ASSESSMENT OF CYBER RISKS IN VEHICLES BASED ON ATTACK SURFACE ANALYSIS

Abstract

The article examines the problem of analyzing cyber threats in modern vehicles, which are increasingly becoming complex cyber-physical systems with a large number of electronic control units, internal networks, wireless interfaces, sensors, diagnostic ports, infotainment modules, and external digital services. It is substantiated that vehicle security cannot be limited solely to the study of the CAN bus, since the actual attack surface includes a much broader set of interaction channels with the environment and the user. Particular attention is paid to the threat modeling approach, which enables the systematic identification of entry points, the determination of input signal receivers, the analysis of trust boundaries between components, and the identification of potential attack propagation paths within the automotive architecture. The paper systematizes the main groups of threats, including threats related to remote communication interfaces, Wi-Fi, Bluetooth, cellular communication, keyless entry systems, TPMS, USB ports, OBD-II, infotainment systems, diagnostic mechanisms, and internal vehicle networks. It is shown that the most critical scenarios are those in which an external channel can be used to access the internal systems of a vehicle or to influence electronic control units. The risks of violating confidentiality, integrity, and availability are considered separately, including location tracking, data spoofing, malware installation, blocking vehicle functions, and manipulating messages within the internal network. It is proposed to consider the threat model as a dynamic document that should be updated throughout the entire vehicle life cycle, taking into account changes in software, architecture, and external services. The practical significance of the study lies in the formation of a structured approach to identifying, classifying, and prioritizing risks, which can be used during the auditing, testing, and design of secure automotive systems.