Incident Response & Forensics

#!/usr/bin/env python3
# Vehicle forensics: collect security artefacts from ECU via OTA/UDS
import socket, struct, json
from datetime import datetime

def collect_forensics(vehicle_ip: str, oem_session_token: str) -> dict:
    # Collect IDS log, DTC history, and SW versions for forensic analysis
    forensics = {"vehicle_ip": vehicle_ip, "collected_at": datetime.utcnow().isoformat()}

    # 1. Connect via DoIP (requires OEM mTLS session token in practice)
    s = socket.create_connection((vehicle_ip, 13400), timeout=10)

    # 2. Read all ECU extended DTCs (UDS 0x19 0x02 0xFF = all stored DTCs)
    dtc_req = struct.pack(">HHIB", 0xFFFE, 0x8001, 3, 0) + bytes([0x03, 0x19, 0x02, 0xFF])
    s.sendall(dtc_req)
    dtc_resp = s.recv(4096)
    forensics["dtc_dump_hex"] = dtc_resp.hex()

    # 3. Read IDS event log via custom DID 0xF1A0
    ids_req = struct.pack(">HHIB", 0xFFFE, 0x8001, 4, 0) + bytes([0x03, 0x22, 0xF1, 0xA0])
    s.sendall(ids_req)
    ids_resp = s.recv(4096)
    forensics["ids_log_hex"] = ids_resp.hex()
    forensics["ids_event_count"] = (len(ids_resp) - 5) // 8  # estimated

    # 4. Read SW fingerprint (VIN + SW version hash for chain-of-custody)
    sw_req = struct.pack(">HHIB", 0xFFFE, 0x8001, 4, 0) + bytes([0x03, 0x22, 0xF1, 0x89])
    s.sendall(sw_req)
    sw_resp = s.recv(256)
    forensics["sw_version_hex"] = sw_resp.hex()

    s.close()
    return forensics

# forensics = collect_forensics("192.168.1.100", "OEM_SESSION_TOKEN_HERE")
# with open(f"forensics_{datetime.now().strftime('%Y%m%d_%H%M')}.json","w") as f:
#     json.dump(forensics, f, indent=2)

#!/usr/bin/env python3
import json
from datetime import date

def generate_incident_report(incident: dict) -> str:
    return f"""
ISO/SAE 21434 INCIDENT REPORT
Report ID:      {incident['id']}
Date:           {incident['date']}
Severity:       {incident['severity']} (CVSS {incident['cvss']})

1. INCIDENT SUMMARY
   {incident['summary']}

2. TIMELINE
{chr(10).join(f"   {t['time']}: {t['event']}" for t in incident['timeline'])}

3. ROOT CAUSE ANALYSIS
   {incident['root_cause']}

4. AFFECTED VEHICLES
   VINs affected: {incident['affected_vins']:,}
   Models:        {', '.join(incident['affected_models'])}

5. CONTAINMENT ACTIONS
{chr(10).join(f"   - {a}" for a in incident['containment'])}

6. CORRECTIVE ACTIONS
{chr(10).join(f"   - {a}" for a in incident['corrective_actions'])}

7. TARA IMPACT
   Threat scenario {incident['tara_ts']} residual risk revised from
   {incident['old_risk']} to {incident['new_risk']}

8. DISCLOSURE
   {incident['disclosure_decision']}
"""

example = {
    "id":"INC-2026-001","date":str(date.today()),
    "severity":"Critical","cvss":8.9,
    "summary":"SecOC symmetric key extracted via power analysis from compromised workshop tool; used to forge engine torque CAN messages on 23 vehicles",
    "timeline":[
        {"time":"00:00","event":"VSOC SIEM alert: SecOC FAILED campaign detected"},
        {"time":"01:00","event":"Remote CAN write disabled via OTA kill-switch"},
        {"time":"24:00","event":"Emergency ESK rotation deployed fleet-wide"},
    ],
    "root_cause":"Workshop tool compromised; SHE KEY_1 extracted via CPA; slot lacked debug-disabled fuse",
    "affected_vins":23,"affected_models":["Model X 2025","Model X 2026"],
    "containment":["OTA disable remote CAN write","Emergency key rotation within 24h"],
    "corrective_actions":["Set SHE KEY_1 to debug-disabled in production fusing SOP",
                          "Workshop tool security requirements added to CIA"],
    "tara_ts":"TS-11","old_risk":"Acceptable (Very Low feasibility)","new_risk":"High (Medium feasibility -- exploit demonstrated)",
    "disclosure_decision":"Coordinated with workshop tool vendor and AUTO-ISAC; 90-day embargo; public advisory Day 90",
}

print(generate_incident_report(example))