Penetration Testing of In-Vehicle Infotainment Systems in Connected Vehicles

The In-Vehicle Infotainment (IVI) system of a modern connected vehicle is a critical attack point and must be thoroughly tested. In this paper, we introduce a comprehensive methodology for penetration testing specifically tailored to IVI systems in connected vehicles and demonstrate its applicability with the case study of testing the IVI Wi-Fi interface of a Volkswagen (VW) ID.3. We define a generic IVI model as the basis for specifying the test scope. The type, depth, and complexity of the tests to be performed can be determined using our proposed attacker model. This ensures that all relevant aspects are tested. Our methodology consists of seven phases and contains detailed descriptions of the tasks to be carried out in each phase. Following our methodology in the case study, we identified vulnerabilities in the VW IVI system that could allow attackers with Wi-Fi access to crash the system, access data, or manipulate volume settings,