Search

Intelligent connected vehicles (ICVs) are equipped with extensive electronic control units which offer convenience but also pose significant cybersecurity risks. Penetration testing, recommended in ISO/SAE 21434 "Road vehicles—Cybersecurity engineering", is an effective approach to identify cybersecurity vulnerabilities in ICVs. However, there is limited research on vehicle penetration testing from a black-box perspective due to the complex architecture of ICVs. Additionally, no penetration testing framework has been proposed to guide security testers on conducting penetration testing for the whole vehicle. The lack of framework guidance results in the inexperienced security testers being uncertain about the processes to follow for conducting penetration testing. Moreover, the inexperienced security testers are unsure about which tests to perform in order to systematically evaluate the vehicle's cybersecurity. To enhance the penetration testing efficiency of ICVs, this paper presents a black-box penetration testing framework, ICVTest. ICVTest proposes a standardized penetration testing process to facilitate step-by-step completion of the penetration testing, thereby addressing the issue of inexperienced testers lacking guidance on how to initiate work when confronted with ICV. Also, ICVTest includes 10 sets of test cases covering hardware and software security tests. Testers can select appropriate test cases based on the specific cybersecurity threats faced by the target object, thereby reducing the complexity of penetration testing tasks. Furthermore, we have developed a vehicle cybersecurity testing platform for ICVTest that seamlessly integrates various testing tools. The platform enables even novice testers to conduct vehicle black-box penetration testing in accordance with the given guidance which addresses the current industry's challenge of an overwhelming number of testing tasks coupled with a shortage of skilled professionals. For the first time, we propose a comprehensive black-box penetration testing framework and implement the framework in the form of a cybersecurity testing platform. We apply ICVTest to evaluate an electric vehicle manufactured in 2021 for assessing the framework's availability. With the aid of ICVTest, even testers with limited experience in automotive penetration can effectively evaluate the security risks of ICVs. In our experiments, numerous cybersecurity vulnerabilities were identified involving in-vehicle sensors, remote vehicle control systems, and in-vehicle controller area network (CAN) bus. [ABSTRACT FROM AUTHOR]

The increasing complexity of web applications and systems, driven by ongoing digitalization, has made software security testing a necessary and critical activity in the software development lifecycle. This article compares the performance of open-source tools for conducting static code analysis for security purposes. Eleven different tools were evaluated in this study, scanning 16 vulnerable web applications. The selected vulnerable web applications were chosen for having the best possible documentation regarding their security vulnerabilities for obtaining reliable results. In reality, the static code analysis tools used in this paper can also be applied to other types of applications, such as embedded systems. Based on the results obtained and the conducted analysis, recommendations for the use of these types of solutions were proposed, to achieve the best possible results. The analysis of the tested tools revealed that there is no perfect tool. For example, Semgrep performed better considering applications developed using JavaScript technology but had worse results regarding applications developed using PHP technology. [ABSTRACT FROM AUTHOR]

With the continuous progress of society, computer technology and information technology are also experiencing rapid development. Especially in recent years, the application of computer technology has rapidly entered into people's daily life. As people's lives become richer, these applications have become particularly complex. For some large software, tens of thousands of function points or millions of lines of source code may be triggered to support it when performing related tasks. As a result, the security of such a complicated and excellent software becomes quite essential. The most effective way to ensure software security is to test the security of software products during the development process. A precise and effective security testing process is the basis for ensuring that software is tested for security. Without a detailed scientific software security testing model to guide software development for security testing, software security testing will become very difficult. This not only wastes more time and money but also does not guarantee the security of the software. A great security testing methodology should be able to find security problems that may be hidden deep within the software. In addition, a scientific process management can greatly facilitate the implementation of software security testing. As a result, it is relatively meaningful to establish a complete software security testing process model, generate excellent security test cases, and develop security process management tools for software security testing. At the same time, in recent years, deep learning has gradually entered more and more people's lives. However, the widespread application of deep learning systems can bring convenience to human life but also bring some hidden dangers. Hence, deep neural networks must be adequately tested to eliminate as many security risks as possible in some safety-critical software that involves personal and property safety. As the foundation of deep learning systems, deep neural networks should be adequately tested for security. However, deep learning systems are fundamentally different from traditional software testing, so traditional software testing techniques cannot be directly applied to deep neural network testing. In recent years, many scholars in related fields have proposed coverage guidelines based on deep learning testing, but the usefulness of these guidelines is still debatable. Based on the complexity of the large software development process and the fact that the interrelationship between nodes often constitutes a complex network of collaborative relationships, this study applies coverage-based testing in deep neural networks to test the security of software. To be specific, this research applies metrics such as peak coverage, speed to peak, and computational speed to evaluate coverage criteria and to investigate the feasibility of using coverage to guide test case selection to select solutions for security testing. [ABSTRACT FROM AUTHOR]

