/CAN](https://dissec.to/kb/chapters/can/can-scapy.html) widely adopted in both hobbyist and professional domains.
- Complexity increases - modern vehicles become software-centric and remotely exploitable.
---
## 2022–2025: Modern Era and Emerging Frontiers
- **API & Backend Attacks:**
- Mass remote exploitation of telematics APIs by researchers - impacting brands like Acura, Kia ([Kia API bug](https://samcurry.net/hacking-kia)), BMW, Tesla ([Tesla charger exploit](https://www.synacktiv.com/en/publications/exploiting-the-tesla-wall-connector-from-its-charge-port-connector)), Nissan ([Nissan Leaf hack](https://www.troyhunt.com/controlling-vehicle-features-of-nissan/)), and Škoda ([Škoda Mobile App bug](https://blog.vensis.pl/2019/11/vw-hacking/)).
- **Hardware & Software Expansion:** Advanced interfaces and attack tools: [Nano-CAN](https://github.com/mintynet/nano-can), [CANtact](http://linklayer.github.io/cantact/), [CANPico](https://canislabs.com/canpico/), [M2 by Macchina](https://www.macchina.cc/), [ELM327](https://www.amazon.com/dp/B07SK6MJT1/).
- **Active Communities:** [DEF CON Car Hacking Village](https://www.carhackingvillage.com/), [ASRG](https://asrg.io/), [Car Hacking Village (Europe, DefCamp)](https://def.camp/car-hacking-village/), [Open Garages](https://github.com/openGarages).
- **Ongoing Publications:** [The Car Hacker’s Handbook](https://nostarch.com/carhacking), academic surveys ([ScienceDirect](https://www.sciencedirect.com/science/article/pii/S0167404825001415), [MDPI Sensors](https://www.mdpi.com/1424-8220/24/18/6139)), live vulnerability tracking ([VicOne zero-days](https://vicone.com/automotive-zero-day-vulnerabilities)).
---
## International Automotive Cybersecurity Standards - Regional Table
| Country/Region | Key Standards / Regulations | Regulatory Bodies / Notes |
|------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------|
| **Global** | [ISO/SAE 21434](https://www.iso.org/standard/70918.html) (Cybersecurity Engineering), [UNECE WP.29 R155/R156](https://unece.org/transport/vehicle-regulations/notifications-un-regulations/r155) | ISO, SAE, UNECE. Adopted by most OEMs worldwide. |
| **United States**| [SAE J3061](https://www.sae.org/standards/content/j3061_201601/), [NHTSA Cybersecurity Best Practices](https://www.nhtsa.gov/technology-innovation/vehicle-cybersecurity), [Auto-ISAC Best Practices](https://www.automotiveisac.com/best-practices/), [NIST 800 Series](https://csrc.nist.gov/publications/sp800) | NHTSA, SAE, Auto-ISAC, NIST. J3061 is a precursor to ISO/SAE 21434. |
| **EU** | [UNECE WP.29 R155/R156](https://unece.org/transport/vehicle-regulations/notifications-un-regulations/r155), [GDPR](https://gdpr.eu/), [ENISA Guidance](https://www.enisa.europa.eu/publications/cybersecurity-challenges-in-the-updated-automotive-homologation-regulation) | UNECE, European Commission, ENISA. GDPR covers data privacy. |
| **Japan** | [UNECE WP.29 R155/R156](https://unece.org/transport/vehicle-regulations/notifications-un-regulations/r155), [JASO TP18004](https://www.jsa.or.jp/en/standardization/standards/list/?std_no=JASO%20TP18004) | JAMA, JASO, MLIT. JASO guidance tailors standards to domestic industry. |
| **China** | [GB/T 38629-2020](https://openstd.samr.gov.cn/bzgk/gb/newGbInfo?hcno=1A37265F240A5EBE736D5A1516E27A93), [GB/T 37292-2018](https://openstd.samr.gov.cn/bzgk/gb/newGbInfo?hcno=EEF574A39601C6B8F58DAE26DA55F4DC), MIIT, [CCC Cybersecurity](http://www.miit.gov.cn) | MIIT, CCC. GB/T standards required for type approvals. |
| **South Korea** | [UNECE WP.29](https://unece.org/transport/vehicle-regulations/notifications-un-regulations/r155), KATRI Guidance | KATRI, MOLIT. National docs supplement UNECE. |
