Conducting Forensic Investigations of Cyber Attacks on Automobile In-Vehicle Networks
Paper i proceeding, 2008

The introduction of the wireless gateway as an entry point to an automobile in-vehicle network reduces the effort of performing diagnostics and firmware updates considerably. Unfortunately, the same gateway also allows cyber attacks to target the unprotected network, which currently lacks proper means for detecting and investigating security-related events. In this paper, we discuss the specifics of performing a digital forensic investigation of an in-vehicle network. An analysis of the current features of the network is performed, and an attacker model is developed. Based on the attacker model and a set of generally accepted forensic investigation principles, we derive a list of requirements for detection, data collection, and event reconstruction. We then use Brian Carrier's Digital Crime Scene Model as a template to illustrate how the requirements affect an investigation. For each phase of the model, we show the benefits of meeting the requirements and the implications of not complying with them.

vehicle

network

investigation

in-vehicle

data

requirements

Forensics

Författare

Dennis Nilsson

Chalmers, Data- och informationsteknik, Datorteknik

Ulf Larson

Chalmers, Data- och informationsteknik, Datorteknik

Proceedings of the First ACM International Conference on Forensic Applications and Techniques in Telecommunications, Information and Multimedia (e-Forensics), January 21-23, 2008, Adelaide, Australia.

1363228

Ämneskategorier

Datorteknik

ISBN

978-963979919-6