{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,8]],"date-time":"2026-07-08T15:55:50Z","timestamp":1783526150501,"version":"3.55.0"},"reference-count":49,"publisher":"Springer Science and Business Media LLC","issue":"1","license":[{"start":{"date-parts":[[2022,5,25]],"date-time":"2022-05-25T00:00:00Z","timestamp":1653436800000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"},{"start":{"date-parts":[[2022,5,25]],"date-time":"2022-05-25T00:00:00Z","timestamp":1653436800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["J Comput Virol Hack Tech"],"abstract":"<jats:title>Abstract<\/jats:title><jats:p>Modern vehicles resemble four-wheels computers connected to the Internet via their In-Vehicle Infotainment (IVI) systems. As with PCs in the past, cars, being connected to the Internet can be potentially vulnerable. The IVI system of a car is part of the intra-vehicle network and can be the entry-point of offensive cybersecurity attacks. The intra-vehicle network, based on the CAN protocol, is vulnerable <jats:italic>by design<\/jats:italic>: messages are exchanged in clear. Thus, the uncontrolled access to the CAN bus may have serious impact on the vehicle itself and its passengers. In this paper, we present a vulnerability assessment, through a reverse engineering process, of Kia vehicles IVI system. In particular, we focused on reverse engineer the Kia IVI system to discover vulnerabilities that may allow an attacker to compromise the IVI functionalities and inject CAN frames into the CAN bus to alter the behaviour of (part of) the vehicle. By reverse engineering the IVI, we identified four important vulnerabilities that affect all Kia vehicles that embed the studied IVI. Finally, we show how an attacker can easily control the IVI and inject CAN bus frames by means of a Metasploit module that we wrote.<\/jats:p>","DOI":"10.1007\/s11416-022-00430-5","type":"journal-article","created":{"date-parts":[[2022,5,25]],"date-time":"2022-05-25T05:03:56Z","timestamp":1653455036000},"page":"33-49","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":11,"title":["Reversing Kia Motors Head Unit to discover and exploit software vulnerabilities"],"prefix":"10.1007","volume":"19","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-2900-262X","authenticated-orcid":false,"given":"Gianpiero","family":"Costantino","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Ilaria","family":"Matteucci","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"297","published-online":{"date-parts":[[2022,5,25]]},"reference":[{"key":"430_CR1","unstructured":"Technology, S.: Automotive ECUs, the Core for Connected Cars. https:\/\/www.syrmatech.com\/ automotive-ecu\/. Accessed 22\/12\/2021 (2022)"},{"key":"430_CR2","unstructured":"International Organization for Standardization: Road vehicles\u2014Controller area network (CAN)\u2014Part 1: Data link layer and physical signalling. https:\/\/www.iso.org\/standard\/63648.html. Accessed 22\/12\/2021 (2015)"},{"key":"430_CR3","doi-asserted-by":"publisher","unstructured":"Dariz, L., Costantino, G., Ruggeri, M., Martinelli, F.: A Joint Safety and Security Analysis of message protection for CAN bus protocol. Adv. Sci. Technol. Eng. Syst. J. 3(1), 384\u2013393 (2018). https:\/\/doi.org\/10.25046\/aj030147","DOI":"10.25046\/aj030147"},{"key":"430_CR4","unstructured":"Dariz, L., Ruggeri, M., Costantino, G., Martinelli, F.: A survey over low-level security issues in heavy duty vehicles. In: Automotive Cyber Security Conference. ESCAR (2016)"},{"key":"430_CR5","doi-asserted-by":"crossref","unstructured":"Dariz, L., Selvatici, M., Ruggeri, M., Costantino, G., Martinelli, F.: Trade-off analysis of safety and security in can bus communication. In: The 5th IEEE International Conference on Models and Technologies for Intelligent Transportation Systems (MT-ITS 2017), pp. 