Vehicles can hide harmful features without breaking protocols or showing misbehavior
Janus Vehicles: Entity-Centric Threat Modelling of Protocol-Conformant Vehicles under a Malicious-Manufacturer Assumption
Cryptography and Security
Summary
Most security checks assume car makers are honest and that malicious attacks involve obvious misbehavior. This paper points out that some vehicles can be designed to follow all rules but still secretly spy, communicate, or act in harmful ways. The authors classify different ways these hidden threats can exist, including genuine components used in bad ways or fake but authentic-looking parts. They also create models to understand how such hidden behaviors can be activated and concealed to avoid detection.
What this means in practice
- •For automotive security teams: Identify potential hidden threats from vehicles or components that seem authentic but perform concealed malicious actions.
- •For network security analysts: Develop monitoring strategies considering that protocol-compliant devices may still behave maliciously without obvious misbehavior signs.
A position paper. It proposes an approach and reports no results.
Authors
Jaeung Franciskus Yoo, Huy Kang Kim
Abstract
Automotive cybersecurity commonly assumes benign end-product manufacturers and design authorities, focusing on supply-chain threats, external attacks, and compromised network participants observable through misbehaviour. This assumption overlooks malicious-by-design vehicles that remain authentic and protocol-conformant while performing undeclared sensing, communication, or context-triggered actuation. We formulate an Entity-Centric Threat Model spanning three subcomponents. The first, Malign Entity Archetypes, describes four types of malign entity: peer-benign, purpose-malicious vehicles; compromised vehicles; reappropriated genuine components; and imitated vehicles or components. The model exposes two assurance gaps: authenticity does not establish declared-purpose conformance, while malicious functionality can evade detection based on behavioural history or peer-visible evidence. Reappropriated components can remain genuine and retain usable identities or capabilities outside authorised contexts, reducing the effectiveness of signal fingerprinting and certificate-based authentication. To structure this threat space, we introduce a Behaviour-Locus Matrix that maps covert, overt, and concealment actions across hardware, software, and network loci. For peer-benign, purpose-malicious vehicles, we further present a Behavioural Interaction Model that represents how hidden capabilities are contextually activated, realised through actions, manifested within the vehicle and its environment, and potentially observed or concealed.