A remote and automatic framework for automotive cybersecurity testing

Despite the increase in the use of Internet of Things (IoT) devices in security-critical sectors like automotive, conducting comprehensive security tests presents several challenges. Traditional methods for penetration testing are often manual, time-consuming, and not suitable for the range and large quantity of IoT devices present in modern applications. This gap puts these devices at risk of cyber attacks, which can have negative consequences on privacy and safety. The increasing reliance on IoT devices in the automotive industry makes the security of vehicle systems critically important. With new cybersecurity regulations being introduced in Europe (e.g., UNECE R155), it has become crucial to implement strong security measures for automotive systems. In this thesis, we propose a novel approach for automatic penetration testing. This system leverages the capabilities of Weseth, a platform able to provide access to the System Under Test (SUT) in a remote fashion, such as automotive networks. This capability is crucial for conducting security testing in environments that replicate real-world scenarios, without the need for physical presence or direct connection to the automotive systems. More precisely, we create an abstracted execution model for performing penetration tests. This model is designed to facilitate the seamless execution of any test provided from an always-expanding catalog, regardless of the host environment. To achieve this high level of generalization and flexibility, are used containerization techniques as a lightweight, isolated layer that operates independently from the host. The findings not only provide a foundation for future research in this area but also offer practical tools that can be immediately applied to improve the cybersecurity posture of automotive systems, in alignment with emerging regulations. Future enhancements of this work could significantly benefit from the integration of machine learning techniques. By analyzing penetration test outputs, these techniques could not only identify security vulnerabilities but also suggest potential mitigation. This approach promises a transition from merely diagnostic to proactive and adaptive security measures, enhancing the resilience and intelligence of automotive IoT systems against evolving cyber threats.