Defense Evasion

An attacker can exploit vulnerabilities in Securityaccess to gain unauthorized access to sensitive data, execute diagnostic commands, and make changes to ECU.

Attackers can execute codes or malware, install tampered firmware by bypassing codes signing security mechanism.  This is done by exploiting vulnerabilities such as "lack of verification", "obsolete certificates" or "insecure key management".

An attacker can install an outdated firmware that has a valid signature, but has vulnerabilities.

Attackers can get to disable the immobilizer in a car by sending fake CAN messages.

Attackers force a vehicle's communication system to revert to a less secure protocol, making it easier to exploit vulnerabilities.

This technique involves unauthorized activation of remote functionalities, such as remote start or unlocking. In the automotive domain, it could lead to theft or unauthorized access, while in rail, it might enable unsanctioned control or monitoring of train systems.