Cyber Security for the Automotive

We report on experiences of IEC 62443 and Common Criteria security certification and penetration testing. This includes, based on examples, typical vulnerabilities that we were able to exploit. For instance, in a blackbox testing of a communication dongle we were able to extract data such as a vehicle identification numbers from unencrypted bluetooth, access lightning control via OBD-II and upload of malicious files to the customer servers.