Penetration Testing

General Overview

We are offering pentests of embedded systems, automotive systems and hardware components. A penetration test, or pentest, simulates cyberattacks to assess a system’s, networks’s or application’s security. It reveals weaknesses and strengths, aiding in risk assessment. The process targets specific systems and goals, using various methods to breach security. Results inform the client of vulnerabilities and recommend mitigation strategies. Penetration testing is integral to security audits, mandated by standards like UNECE R155 and supporting risk assessments. Penetration tests can be tailored to meet your individual requirements.

fact sheet
contact us
Penetration_Testing

Outline

  • Comprehensive Systems Testing: We conduct thorough security tests for entire vehicles, including ECUs and embedded systems, ensuring robust protection against potential vulnerabilities.
  • Specialized Network and Interface Testing: Our package offers in-depth testing services for vehicle control units, using reverse engineering, hardware checks, and protocol fuzzing to identify vulnerabilities and enhance vehicle security.
  • Hardware-Security Analysis: We carefully examine hardware components like microcontrollers to uncover potential security gaps and recommend measures to fortify ECUs and microcontrollers against attacks
  • Processor-Security Analysis: We delve into processor security, conducting detailed analyses to identify vulnerabilities and implement tailored protective measures.
  • Proof of Concept Attacks and Showcases: We craft practical attack demonstrations to showcase potential vulnerabilities and provide actionable insights for strengthening security measures.
  • Customized Scope of Testing: Our testing scope includes reverse engineering, hardware security assessments, and robustness testing through fuzzing, ensuring comprehensive coverage of potential attack vectors. However, the specific scope is always agreed with the customer in advance.
  • Detailed Reporting and Results: Clients receive detailed reports outlining findings, risk assessments, and proposed countermeasures, along with technical scripts where feasible for reproducing findings.
  • Continuous Security Testing: We offer ongoing security monitoring and detailed vulnerability reports for integrated control units using our fully automated testing system, dissecto HydraVision.

Work Results

Result 1: At the start of the project a test plan is created, which shows the individual steps and processes.

Result 2: dissecto GmbH delivers a results report with the following contents:

  • Management summary, summary of top risks with attack paths and requirements for measures to be taken.
  • Description of scope and out-of-scope
  • A description of the test procedure
  • A description of the test setup (including software and hardware versions of all components involved)
  • All findings including concrete traces that show the security problem mentioned, classification of the findings according to the specified risk metrics and proposed countermeasures

Result 3: With the help of our fully automated “Platform as a Service” (PaaS) test system dissecto HydraVision, the client will receive continuous detailed reports on weak points of the integrated control units (continuous re-testing)

Result 4: If technically possible, scripts are provided to reproduce the findings.

Examination Object

The test object is a control unit with the following conditions:

  • The component operates in a system network with other components. If a test setup is required, this will be provided by the customer
  • The component has 1+ vehicle buses (e.g. CAN, CAN-FD, 10/100/1000BASE-T1/100BASE-TX Ethernet)
  • The component has 1+ microcontrollers that provide debugging interfaces on the PCB (e.g. UART, JTAG)
  • The microcontrollers may have hardware-based protection mechanisms (e.g. JTAG lock, HSM)
  • The component has a diagnostic stack that can be used to process diagnostic messages and to program the ECU (flashing). Likewise, variants are configured via the UDS diagnostic protocol (coding)

Requirements

  • The customer provides all necessary documents in due time
  • The client provides at least two test setups or control units
  • The client designates a fixed contact person who is available for queries during the penetration test

Procedure

Penetration Test Package – Automotive Systems

fact sheet

Our Penetration Test Package “Automotive Systems (Networks & Interfaces)” offers comprehensive testing services for vehicle control units. Using reverse engineering, hardware checks, protocol fuzzing and more, we identify vulnerabilities and assist in improving vehicle security.

Penetration Test Package – Hardware Security

fact sheet

Our “Hardware Security” Penetration Testing Package offers comprehensive testing services for your ECUs and microcontrollers. We create detailed test plans, provide comprehensive results reports, and use specialized attack scenarios to uncover security vulnerabilities and recommend protective measures.

*product specifications and features are subject to change without prior notice as we continuously strive to improve our products