دانلود کتاب امنیت سایبری تهاجمی خودکار – کتابچه راهنمای مهندسی برای بهره‌برداری از پلتفرم‌های مدرن خودکار

The idea for this book was sparked by a conversation I had with a bright colleague who challenged me on the likelihood of a specific attack chain against an automotive ECU. When discussing cybersecurity risks, encountering doubtful minds is not exclusive to the automotive industry. I have heard from numerous friends who work in cloud and enterprise security that they often face skepticism when raising security concerns, especially when the remedy is costly or has an impact on performance or project schedule. But when that colleague shared his concern, it was obvious to me that this was not a simple case of disagreement over attack feasibility, but rather a disconnect with the reality of modern-day cyberattacks. Prior to that day, I had many conversations with engineers about threats against all sorts of vehicle components, and the one striking theme was always their lack of imagination about what is possible. These engineers, while quite competent in their respective domains, often failed to imagine how a security weakness in their component could ever materialize into a fullblown exploit. To their credit, I too would be highly skeptical if it were not for the hundreds of news stories and papers illustrating how attackers took advantage of seemingly innocuous vulnerabilities to carry out their attack objectives. Engineers focused on chip design, writing embedded software, or developing vehicle supporting systems may perceive the vehicle as a multi-layered fortress of electronic complexity that no one can penetrate. Heck, engineers can barely get their designs working, so it must be magnitudes more difficult for adversaries to work through that complexity and hack into the vehicle. Since rebutting this argument is not as straightforward as citing a few incidents in which that was not the case, we turn to the discipline of offensive cybersecurity to build our case. We cannot convince someone who has already made up their mind that attacking vehicles is theoretical work from the realm of science fiction rather than reality, but what we intend to do is show the evidence of what is possible and what has already happened and let you decide. While this book is focused on automotive systems, most of the concepts and attacks discussed can easily be applied to IoT systems, as the underlying architecture of edge and cloud computing is gradually converging between the two domains. Throughout this book, you will learn real-life hacks targeting each layer of vehicle architecture to show how attackers successfully achieved their objectives. As we do so, we hope to convince you that modern vehicles are more like porous membranes, with information àowing in almost every direction, as opposed to isolated islands that are hard to breach. After introducing the basic concepts of offensive cybersecurity and penetration testing, we will explore each layer of the connected vehicle architecture through case studies that show how attackers managed to bypass multiple layers of security to achieve their objectives, starting with the vehicle backend and ending with deeply embedded electronic control units and sensors. For those engineers who argued that their systems were sufficiently secure because they had built-in first-order security measures, we will see that their results were often no better than those who ignored security altogether. By the end of this book, we hope to convince you that security must be systematically integrated across all vehicle architecture layers, all development processes, and all vehicle lifecycles. Rather than overwhelming you with technical explanations about coding vulnerabilities and insecure protocols, we will introduce these concepts in the respective chapters where they were exploited in real-life attacks. Before presenting the case studies, we offer a survey of security weaknesses that impact each architecture layer to highlight the concepts and technology aspects that must be understood to fully internalize how the attacks were possible. Also, since offensive security tools are a big part of the domain, we dedicated a full chapter to the topic. This should serve as a useful reference that you can return to when reading case studies or choosing to set up your own penetration testing environment. In the final chapter, we lay out our vision for the future of defensive automotive cybersecurity, which must leverage artificial intelligence as an enabling technology not only to keep up with offensive AI capabilities, but also to finally eliminate entire classes of security weaknesses.