In an era of connectivity and automation, the vehicle industry is adopting numerous technologies to transform driver-centric vehicles into intelligent mechanical devices driven by software components. Software integration and network connectivity inherit numerous security issues that open the door for malicious attacks. Software security testing is a scalable and practical approach to identify systems’ weaknesses and vulnerabilities at an early stage and throughout their life-cycle. Security specialists recommend fuzz testing to identify vulnerabilities within vehicle software systems. Nevertheless, the randomness and blindness of fuzzing hinder it from becoming a reliable security tool. This article presents a vulnerability-oriented fuzz (VulFuzz) testing framework that utilizes security vulnerability metrics designed particularly for connected and autonomous vehicles to direct and prioritize the fuzz testing toward the most vulnerable components. While most gray-box fuzzing techniques aim solely to expand code coverage, the proposed approach assigns weights to ensure a thorough examination of the most vulnerable components. Moreover, we employ an input structure-aware mutation technique that can bypass vehicle software systems’ input formats to boost test performance and avoid dropped test cases. Such a testing technique will contribute to the quality assurance of vehicle software engineering. We implemented the proposed approach on OpenPilot, a driver assistance system, and compared our results to American fuzzy lop (AFL) and an unguided mutation-based fuzzer. Within 16.8 h, VulFuzz exposed 335 crashes, 41 times more than AFL and two times more than an unguided mutation-based fuzzer. VulFuzz is explicitly efficient for automotive systems, reaching the same code coverage as AFL but with more exposed crashes and fewer dropped messages. [ABSTRACT FROM AUTHOR]

This article, titled "Retracted: Software Security Testing through Coverage in Deep Neural Networks," has been retracted by Hindawi due to evidence of systematic manipulation of the publication process. The investigation revealed discrepancies in scope, description of the research, and availability of data, as well as inappropriate citations and incoherent content. Hindawi acknowledges that the usual quality checks did not identify these issues before publication and has implemented additional measures to safeguard research integrity. The corresponding author has been given the opportunity to respond to the retraction. [Extracted from the article]

Modern vehicles have evolved to support connected and self-driving capabilities. The concepts such as connected driving, cooperative driving, and intelligent transportation systems have resulted in an increase in the connectivity of vehicles and subsequently created new information security risks. The original vehicular ad-hoc network term is now emerged to a new term, Internet of Vehicles (IoV), which is a typical application of symmetry of Internet of Things (IoT). Vehicle manufacturers address some critical issues such as software bugs or security issues through remote updates, and this gives rise to concerns regarding the security of updated components. Moreover, aftermarket units such as those imposed by transportation authorities or insurance companies expose vehicles to high risk. Software testing aims to ensure that software products are reliable and behave as expected. Many commercial and open-source software products undergo formal certifications to increase users' confidence in their accuracy, reliability, and security. There are different techniques for software certification, including test-based certification. Testcase repositories are available to support software testing and certification, such as the Linux Test Project for Linux kernel testing. Previous studies performed various testing and experimental evaluation of different parts of modern vehicles to assess the security risks. Due to the lack of trusted testcase repositories and a common approach for testing, testing efforts are performed individually. In this paper, we propose a blockchain-based approach for a testcase repository to support test-based software and security testing and overcome the lack of trusted testcase repositories. The novel concept Proof-of-Validation to manage global state is proposed to manage updates to the repository. The initial work in this study considers the LTP test suite as a use case for the testcase repository. This research work is expected to contribute to the further development in including evidence generation for testing verification. [ABSTRACT FROM AUTHOR]