| **UK** | [UNECE WP.29](https://unece.org/transport/vehicle-regulations/notifications-un-regulations/r155), [DCMS Code of Practice](https://www.gov.uk/government/publications/code-of-practice-for-consumer-iot-security), [NCSC Guidance](https://www.ncsc.gov.uk/collection/connected-places-guidance) | DVSA, DCMS, NCSC. Dedicated automotive/IoT code post-Brexit. |
| **Australia** | [UNECE WP.29](https://unece.org/transport/vehicle-regulations/notifications-un-regulations/r155), [ACSC Guidance](https://www.cyber.gov.au/acsc/view-all-content/publications/securing-connected-vehicles) | Dept. of Infrastructure, ACSC. National supplements for cyber and connected fleets. |
| **Germany** | [IT Security Catalogue (BNetzA)](https://www.bundesnetzagentur.de/EN/Areas/Energy/Companies/Security_of_supply/IT_Security_Catalogue/IT_Security_Catalogue_node.html), [UNECE WP.29](https://unece.org/transport/vehicle-regulations/notifications-un-regulations/r155) | BNetzA. Applies IT/OT security standards to automotive and infrastructure sectors. |
| **Switzerland** | [Basel/FINMA Cyber Guidance](https://www.finma.ch/en/documentation/finma-guidance/) | Basel Committee, FINMA. Emphasis on supply chain and digital vehicle resilience. |
## Essential Learning & Research Resources
| Resource/Community | Type | Description/Notes |
|-------------------------------------------------------------------------------------|-------------------|------------------------------------------------|
| [The Car Hacker’s Handbook (Craig Smith)](https://nostarch.com/carhacking) | Book | Comprehensive guide to car security |
| [Hacking Connected Cars](https://www.amazon.com/gp/product/1119491761/) | Book | Techniques and procedures book |
| [ICSim](https://github.com/zombieCraig/ICSim) | Toolkit/Software | CAN cluster simulation |
| [can-utils](https://github.com/linux-can/can-utils) | Toolkit/Software | CAN bus open-source tools |
| [python-can](https://pypi.org/project/python-can/) | Toolkit/Software | Python CAN bus library |
| [Scapy/CAN Layer](https://dissec.to/kb/chapters/can/can-scapy.html) | Toolkit/Software | CAN protocol analysis |
| [DEF CON Car Hacking Village](https://www.carhackingvillage.com/) | Community/Event | Global in-person and virtual hands-on events |
| [Car Hacking Village @ DefCamp](https://def.camp/car-hacking-village/) | Community/Event | European CTF/hack venue |
| [ASRG](https://asrg.io/) | Community | Auto Security Research Group: global research |
| [Open Garages](https://github.com/openGarages) | Forum/Repo | Tutorials, datasets, simulation kits |
| [Upstream Security Reports](https://upstream.auto/reports/global-automotive-cybersecurity-report/) | Research/Survey | Trends, vulnerabilities, industry survey |
| [The Hacker News: API survey](https://thehackernews.com/2023/01/millions-of-vehicles-at-risk-api.html) | News/Research | Mass API attack reports |
| [arXiv: UWBAD paper](https://arxiv.org/abs/2407.00682) | Research | Ultra-Wideband relay attack research |
| [arXiv: SAE J1939 attacks](https://arxiv.org/abs/2406.00810) | Research | Heavy-duty transport attacks |
| [ScienceDirect: HD vehicle review](https://www.sciencedirect.com/science/article/pii/S0167404825001415) | Research | Heavy vehicle vulnerabilities |
| [MDPI Sensors: SDV security](https://www.mdpi.com/1424-8220/24/18/6139) | Research/Survey | Survey on frameworks/attacks |
| [VicOne Zero-Day Database](https://vicone.com/automotive-zero-day-vulnerabilities) | Vulnerability DB | Live CVE, 0-day tracking |
---
## Getting Started with Car Hacking (Today)
- **Read:** [The Car Hacker’s Handbook](https://nostarch.com/carhacking)
- **Practice:** Use [ICSim](https://github.com/zombieCraig/ICSim), [ELM327](https://www.amazon.com/dp/B07SK6MJT1/), [CANtact](http://linklayer.github.io/cantact/) on test benches.
