CN112887945B - Penetration testing method for Internet of vehicles network - Google Patents

Abstract

The invention discloses a penetration testing method of the Internet of Vehicles network, including a security SDK, an APP terminal and a vehicle terminal. The penetration testing method of the Internet of Vehicles network includes the following steps: Step 1. Identity authentication: the user binds and uses it for the first time After logging in, operate the mobile terminal device and the unique identification code of the vehicle to match the vehicle, the security SDK completes the generation of the unique identification code, and the vehicle operation is completed to confirm the relationship between the person and the vehicle; the mobile terminal device and the vehicle security environment exchange the unique user identification code. The present invention conducts detailed and comprehensive tests on the security SDK, APP and vehicle terminals, detects possible faults in the Internet of Vehicles, and modifies the test results to ensure the stability and reliability of the Internet of Vehicles network. The advanced penetration testing method has the advantages of comprehensive testing, and can perform detailed detection of possible faults in the Internet of Vehicles network during actual use.

Description

A penetration testing method for Internet of Vehicles network

technical field

The invention relates to the technical field of the Internet of Vehicles, in particular to a penetration testing method of the Internet of Vehicles network.

Background technique

The connotation of the Internet of Vehicles mainly refers to: the on-board equipment on the vehicle effectively utilizes all vehicle dynamic information in the information network platform through wireless communication technology, and provides different functional services during the operation of the vehicle. It can be found that the Internet of Vehicles exhibits the following aspects: Point features: Internet of vehicles can provide guarantee for the distance between vehicles and reduce the probability of vehicle collision accidents; Internet of vehicles can help car owners navigate in real time, and improve the efficiency of traffic operation through communication with other vehicles and network systems.

Whether the Internet of Vehicles network is safe and reliable is related to the driving safety and comfort of the car owner. Once the Internet of Vehicles network fails, it is very easy to cause the owner's navigation to fail and cannot operate normally, and the various sensors and communication centers cannot cooperate with each other, resulting in the failure of the vehicle and the vehicle. Road condition information cannot be transmitted in time, for example, the distance between vehicles cannot be transmitted, the probability of vehicle collision will be greatly increased, the driving safety of vehicle owners will be greatly affected, and the efficiency of traffic operation will be reduced. To solve the above problems, a A penetration testing method for the Internet of Vehicles network needs to be developed urgently.

Contents of the invention

The purpose of the present invention is to provide a penetration testing method for the Internet of Vehicles network, which has the advantages of comprehensive testing, and solves the problem that whether the Internet of Vehicles network is safe and reliable is related to the driving safety and comfort of the car owner. Once the Internet of Vehicles fails, it is very easy to cause The car owner's navigation fails to operate normally, and the various sensors and communication centers cannot cooperate with each other, resulting in the inability to transmit vehicle and road condition information in a timely manner. For example, the distance between vehicles cannot be transmitted, and the probability of vehicle collision will be greatly increased. As a result, the driving safety of car owners has been greatly affected and the efficiency of traffic operation has been reduced.

In order to achieve the above object, the present invention provides the following technical solutions: a penetration testing method of the Internet of Vehicles network, including a security SDK, an APP end and a vehicle end, and the penetration testing method of the Internet of Vehicles network includes the following steps:

Step 1. Identity authentication: After the user logs in through binding for the first time, operate the mobile terminal device and the unique identification code of the vehicle to match with the vehicle. The security SDK completes the generation of the unique user identification code, and the vehicle operation is completed to confirm the relationship between the person and the vehicle; the mobile terminal device Exchanging unique user identification codes with the vehicle security environment;

Step 2. Car terminal communication security test: When the car terminal and mobile terminal are connected by Bluetooth, it is detected. The detection method includes the following steps:

1. BLE Bluetooth service traversal, traversal of all SSID information;

2. BLE Bluetooth forced connection attack, violent attempt to establish an illegal forced connection with the car end, and test the ability to reject illegal connections;

3. BLECVE detection, detection of BLE known CVE vulnerabilities;

4. BLE message fuzz test, try to construct legal message fuzz test;

5. BLE replay detection, capture the BLE car control data packet, and check the message security through the replay test;

Step 3, APP code analysis and testing: Code analysis of the APP on the user's mobile terminal includes the following steps:

1. Code obfuscation, using obfuscation tools to confuse JAVA code and NATIVE code;

2. APP code protection breakthrough, try to unpack the reinforced protected APP and obtain the source code;

3. Analysis of the APP Bluetooth encryption algorithm, and analyze the data communication encryption algorithm on the APP side;

4. Search for logic defects in APP code, search for logic defects related to Bluetooth certification and test communication process;

5. Reappearance of the APP Bluetooth connection algorithm, analyze the Bluetooth encryption process, try to rewrite the connection algorithm, and realize or partially realize car control;

Step 4: SO logic test, BLE service car side SO file authentication process analysis, reverse SO code, find the authentication process.