226\u2013231. IEEE, Piscataway, New Jersey, USA (2017)","DOI":"10.1109\/MTITS.2017.8005670"},{"key":"430_CR6","unstructured":"Strategy Analytics Press Releases: Linux, Android poised to dominate automotive infotainment systems. https:\/\/www.telecomtv.com\/content\/device-software-apps\/linux-android-poised-to-dominate-automotive-infotainment-systems-34987\/. Accessed 22\/12\/2021 (2019)"},{"key":"430_CR7","unstructured":"Christoph Hammerschmidt: Study: Android challenges automotive OS market. https:\/\/www.eenewsautomotive.com\/news\/study-android-challenges-automotive-os-market. Accessed 22\/12\/2021 (2019)"},{"key":"430_CR8","unstructured":"Sean O\u2019Kane: GM will use Google\u2019s embedded Android Automotive OS in cars starting in 2021. https:\/\/www.theverge.com\/2019\/9\/5\/20851021\/general-motors-android-auto-google-infotainment. Accessed 22\/12\/2021 (2019)"},{"key":"430_CR9","unstructured":"Valasek, C., Miller, C.: Remote Exploitation of an Unaltered Passenger Vehicle. http:\/\/illmatics.com\/Remote%20Car%20Hacking.pdf. Accessed 22\/12\/2021 (2015)"},{"key":"430_CR10","unstructured":"Valasek, C., Miller, C.: Adventures in Automotive Networks and Control Units. https:\/\/ioactive.com\/pdfs\/IOActive_Adventures_in_Automotive_Networks_and_Control_Units.pdf"},{"key":"430_CR11","unstructured":"International Organization for Standardization: ISO\/SAE FDIS 21434 Road vehicles\u2014Cybersecurity engineering (2021). https:\/\/www.iso.org\/standard\/70918.html"},{"key":"430_CR12","unstructured":"AUTOSAR: Specification of Secure Onboard Communication AUTOSAR CP R19-11. https:\/\/www.autosar.org\/fileadmin\/user_upload\/standards\/classic\/19-11\/AUTOSAR_SWS_SecureOnboardCommunication.pdf"},{"key":"430_CR13","doi-asserted-by":"publisher","unstructured":"Koscher, K., Czeskis, A., Roesner, F., Patel, S., Kohno, T., Checkoway, S., McCoy, D., Kantor, B., Anderson, D., Shacham, H., Savage, S.: Experimental security analysis of a modern automobile. In: 2010 IEEE Symposium on Security and Privacy (SP), pp. 447\u2013462. IEEE Computer Society, Los Alamitos, CA, USA (2010). https:\/\/doi.org\/10.1109\/SP.2010.34. https:\/\/doi.ieeecomputersociety.org\/10.1109\/SP.2010.34","DOI":"10.1109\/SP.2010.34"},{"key":"430_CR14","unstructured":"Checkoway, S., McCoy, D., Kantor, B., Anderson, D., Shacham, H., Savage, S., Koscher, K., Czeskis, A., Roesner, F., Kohno, T., et al.: Comprehensive experimental analyses of automotive attack surfaces. In: USENIX Security Symposium, San Francisco (2011)"},{"key":"430_CR15","unstructured":"Paganini, P.: How to hack airbag in Audi TT on other models. https:\/\/securityaffairs.co\/wordpress\/41416\/hacking\/hack-airbag-audi-tt.html. Accessed 22\/12\/2021 (2015)"},{"key":"430_CR16","unstructured":"Zetter, K.: Researchers Hacked a Model S, But Tesla\u2019s Already Released a Patch. https:\/\/www.wired.com\/2015\/08\/researchers-hacked-model-s-teslas-already. Accessed 22\/12\/2021 (2015)"},{"key":"430_CR17","unstructured":"Solomon, O.: Team of hackers take remote control of Tesla Model S from 12 miles away. https:\/\/www.theguardian.com\/technology\/2016\/sep\/20\/tesla-model-s-chinese-hack-remote-control-brakes. Accessed 22\/12\/2021 (2016)"},{"key":"430_CR18","unstructured":"Greenmberg, A.: GM Took 5 Years to Fix a Full-Takeover Hack in Millions of OnStar Cars. https:\/\/www.wired.com\/2015\/09\/gm-took-5-years-fix-full-takeover-hack-millions-onstar-cars. Accessed 22\/12\/2021 (2015)"},{"key":"430_CR19","unstructured":"Paganini, P.: Flaws in BMW ConnectedDrive Infotainment System allow remote hack. https:\/\/securityaffairs.co\/wordpress\/49149\/hacking\/bmw-connecteddrive-hacking.html. Accessed 22\/12\/2021 (2016)"},{"key":"430_CR20","unstructured":"Mitsubishi Outlander hybrid car alarm \u2019hacked\u2019. https:\/\/www.bbc.com\/news\/technology-36444586. Accessed 