Hands-On: Full TARA for Connected ECU

#!/usr/bin/env python3
# Full TCU TARA: 12 assets with damage scenarios

tcu_assets = [
    {"id":"A-01","asset":"LTE Credentials (SIM/key)","S":0,"F":2,"O":2,"P":0},
    {"id":"A-02","asset":"CAN Gateway Routing Table","S":3,"F":2,"O":3,"P":0},
    {"id":"A-03","asset":"OTA Package Verification Key","S":3,"F":3,"O":3,"P":0},
    {"id":"A-04","asset":"UDS Session Manager","S":3,"F":2,"O":2,"P":0},
    {"id":"A-05","asset":"Bluetooth Pairing Database","S":0,"F":1,"O":1,"P":2},
    {"id":"A-06","asset":"Stored PII/Location History","S":0,"F":1,"O":0,"P":3},
    {"id":"A-07","asset":"ECU Firmware Image","S":3,"F":2,"O":3,"P":0},
    {"id":"A-08","asset":"Secure Boot Chain","S":3,"F":3,"O":3,"P":0},
    {"id":"A-09","asset":"CAN Message Integrity","S":3,"F":2,"O":3,"P":0},
    {"id":"A-10","asset":"Remote Access Token","S":2,"F":2,"O":2,"P":1},
    {"id":"A-11","asset":"Diagnostic Session Auth","S":3,"F":2,"O":2,"P":0},
    {"id":"A-12","asset":"Diagnostic Log Files","S":0,"F":1,"O":0,"P":1},
]

print(f"TCU Asset Register: {len(tcu_assets)} assets, {sum(len([x for x in [a['S'],a['F'],a['O'],a['P']] if x > 0]) for a in tcu_assets)} damage scenarios")
for a in tcu_assets:
    overall = max(a["S"], a["F"], a["O"], a["P"])
    cats = [k for k in ["S","F","O","P"] if a[k] > 0]
    print(f"  [{a['id']}] {a['asset']}: max impact {overall} ({'/'.join(cats)})")

#!/usr/bin/env python3
# TS-09: Remote attacker obtains valid UDS extended diagnostic session

# Attack path AP-09A: LTE interface exploit
ap_09a_factors = {
    "Elapsed Time":            3,  # le_6_months — need 0-day LTE modem exploit
    "Specialist Expertise":    4,  # expert — cellular firmware exploitation
    "Knowledge of Target":     3,  # restricted — modem model known from FCC filings
    "Window of Opportunity":   1,  # easy — vehicle always has LTE active
    "Equipment":               0,  # standard — laptop + software radio
}
ap_09a_score = sum(ap_09a_factors.values())
print(f"AP-09A (LTE 0-day exploit): AFR score = {ap_09a_score} → {'High' if ap_09a_score <= 13 else 'Medium'}")

# Attack path AP-09B: social engineering + remote portal
ap_09b_factors = {
    "Elapsed Time":            0,  # le_1_day — phishing works quickly
    "Specialist Expertise":    0,  # layman — no technical skill needed
    "Knowledge of Target":     3,  # restricted — OEM portal URL is public
    "Window of Opportunity":   1,  # easy — portal available 24/7
    "Equipment":               0,  # standard
}
ap_09b_score = sum(ap_09b_factors.values())
print(f"AP-09B (social engineering): AFR score = {ap_09b_score} → {'High' if ap_09b_score <= 13 else 'Medium'}")

# Overall TS-09: OR gate → worst-case (lowest score = highest feasibility)
import sys
overall = min(ap_09a_score, ap_09b_score)
print(f"TS-09 overall feasibility: score = {overall} → High")
print(f"Risk: S2/F2 × High = UNACCEPTABLE — mandatory countermeasures required")

#!/usr/bin/env python3
# TS-09 countermeasure definition and residual risk calculation

countermeasures = {
    "CM-09.1": {
        "description": "Require SecurityAccess seed-key (SID 0x27) with 256-bit random challenge "
                       "before entering extended session; HMAC-SHA256 with secret known only to OEM tooling",
        "impact_on_feasibility": "AP-09B eliminated: portal cannot grant extended session without seed-key "
                                  "exchange requiring secret key"
    },
    "CM-09.2": {
        "description": "Enforce TLS 1.3 mTLS for all remote diagnostic connections; "
                       "OEM-issued client certificate required from registered diagnostic tool",
        "impact_on_feasibility": "AP-09A: attacker must also forge valid mTLS certificate chain — "
                                  "ET > 6 months; SE = multiple experts; EQ = bespoke"
    },
}

print("Countermeasures for TS-09:")
for cm_id, cm in countermeasures.items():
    print(f"  [{cm_id}] {cm['description'][:80]}")
    print(f"    Feasibility impact: {cm['impact_on_feasibility'][:80]}")
    print()

# Residual risk after CM-09.1 + CM-09.2
residual_score = 4 + 6 + 7 + 10 + 7  # ET>6m + multipleExperts + sensitive + difficult + bespoke
print(f"Residual AFR score (after CM-09.1+09.2): {residual_score} → Very Low")
print(f"Residual Risk: S2/F2 × Very Low = ACCEPTABLE")
print(f"Required sign-off: Cybersecurity Manager + Functional Safety Manager")
print(f"Review trigger: New CVE for OEM mTLS library; or new remote diag portal vulnerability")