- **Engage:** [ASRG](https://asrg.io/), [Open Garages](https://github.com/openGarages), [DEF CON Car Hacking Village](https://www.carhackingvillage.com/)
- **Stay Current:** [Upstream Reports](https://upstream.auto/reports/global-automotive-cybersecurity-report/), [arXiv search: automotive security](https://arxiv.org/search/cs?searchtype=author&query=automotive+security), [HackerNews](https://thehackernews.com/search?q=automotive)
---
## Summary Timeline of Milestones
- **1990s–2000s:** OBD/CAN bus hacking ([CAN bus](https://en.wikipedia.org/wiki/CAN_bus))
- **2010–2014:** [Chevy Malibu hack (Wired)](https://www.wired.com/2011/03/hackers-car/), [CAN-utils](https://github.com/linux-can/can-utils), [ELM327](https://www.amazon.com/dp/B07SK6MJT1/)
- **2015:** [Jeep UConnect hack](https://www.wired.com/2015/07/hackers-remotely-kill-jeep-highway/), [DEF CON Car Hacking Village](https://www.carhackingvillage.com/)
- **2016–2018:** [BMW](https://www.wired.com/2015/01/hackers-remotely-unlock-dozens-bmw-models/), [Tesla](https://www.wired.com/2016/09/tesla-hack-can-remote-control-brakes-and-more/), [ICSim](https://github.com/zombieCraig/ICSim)
- **2019–2025:** [API hacks survey](https://thehackernews.com/2023/01/millions-of-vehicles-at-risk-api.html), [Upstream Report](https://upstream.auto/reports/global-automotive-cybersecurity-report/), [VicOne 0-days](https://vicone.com/automotive-zero-day-vulnerabilities)
---
## Curated Modern Automotive Security List (2025)
### Approach & Methodology
- In-Vehicle Network, Hardware Hacking, Firmware, Wireless, Mobile App, Cloud/Telemetry, AI-based Security, Supply Chain, Mobility.
### Communities & Events
- [ASRG](https://asrg.io/)
- [Auto-ISAC](https://automotiveisac.com/)
- [Car Hacking Village – DEF CON](https://www.carhackingvillage.com/)
- [Pwn2Own Automotive](https://www.automotiveworld.jp/tokyo/en-gb/conference/pwn2own.html)
- [Automotive Cybersecurity Detroit 2025](https://www.automotive-iq.com/events-automotive-cybersecurity/agenda-mc)
- [Auto-ISAC Europe Summit 2025](https://automotiveisac.com/2025-europe-summit)
- [escar Europe 2025](https://easychair.org/cfp/escarEurope2025)
### Educational Resources
- [Car Hacker’s Handbook](https://nostarch.com/carhacking)
- [Hacking Connected Cars](https://www.amazon.com/gp/product/1119491761/)
- [ASRG YouTube](https://www.youtube.com/@automotivesecurityresearch1613)
- [Car Hacking Village YouTube](https://www.youtube.com/@carhackingvillage)
- [CANisLabs Blog](https://kentindell.github.io/)
- [CANBusHack Blog](https://canbushack.com/blog/)
### Tools & Platforms
#### Hardware
- [Nano-CAN](https://github.com/mintynet/nano-can)
- [USBtin](http://www.fischl.de/usbtin/)
- [USB2CAN](http://www.8devices.com/products/usb2can/)
- [CANPico](https://canislabs.com/canpico/)
- [OBD-KILL](https://store.intrepidcs.com/product/chv-badge-30)
- [ELM327](https://www.amazon.com/dp/B07SK6MJT1/)
- [CANtact](http://linklayer.github.io/cantact/)
- [Macchina M2](https://www.macchina.cc/)
#### Software
- [can-utils](https://github.com/linux-can/can-utils)
- [ICSim](https://github.com/zombieCraig/ICSim/)
- [UDSim](https://github.com/zombieCraig/UDSim/)
- [CANalyse 2.0](https://github.com/canalyse/CANalyse-2.0)
- [CANToolz](https://github.com/eik00d/CANToolz)
- [CANalyzat0r](https://github.com/schutzwerk/CANalyzat0r)
#### Libraries
- [python-can](https://pypi.org/project/python-can/)