Preferably, the penetration testing method of the Internet of Vehicles network also includes a testing method for the vehicle end system:

1. System ROOT test: Use USB test interface ROOT to attack ROOT or use APP ROOT to perform ROOT;

Two, system firmware safety test: the test method of described system firmware safety test is as follows:

1. Firmware flashing test;

2. Firmware reverse analysis;

3. Firmware rollback flashing test;

3. Upgrade package cracking test: try to crack the local USB upgrade package;

4. System vulnerability testing: try unsafe service testing, redundant service testing, and security vulnerability testing with known system versions;

5. System upgrade security test: verify the legality and integrity of the system upgrade package, and conduct fault tolerance tests;

6. Test application software security: Detect whether the application software uses obfuscation, encryption means to prevent decompilation, and detect whether the application software has redundant permissions.

Preferably, in the second step of the vehicle-end communication security test, all end-to-end communication adopts HTTPS communication mode.

Preferably, in the second step, in the vehicle-side communication security test, Certificate Pinning or a two-way authentication mechanism is used to prevent MRRY attacks.

Preferably, the vehicle terminal includes two encryption methods, white box encryption and hardware encryption, when storing information.

Compared with the prior art, the beneficial effects of the present invention are as follows:

The present invention conducts detailed and comprehensive tests on the security SDK, APP and vehicle terminals, detects possible faults in the Internet of Vehicles, and modifies the test results to ensure the stability and reliability of the Internet of Vehicles network. The penetration testing method has the advantages of comprehensive testing. In the actual use process, it can carry out detailed detection of possible faults in the Internet of Vehicles network. Failure of the network network can easily cause the owner's navigation to fail to operate normally, and the various sensors and communication centers cannot cooperate with each other, resulting in the inability to transmit vehicle and road condition information in time, such as the distance between vehicles. The probability of vehicle collision will be greatly improved, the driving safety of car owners will be greatly affected, and the efficiency of traffic operation will be reduced.

detailed description

The technical solutions in the embodiments of the present invention will be clearly and completely described below. Obviously, the described embodiments are only some of the embodiments of the present invention, but not all of them. Based on the embodiments of the present invention, all other embodiments obtained by persons of ordinary skill in the art without making creative efforts belong to the protection scope of the present invention.

The present invention provides a technical solution: a penetration testing method for the Internet of Vehicles network, including a security SDK, an APP terminal, and a vehicle terminal, characterized in that: the penetration testing method for the Internet of Vehicles network includes the following steps:

Step 1. Identity authentication: After the user logs in through binding for the first time, operate the mobile terminal device and the unique identification code of the vehicle to match with the vehicle. The security SDK completes the generation of the unique user identification code, and the vehicle operation is completed to confirm the relationship between the person and the vehicle; the mobile terminal device Exchanging unique user identification codes with the vehicle security environment;

Step 2. Car terminal communication security test: When the car terminal and mobile terminal are connected by Bluetooth, it is detected. The detection method includes the following steps:

1. BLE Bluetooth service traversal, traversal of all SSID information;

2. BLE Bluetooth forced connection attack, violent attempt to establish an illegal forced connection with the car end, and test the ability to reject illegal connections;

3. BLECVE detection, detection of BLE known CVE vulnerabilities;

4. BLE message fuzz test, try to construct legal message fuzz test;

5. BLE replay detection, capture the BLE car control data packet, and check the message security through the replay test;

Step 3, APP code analysis and testing: Code analysis of the APP on the user's mobile terminal includes the following steps:

1. Code obfuscation, using obfuscation tools to confuse JAVA code and NATIVE code;

2. APP code protection breakthrough, try to unpack the reinforced protected APP and obtain the source code;

3. Analysis of the APP Bluetooth encryption algorithm, and analyze the data communication encryption algorithm on the APP side;

4. Search for logic defects in APP code, search for logic defects related to Bluetooth certification and test communication process;

5. Reappearance of the APP Bluetooth connection algorithm, analyze the Bluetooth encryption process, try to rewrite the connection algorithm, and realize or partially realize car control;

Step 4: SO logic test, BLE service car side SO file authentication process analysis, reverse SO code, find the authentication process.

In the present invention: the penetration test method of the Internet of Vehicles network also includes a test method for the vehicle end system:

1. System ROOT test: Use USB test interface ROOT to attack ROOT or use APP ROOT to perform ROOT;

Two, system firmware safety test: the test method of described system firmware safety test is as follows:

1. Firmware flashing test;

2. Firmware reverse analysis;

3. Firmware rollback flashing test;

3. Upgrade package cracking test: try to crack the local USB upgrade package;

4. System vulnerability testing: try unsafe service testing, redundant service testing, and security vulnerability testing with known system versions;

5. System upgrade security test: verify the legality and integrity of the system upgrade package, and conduct fault tolerance tests;

6. Test application software security: Detect whether the application software uses obfuscation, encryption means to prevent decompilation, and detect whether the application software has redundant permissions.