22\/12\/2021 (2016)"},{"key":"430_CR21","unstructured":"Nissan Leaf Can be Hacked via Mobile App and Web Browser. https:\/\/www.trendmicro.com\/vinfo\/it \/security\/news\/internet-of-things\/nissan-leaf-can-be-hacked-via-mobile-app-and-web-browser. Accessed 22\/12\/2021 (2016)"},{"key":"430_CR22","unstructured":"A Remote Attack on the Bosch Drivelog Connector Dongle. https:\/\/argus-sec.com\/remote-attack-bosch-drivelog-connector-dongle\/. Accessed 22\/12\/2021 (2017)"},{"key":"430_CR23","doi-asserted-by":"publisher","unstructured":"Costantino, G., Marra, A.L., Martinelli, F., Matteucci, I.: CANDY: A social engineering attack to leak information from infotainment system. In: 87th IEEE Vehicular Technology Conference, VTC Spring 2018, Porto, Portugal, June 3-6, 2018, pp. 1\u20135. IEEE (2018). https:\/\/doi.org\/10.1109\/VTCSpring.2018.8417879","DOI":"10.1109\/VTCSpring.2018.8417879"},{"key":"430_CR24","unstructured":"Keenlab Security Lab: New Car Hacking Research: 2017, Remote Attack Tesla Motors Again. https:\/\/keenlab.tencent.com\/en\/2017\/07\/27\/New-Car-Hacking-Research-2017-Remote-Attack-Tesla-Motors-Again. Accessed 22\/12\/2021 (2017)"},{"key":"430_CR25","unstructured":"Tencent Keen Security Lab: New Vehicle Security Research by KeenLab: Experimental Security Assessment of BMW Cars. https:\/\/keenlab.tencent.com\/en\/2018\/05\/22\/New-CarHacking-Research-by-KeenLab-Experimental-Security-Assessment-of-BMW-Cars\/. Accessed 22\/12\/2021 (2018)"},{"key":"430_CR26","unstructured":"Pareja, R.: Fault injection on automotive diagnostic protocols (2018)"},{"key":"430_CR27","unstructured":"Subaruoutback: Hacking the Starlink Infotainment System. https:\/\/www.subaruoutback.org\/threads\/hacking-the-starlink-infotainment-system.494535\/. Accessed 22\/12\/2021"},{"key":"430_CR28","unstructured":"Volkswagen and Audi car infotainment systems hacked remotely. https:\/\/nakedsecurity.sophos.com\/2018\/05\/02\/volkswagen-and-audi-car-infotainment-systems-hacked-remotely\/. Accessed 22\/12\/2021"},{"key":"430_CR29","unstructured":"Hackers Can Steal a Tesla Model S in Seconds by Cloning Its Key Fob. https:\/\/www.wired.com\/story\/hackers-steal-tesla-model-s-seconds-key-fob\/. Accessed 22\/12\/2021 (2018)"},{"key":"430_CR30","unstructured":"Tesla Hacked and Stolen Again Using Key Fob. https:\/\/threatpost.com\/tesla-hacked-stolen-key-fob\/161530\/. Accessed 22\/12\/2021 (2020)"},{"key":"430_CR31","doi-asserted-by":"publisher","unstructured":"Costantino, G., Matteucci, I.: CANDY CREAM - hacking infotainment android systems to command instrument cluster via can data frame. In: Qiu, M. (ed.) 2019 IEEE International Conference on Computational Science and Engineering, CSE 2019, and IEEE International Conference on Embedded and Ubiquitous Computing, EUC 2019, New York, NY, USA, August 1-3, 2019, pp. 476\u2013481. IEEE (2019). https:\/\/doi.org\/10.1109\/CSE\/EUC.2019.00094","DOI":"10.1109\/CSE\/EUC.2019.00094"},{"key":"430_CR32","unstructured":"Tencent Keen Security Lab: Experimental Security Assessment on Lexus Cars. https:\/\/keenlab.tencent.com\/en\/2020\/03\/30\/Tencent-Keen-Security-Lab-Experimental-Security-Assessment-on-Lexus-Cars. Accessed 22\/12\/2021 (2021)"},{"key":"430_CR33","unstructured":"Weinmann, R.P., Schmotzle, B.: TBONE\u2014A zero-click exploit for Tesla MCUs. https:\/\/kunnamon.io\/tbone\/tbone-v1.0-redacted.pdf (2021)"},{"key":"430_CR34","unstructured":"Zavpasha: HACK Navigation\/Multimedia Systems KIA\/HYUNDAI and Install Third-party Applications. https:\/\/forum.xda-developers.com\/t\/hack-navigation-multimedia-systems-kia-hyundai-and-install-third-party-applications.3892333\/"},{"key":"430_CR35","unstructured":"Oviradio: Hyundai and Kia Hidden Android Menu Engineering Mode and Secret Features of Radio and Navigation. https:\/\/www.oviradio.cz\/hyundai-kia-radio-engineering-mode-en\/"},{"key":"430_CR36","unstructured":"RAPID4 