- [Scap CAN Layer](https://dissec.to/kb/chapters/can/can-scapy.html)
#### Lists & Platforms
- [Awesome Vehicle Security](https://github.com/jaredthecoder/awesome-vehicle-security)
- [wtsxDev/Vehicle-Security](https://github.com/wtsxDev/Vehicle-Security)
- [Carpunk](https://github.com/souravbaghz/Carpunk)
- [pq-flasher](https://github.com/I-CAN-hack/pq-flasher)
- [FOSSA for Automotive](https://fossa.com/industries/manufacturing-autos/)
- [GitGuardian for Automotive](https://www.gitguardian.com/industries/automotive)
### Research, Papers & Vulnerabilities
- [UWBAD – Ultra-Wideband Keyless Entry Jamming (arXiv)](https://arxiv.org/abs/2407.00682)
- [SAE J1939 Attacks (arXiv)](https://arxiv.org/abs/2406.00810)
- [ScienceDirect: Heavy-Duty Vehicle Security Review](https://www.sciencedirect.com/science/article/pii/S0167404825001415)
- [MDPI Sensors: Survey on SDV Security](https://www.mdpi.com/1424-8220/24/18/6139)
- [VicOne Automotive Zero-Day Vulnerabilities](https://vicone.com/automotive-zero-day-vulnerabilities)
- [The Hacker News – API Vulnerability Survey](https://thehackernews.com/2023/01/millions-of-vehicles-at-risk-api.html)
- [Upstream: 2025 Global Automotive Cybersecurity Report](https://upstream.auto/reports/global-automotive-cybersecurity-report/)
---
**Reference Resource Links:**
- [UNECE WP.29 Regulation Summary](https://unece.org/transport/vehicle-regulations/notifications-un-regulations/r155)
- [ISO/SAE 21434 Standard Overview](https://www.iso.org/standard/70918.html)
- [Auto-ISAC Best Practices](https://www.automotiveisac.com/best-practices/)
- [ENISA Automotive Cybersecurity](https://www.enisa.europa.eu/publications/cybersecurity-challenges-in-the-updated-automotive-homologation-regulation)
- [China MIIT](http://www.miit.gov.cn)
- [DCMS Consumer IoT Code of Practice](https://www.gov.uk/government/publications/code-of-practice-for-consumer-iot-security)
- [Australian Cyber Security Centre Automotive Guidance](https://www.cyber.gov.au/acsc/view-all-content/publications/securing-connected-vehicles)
- [BNetzA IT Security Catalogue](https://www.bundesnetzagentur.de/EN/Areas/Energy/Companies/Security_of_supply/IT_Security_Catalogue/IT_Security_Catalogue_node.html)
### New & Emerging Threats
- AI Security & Prompt Injection
- Automotive Software Supply Chain Security
- Connected Mobility & Telematics API Security
- EV Charging Infrastructure Vulnerabilities
- Ransomware & Data Breach Response
### Recommendations
- Monitor live vulnerability and supply chain intelligence portals (e.g., [VicOne](https://vicone.com/automotive-zero-day-vulnerabilities), [FOSSA](https://fossa.com/industries/manufacturing-autos/), [GitGuardian](https://www.gitguardian.com/industries/automotive)).
- Engage at [DEF CON Car Hacking Village](https://www.carhackingvillage.com/), [Auto-ISAC Summits](https://automotiveisac.com/), and [Pwn2Own Automotive](https://www.automotiveworld.jp/tokyo/en-gb/conference/pwn2own.html).
- Follow and contribute to open-source and research repositories.
- Stay updated with [Upstream Reports](https://upstream.auto/reports/global-automotive-cybersecurity-report/), and adapt to regulatory and threat intelligence changes.
---
*This guide covers car hacking’s journey from early OBD/CAN explorations to today’s cloud, API, and AI security challenges - linking you directly to key reference points and resources at each stage.*
Reference in New Issue View Git Blame Copy Permalink