Beyond the Dashboard : Vulnerability analysis of the MG Marvel R In-Vehicle Infotainment System

Sammanfattning

In recent years, the global surge in the adoption of Electric Vehicles (EVs) has been propelled by environmental and economic benefits. This development has gone hand-in-hand with vehicles becoming more technologically advanced with internet connectivity, complex internal networks, and computing systems running applications being integrated into modern vehicles. Notably, the In-Vehicle Infotainment (IVI) systems of modern cars bear striking resemblance to smartphones and computers, offering functionalities like real-time navigation updates, Over The Air (OTA) software updates, media players, and more, all aimed at enhancing the driving experience. This however opens vehicles up to potential cyber threats, which could lead to severe consequences. This thesis undertakes an evaluation of the security of the IVI system of an MG Marvel R EV. The objective is to identify vulnerabilities within the infotainment system, thereby assessing what cybersecurity threats exist in modern vehicles. The methodology adopted in this project was penetration testing with the PatrIoT approach focusing on the IVI system and its interconnected components. A comprehensive threat model was designed, and a select set of vulnerabilities was targeted for exploitation as a proof-of-concept demonstration. The study found several vulnerabilities in the IVI of the MG Marvel R of varying severity, which were successfully exploited. The attacks require an adversary to be on the same network as the IVI or have temporary physical access to the vehicle. Therefore, the vulnerabilities found do not pose a direct threat to the general driver but do highlight the risk of targeted attacks. This project with its threat model and results provides a general insight into the internals and security of the MG Marvel R IVI. It hopes to be a good starting point for future security researchers and car manufacturers to improve the security of their vehicles.