In the present invention: in step 2, in the vehicle-end communication security test, all end-to-end communications adopt the HTTPS communication method to ensure that all communications with the background and with the vehicle-end are encrypted and transmitted.

In the present invention: in step 2, in the vehicle terminal communication security test, the mechanism of Certificate Pinning or two-way authentication is used to place MRRY attacks, so as to ensure encryption and prevent man-in-the-middle attacks.

In the present invention: when the vehicle end stores information, it includes two encryption methods: white box encryption and hardware encryption, and hardware encryption refers to an encryption method at the software plus hardware level.

It should be noted that in this article, relational terms such as first and second are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply that there is a relationship between these entities or operations. any such actual relationship or order exists between them. Furthermore, the term "comprises", "comprises" or any other variation thereof is intended to cover a non-exclusive inclusion such that a process, method, article, or apparatus comprising a set of elements includes not only those elements, but also includes elements not expressly listed. other elements of or also include elements inherent in such a process, method, article, or device.

Although the embodiments of the present invention have been shown and described, those skilled in the art can understand that various changes, modifications and substitutions can be made to these embodiments without departing from the principle and spirit of the present invention. and modifications, the scope of the invention is defined by the appended claims and their equivalents.

Claims (5)

1. The utility model provides a penetration test method of car networking, includes safe SDK, APP end and car end, its characterized in that: the penetration testing method of the Internet of vehicles network comprises the following steps:

step one, identity authentication: after the user logs in through the first binding use, operating the mobile terminal equipment to match with the unique vehicle-side identification code for vehicle pairing, generating the unique user identification code by the safety SDK, and confirming the man-vehicle relationship after the vehicle operation is completed; the mobile terminal equipment exchanges the unique user identification code with the vehicle-terminal safety environment;

step two, vehicle end communication safety test: detect it when car end and removal end carry out the bluetooth and connect, the detection mode includes following step:

1. the BLE Bluetooth service is traversed, and all SSID information is traversed;

2. the BLE Bluetooth compulsory connection attack is carried out, illegal compulsory connection is violently tried to be established with a vehicle end, and the illegal connection rejection capability is tested;

3. detecting BLECVE, and detecting the BLE known CVE loophole;

4. performing BLE message fuzz test, and trying to construct a legal message fuzz test;

5. the BLE replay detection is performed, a BLE vehicle control data packet is captured, and the message safety is checked through the replay test;

step three, APP code analysis and test: the method for analyzing the code of the APP of the user mobile terminal comprises the following steps:

1. code obfuscating, obfuscating the JAVA code and the NATIVE code using an obfuscation tool;

2. the APP code protection breakthrough attempts to perform shelling processing on the reinforced and protected APP to obtain a source code;

3. analyzing an APP Bluetooth encryption algorithm, and analyzing an APP end data communication encryption algorithm;

4. finding out APP code logic defects, finding out logic defects related to Bluetooth authentication and a test communication process;

5. the APP Bluetooth connection algorithm is reproduced, a Bluetooth encryption flow is analyzed, the connection algorithm is tried to be rewritten, and vehicle control is achieved or partially achieved;

and step four, SO logic test, analysis of the SO file authentication process of the BLE service vehicle end, reversing the SO code and searching the authentication process.

2. The penetration testing method of the internet of vehicles network according to claim 1, characterized in that: the method also comprises a test method of the vehicle end system:

1. and (3) testing the ROOT of the system: using a USB test interface ROOT to attack ROOT or using an APP ROOT mode to carry out ROOT;

2. and (3) system firmware security testing: the test method for the system firmware security test comprises the following steps:

1. firmware is tested by flashing;

2. reverse analysis of firmware;

3. firmware rollback flash test;

3. and (3) upgrading package cracking test: trying to crack a local USB upgrade package;

4. and (3) testing system vulnerabilities: the method comprises the following steps of trying unsafe service tests, trying redundant service tests, and trying security vulnerability tests with known system versions;

5. and (3) system upgrading safety test: verifying the validity and integrity of the system upgrade package, and performing fault tolerance test;

6. and (3) testing the safety of the application software: whether the application software adopts confusion or not is detected, the encryption means prevents the application software from being decompiled, and whether the application software has redundant authority or not is detected.

3. The penetration testing method of the internet of vehicles network according to claim 1, characterized in that: in the second vehicle-end communication safety test, all end-to-end communication adopts an HTTPS communication mode.

4. The penetration testing method of the internet of vehicles network according to claim 1, characterized in that: in the second vehicle end communication safety test, a Certificate screening or bidirectional authentication mechanism is adopted to place MRRY attacks.

5. The penetration testing method of the internet of vehicles network according to claim 1, characterized in that: the vehicle end comprises two encryption modes of white box encryption and hardware encryption when information storage is carried out.