Scholarlink

The Android Automotive Operating System (AAOS) is a specialized version of the Android OS designed for in-vehicle infotainment and system control. Prominent automakers such as Honda, General Motors (GM), Volvo, and Ford have already adopted it in their latest vehicles. Despite its popularity, the security of AAOS integration has hardly been evaluated, particularly at the framework layer, where auto feature and access control anomalies are likely to arise. To bridge the gap, we perform the first security evaluation of automotive entry points in AAOS. Our study is enabled by AutoAcRaptor, an automated pipeline that leverages static analysis to identify automotive entry points, generate their access control and auto feature specifications, and analyze them for potential security risks. Our evaluation of AutoAcRaptor on two AOSP and eight automaker AAOS images demonstrates that it is able to identify 23 auto feature and access control anomalies, on average per ROM. We report ten cases to the corresponding automakers. At the time of writing, five have been acknowledged while the rest are pending verification.

错误：搜索内容不能为空，请输入英文关键词
错误：关键词超出字数限制，请精简
高级检索

Red Light for Security: Uncovering Auto Feature Check and Access Control Gaps in AAOS

  • 会议论文

  • 发表日期：

    2025年

查看全文
  • Jumana,
  • Parjanya Vyas,
  • Yousra Aafer

摘要

The Android Automotive Operating System (AAOS) is a specialized version of the Android OS designed for in-vehicle infotainment and system control. Prominent automakers such as Honda, General Motors (GM), Volvo, and Ford have already adopted it in their latest vehicles. Despite its popularity, the security of AAOS integration has hardly been evaluated, particularly at the framework layer, where auto feature and access control anomalies are likely to arise. To bridge the gap, we perform the first security evaluation of automotive entry points in AAOS. Our study is enabled by AutoAcRaptor, an automated pipeline that leverages static analysis to identify automotive entry points, generate their access control and auto feature specifications, and analyze them for potential security risks. Our evaluation of AutoAcRaptor on two AOSP and eight automaker AAOS images demonstrates that it is able to identify 23 auto feature and access control anomalies, on average per ROM. We report ten cases to the corresponding automakers. At the time of writing, five have been acknowledged while the rest are pending verification.