Metasploit: Metasploit. https:\/\/www.metasploit.com. Accessed 22\/12\/2021 (2021)"},{"key":"430_CR37","unstructured":"Denys Vlasenko: Busybox. https:\/\/busybox.net (2022)"},{"key":"430_CR38","unstructured":"XDA Developers: The differences between Odex and Deodex Files. https:\/\/forum.xda-developers.com\/t\/guide-the-differences-between-odex-and-deodex-files.2336411\/. Accessed 22\/12\/2021 (2013)"},{"key":"430_CR39","unstructured":"Universal Deodexer: Universal Deodexer V5. https:\/\/forum.xda-developers.com\/showthread.php?t=2213235. Accessed 22\/12\/2021 (2013)"},{"key":"430_CR40","unstructured":"Android IPC: Android Interface Definition Language (AIDL). https:\/\/developer.android.com\/guide\/components\/aidl. Accessed 22\/12\/2021 (2021)"},{"key":"430_CR41","unstructured":"CAN Hacker Website: CAN Hacker. https:\/\/canhacker.com\/projects\/can-hacker-3-0\/. Accessed 22\/12\/2021 (2021)"},{"key":"430_CR42","unstructured":"CARBUS Analyzer: CARBUS Analyzer. https:\/\/canhacker.com\/projects\/carbus-analyzer\/. Accessed 22\/12\/2021 (2022)"},{"key":"430_CR43","unstructured":"Costantino, G., Matteucci, I.: KOFFEE Module. https:\/\/github.com\/rapid7\/metasploit-framework\/blob\/master\/modules\/post\/android\/local\/koffee.rb"},{"key":"430_CR44","unstructured":"Costantino, G., Matteucci, I.: KOFFEE Module Documentation. https:\/\/github.com\/rapid7\/metasploit-framework\/blob\/master\/documentation\/modules\/post\/android\/local\/koffee.md"},{"key":"430_CR45","unstructured":"apktool: Apktool: A Tool for Reverse Engineering Android Apk Files. https:\/\/github.com\/iBotPeaches\/Apktool"},{"key":"430_CR46","unstructured":"Huq, N., Gibson, C., Vosseler, R.: Driving security into connected cars:threat model and recommendations. Technical report, Trend Micro Research (2020). https:\/\/documents.trendmicro.com\/assets\/white_papers\/wp-driving-security-into-connected-cars.pdf"},{"key":"430_CR47","unstructured":"for Europe, U.N.E.C.: Un regulation no. 155 - uniform provisions concerning the approval of vehicles with regards to cyber security and cyber security management system. Technical report (2021). https:\/\/documents.trendmicro.com\/assets\/white_papers\/wp-driving-security-into-connected-cars.pdf"},{"key":"430_CR48","unstructured":"ACEA: European Automobile Manufacturers\u2019 Association. https:\/\/www.acea.auto\/about-acea\/ (2022)"},{"key":"430_CR49","unstructured":"Costantino, G., Matteucci, I.: KOFFEE\u2014Kia OFFensivE Exploit. Technical report, Consiglio Nazionale delle Ricerche, Istituto di Informatica e Telematica (2020)"}],"container-title":["Journal of Computer Virology and Hacking Techniques"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s11416-022-00430-5.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/article\/10.1007\/s11416-022-00430-5\/fulltext.html","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s11416-022-00430-5.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2023,3,26]],"date-time":"2023-03-26T21:31:19Z","timestamp":1679866279000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/s11416-022-00430-5"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2022,5,25]]},"references-count":49,"journal-issue":{"issue":"1","published-online":{"date-parts":[[2023,3]]}},"alternative-id":["430"],"URL":"https:\/\/doi.org\/10.1007\/s11416-022-00430-5","relation":{},"ISSN":["2263-8733"],"issn-type":[{"value":"2263-8733","type":"electronic"}],"subject":[],"published":{"date-parts":[[2022,5,25]]},"assertion":[{"value":"22 December 2021","order":1,"name":"received","label":"Received","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"17 April 2022","order":2,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"25 May 2022","order":3,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}}]}}