[论文解读] Towards Understanding and Characterizing Vulnerabilities in Intelligent Connected Vehicles through Real-World Exploits

Yuelin Wang, Yuqiao Ning+8 more|arXiv (Cornell University)|Jan 2, 2026

Vehicular Ad Hoc Networks (VANETs)被引用 0

一句话总结

这篇论文开展了第一项大规模的 ICV 漏洞实证研究，收集了来自真实世界利用和竞赛的 649 个可利用漏洞，并扩展现有分类法以更好地反映真实威胁格局。

ABSTRACT

Intelligent Connected Vehicles (ICVs) are a core component of modern transportation systems, and their security is crucial as it directly relates to user safety. Despite prior research, most existing studies focus only on specific sub-components of ICVs due to their inherent complexity. As a result, there is a lack of systematic understanding of ICV vulnerabilities. Moreover, much of the current literature relies on human subjective analysis, such as surveys and interviews, which tends to be high-level and unvalidated, leaving a significant gap between theoretical findings and real-world attacks. To address this issue, we conducted the first large-scale empirical study on ICV vulnerabilities. We began by analyzing existing ICV security literature and summarizing the prevailing taxonomies in terms of vulnerability locations and types. To evaluate their real-world relevance, we collected a total of 649 exploitable vulnerabilities, including 592 from eight ICV vulnerability discovery competitions, Anonymous Cup, between January 2023 and April 2024, covering 48 different vehicles. The remaining 57 vulnerabilities were submitted daily by researchers. Based on this dataset, we assessed the coverage of existing taxonomies and identified several gaps, discovering one new vulnerability location and 13 new vulnerability types. We further categorized these vulnerabilities into 6 threat types (e.g., privacy data breach) and 4 risk levels (ranging from low to critical) and analyzed participants' skills and the types of ICVs involved in the competitions. This study provides a comprehensive and data-driven analysis of ICV vulnerabilities, offering actionable insights for researchers, industry practitioners, and policymakers. To support future research, we have made our vulnerability dataset publicly available.

研究动机与目标

• 将现有 ICV 漏洞分类法综合为一个统一的双维框架（位置与类型）。
• 通过对来自竞赛与报告的 16 个月 Real-world exploits 的实证验证，评估分类法的覆盖范围。
• 识别先前分类法未覆盖的漏洞新类别与空白。
• 分析跨模块与车辆类型的漏洞分布，以为有针对性的防御提供依据。
• 为研究人员、行业从业者与政策制定者提供数据驱动的建议。

提出的方法

• 在 16 个月内通过研究者提交和 eight Anonymous Cup 比赛收集 890 份漏洞报告，随后在真实车辆上进行验证，得到 649 个可利用漏洞。
• 通过人工综合 13 篇具有代表性的 ICV 安全论文，构建统一的基于位置和基于类型的分类法。
• 将 649 个漏洞映射到统一的分类法以评估覆盖率并识别空白。
• 将漏洞归类为威胁类型和风险等级（从关键到低）以开展整改优先级排序。
• 分析跨模块（云平台、IVI 等）和车辆类型（SUV、轿车、MPV）的分布模式，以推导可操作的洞见。

实验结果

研究问题

• RQ1 在面对真实世界利用时，现有 ICV 漏洞分类法的经验覆盖度是多少？
• RQ2 在大规模真实数据中，除了先前分类法之外，出现了哪些新的漏洞位置和类型？
• RQ3 漏洞在 ICV 模块与车辆类型之间的分布如何，这对防御优先级有何启示？
• RQ4 从经验漏洞数据集中，针对制造商、研究者及监管者有哪些实际建议？

主要发现

• 通过通过在线提交和 eight 脆弱性发现竞赛收集的 890 份报告，确认了 649 个独特且可利用的漏洞。
• 外部车辆漏洞占比 49.5%，云平台对外部车辆案例贡献 76.3%，APP 占 20.6%。
• 车内漏洞总计 297（45.8%），其中 IVI 驱动了 70.0% 的车内案例，T-Box 占 9.4%。
• 漏洞在 ICV 堆栈中高度集中于云平台（37.8%）与 IVI（32.0%）。
• 授权漏洞（36.4%）和信息泄露（17.3%）是总体最常见的漏洞类型，所有与网页相关的问题均出现在云平台。
• SUV 相较轿车和 MPV 显示出显著更多的漏洞，其中 IVI 在所有车辆类型上都是一个特别密集的攻击面。