A Study of Security Vulnerabilities and Software Weaknesses in Vehicles

被引：10

作者：

Xiong, Wenjun ^{[1
]}

Gulsever, Melek ^{[1
]}

Kaya, Koray Mustafa ^{[1
]}

Lagerstrom, Robert ^{[1
]}

机构：

[1] KTH Royal Inst Technol, Sch Elect Engn & Comp Sci, Stockholm, Sweden

来源：

SECURE IT SYSTEMS, NORDSEC 2019 | 2019年 / 11875卷

关键词：

Vehicles; Cyber security; Vulnerabilities; Weaknesses;

D O I：

10.1007/978-3-030-35055-0_13

中图分类号：

TP [自动化技术、计算机技术];

学科分类号：

0812 ;

摘要：

In this paper, we conduct an empirical study with the purpose of identifying common security vulnerabilities discovered in vehicles. The vulnerability information is gathered for 60 vehicle OEMs (Original Equipment Manufacturers) and common vehicle components from the National Vulnerability Database (NVD). Each vulnerability (CVE) is analyzed with respect to its software weakness type (CWE) and severity score (CVSS). 44 unique CVEs were found in NVD and analyzed. The analysis results show that about 50% of the vulnerabilities fall into the medium severity category, and the three most common software weaknesses reported are protection mechanism failure, buffer errors, and information disclosure.

引用

页码：204 / 218

页数：15

共 50 条

[41] Security vulnerabilities in computer software testing technology and its application
Lan, Jiang
INFORMATION TECHNOLOGY AND INDUSTRIAL ENGINEERING, VOLS 1 & 2, 2014, : 541 - 545
[42] Assessing and Extracting Software Security Vulnerabilities in SOFL Formal Specifications
Emeka, Busalire Onesmus
Liu, Shaoying
2018 INTERNATIONAL CONFERENCE ON ELECTRONICS, INFORMATION, AND COMMUNICATION (ICEIC), 2018, : 374 - 377
[43] Detecting Software Security Vulnerabilities Via Requirements Dependency Analysis
Wang, Wentao
Dumont, Faryn
Niu, Nan
Horton, Glen
IEEE TRANSACTIONS ON SOFTWARE ENGINEERING, 2022, 48 (05) : 1665 - 1675
[44] Analysis of Software Vulnerabilities, Measures for Prevention and Protection and Security Testing
Nakov, Ognian
Trifonov, Roumen
Pavlova, Galya
Nakov, Plamen
2021 29TH NATIONAL CONFERENCE WITH INTERNATIONAL PARTICIPATION (TELECOM), 2021, : 73 - 76
[45] Automated Risk Management Based Software Security Vulnerabilities Management
Althar, Raghavendra Rao
Samanta, Debabrata
Kaur, Manjit
Singh, Dilbag
Lee, Heung-No
IEEE ACCESS, 2022, 10 : 90597 - 90608
[46] Bug, Fault, Error, or Weakness: Demystifying Software Security Vulnerabilities
Bojanova, Irena
Galhardo, Carlos Eduardo C.
IT PROFESSIONAL, 2023, 25 (01) : 7 - 12
[47] Improving Software Security by Eliminating the CWE Top 25 Vulnerabilities
Howard, Michael
IEEE SECURITY & PRIVACY, 2009, 7 (03) : 68 - 71
[48] On the Design of IoT Security: Analysis of Software Vulnerabilities for Smart Grids
Mathas, Christos-Minas
Vassilakis, Costas
Kolokotronis, Nicholas
Zarakovitis, Charilaos C.
Kourtis, Michail-Alexandros
ENERGIES, 2021, 14 (10)
[49] Mining the Categorized Software Repositories to Improve the Analysis of Security Vulnerabilities
Sadeghi, Alireza
Esfahani, Naeem
Malek, Sam
FUNDAMENTAL APPROACHES TO SOFTWARE ENGINEERING, FASE 2014, 2014, 8411 : 155 - 169
[50] An Approach to Obtain Software Security Vulnerabilities Based on Vertical Search
Li, Xiaohong
Hu, Chang
Feng, Zhiyong
Du, Hongwei
Ding, Ganggang
MEMS, NANO AND SMART SYSTEMS, PTS 1-6, 2012, 403-408 : 3203 - 3206

← 1 2 3 4 5 →