Conducting forensic investigations of cyber attacks on automobile in-vehicle networks

Authors:
Dennis K. Nilsson;Ulf E. Larson
Affiliations:
Chalmers University of Technology, Göteborg, Sweden;Chalmers University of Technology, Göteborg, Sweden
Venue:
Proceedings of the 1st international conference on Forensic applications and techniques in telecommunications, information, and multimedia and workshop
Year:
2008

Citing 4
Cited 4

Incident Response: Investigating Computer Crime

Incident Response: Investigating Computer Crime
A categorization of computer security monitoring systems and the impact on the design of audit sources

A categorization of computer security monitoring systems and the impact on the design of audit sources
Real Digital Forensics: Computer Security and Incident Response

Real Digital Forensics: Computer Security and Incident Response
Computer Forensics: Principles and Practices (Prentice Hall Security Series)

Computer Forensics: Principles and Practices (Prentice Hall Security Series)

Securing vehicles against cyber attacks

Proceedings of the 4th annual workshop on Cyber security and information intelligence research: developing strategies to meet the cyber security and information intelligence challenges ahead
Creating a Secure Infrastructure for Wireless Diagnostics and Software Updates in Vehicles

SAFECOMP '08 Proceedings of the 27th international conference on Computer Safety, Reliability, and Security
Simulated attacks on CAN buses: vehicle virus

AsiaCSN '08 Proceedings of the Fifth IASTED International Conference on Communication Systems and Networks
A partially reconstructed previous Gmail session by live digital evidences investigation through volatile data acquisition

Security and Communication Networks

Quantified Score

Hi-index	0.00

Visualization

Abstract

The introduction of the wireless gateway as an entry point to an automobile in-vehicle network reduces the effort of performing diagnostics and firmware updates considerably. Unfortunately, the same gateway also allows cyber attacks to target the unprotected network, which currently lacks proper means for detecting and investigating security-related events. In this paper, we discuss the specifics of performing a digital forensic investigation of an in-vehicle network. An analysis of the current features of the network is performed, and an attacker model is developed. Based on the attacker model and a set of generally accepted forensic investigation principles, we derive a list of requirements for detection, data collection, and event reconstruction. We then use Brian Carrier's Digital Crime Scene Model as a template to illustrate how the requirements affect an investigation. For each phase of the model, we show the benefits of meeting the requirements and the implications of not complying with them.