Browse Publications Technical Papers 2017-01-1657

Identifying Security Vulnerabilities Early in the ECU Software Development Lifecycle 2017-01-1657

In the past few years, automotive electronic control units (ECUs) have been the focus of many studies regarding the ability to affect the deterministic operation of safety critical cyber-physical systems. Researchers have been able to successfully demonstrate flaws in security design that have considerable, dramatic impacts on the functional safety of a target vehicle. With the rapid increase in data connectivity within a modern automobile, the attack surface has been greatly broadened to allow adversaries remote access to vehicle control system software and networks. This has serious implications, as a vast number of vulnerability disclosures released by security researchers point directly to common programming bugs and software quality issues as the root cause of successful exploits which can compromise the vehicle as a whole. In this paper, we aim to bring to light the most prominent categories of bugs found during the software development life cycle of an automotive ECU. We employ the method of static code analysis using reference coding standards such as MISRA and CERT C secure coding guidelines, to identify categories of software bugs which are most likely to remain in the vehicle, undetected as zero-day security vulnerabilities. We further examine the security issues originating from each category and provide an insight into the systematic elimination of crucial security-related bugs, much earlier in the software development life cycle. In the long term, we expect such an approach to drastically reduce the amount of attack vectors available for exploit in the ECU's software and limit the scope of damage possible by a malicious adversary.


Subscribers can view annotate, and download all of SAE's content. Learn More »


Members save up to 16% off list price.
Login to see discount.
Special Offer: Download multiple Technical Papers each year? TechSelect is a cost-effective subscription option to select and download 12-100 full-text Technical Papers per year. Find more information here.
We also recommend:

Case Study for Defining Security Goals and Requirements for Automotive Security Parts Using Threat Modeling


View Details


Methodology for Migration of Traditional Application Software to AUTOSAR Architecture


View Details


SENT - Single Edge Nibble Transmission for Automotive Applications


View Details