Topic 2 Lecture Quiz

A car's Tire Pressure Monitoring System (TPMS) transmits tire identifiers wirelessly, raising privacy concerns about tracking. How can you BEST enhance the privacy of drivers?

• Implement k-anonymity to mask individual tire identities.

• Encrypt tire identities and change them frequently

• Physically isolate the TPMS from the car's network.

• Require the driver to authenticate before reading tire pressure data via biometrics.

A TPMS system has vulnerabilities where the car and receiver cannot authenticate data/message as 'real.' What is the specific security issue being stated here and what is the most effective approach from these listed to countermeasure the following problems: lack of tire identification checks, unverified sensor message authenticity, wrong sensor readings from unknown sources being processed, unauthorized disablement?

• Implement a challenge-response protocol for tire identification and use Message Authentication Codes (MACs) for sensor messages

• Encrypt sensor data during transmission and isolate the in-car network

• Set proper access rights for the ECU and isolate data/programs using sandboxes

• Require driver password for system deactivation and log the event. Check messages for freshness and integrity before acceptance by the ECU, and encrypt the tire Ids and or change their id after car restart

A malicious actor modifies the sensor data in a Tire Pressure Monitoring System (TPMS), and there's no mechanism to track who made the changes. What security violations best describe this situation?

• Confidentiality violation and Availability violation.

• Integrity violation and Accountability violation.

• Authenticity violation and Confidentiality violation.

• Privacy violation and Availability violation.

A critical vulnerability in a Tire Pressure Monitoring System (TPMS) is the potential for unauthorized access to sensor data during wireless transmission. Which security service is MOST crucial to address this specific vulnerability?

• Authenticity

• Availability

• Confidentiality

• Accountability

A city council is debating TPMS technology's implications for citizen privacy, recognizing that continuous tire identification could allow for vehicle tracking and profiling. Which approach best protects individual privacy without unduly restricting normal system function?

• Implement robust access controls on the ECU to prevent unauthorized data modification and ensure only the car mechanic can access sensor data.

• Encrypt sensor data in transit and implement digital signatures to ensure data and message integrity.

• Employ data anonymization techniques to mask tire identities and change these masked identifiers frequently. Supplement this with strong encryption of data at rest and in transit.

• Isolate the TPMS system entirely from other car networks and encrypt all TPMS-related data while storing a copy of the encryption key with the manufacturer for recovery if needed.

In a Tire Pressure Monitoring System (TPMS), how can you ensure that the pressure readings displayed on the dashboard originate from the legitimate tire sensors and haven't been tampered with during transmission, especially considering potential vulnerabilities over the air or within the car network itself?

• Implement encryption for all sensor data transmissions, including over-the-air and within the car network.

• Utilize a digital signature scheme for all sensor messages to verify their authenticity and origin.

• Isolate the in-car network completely from any external access points to prevent unauthorized entry.

• Restrict access to sensor data by implementing strict access control policies within the car's system, limiting data access to authorized personnel only, such as mechanics during maintenance procedures or the drivers themselves. The policies would specifically outline these allowed usage contexts while excluding external access without valid justification

In a Tire Pressure Monitoring System (TPMS), how can you best mitigate the privacy risk of tire tracking based on unique and persistent tire identifiers?

• Encrypt all sensor data transmitted from the tires to the car's ECU.

• Change tire identifiers with every car restart and store the current identifier securely in the car's ECU.

• Implement k-anonymity methods to aggregate tire pressure data.

• Log all access attempts to the TPMS, including the timestamp and source IP address, to ensure accountability in case of unauthorized access and make the logs readily accessible to car owners via car interface or a specific platform so that all access logs are clear, as if to promote "security by obscurity" for the owners.

A Tire Pressure Monitoring System (TPMS) is vulnerable to unauthorized deactivation. Applying the principle of accountability, which countermeasure best ensures that responsibility for TPMS deactivation cannot be denied?

• Implement k-anonymity methods to mask individual tire identities.

• Store tire pressure readings in an encrypted database within the vehicle's ECU.

• Require driver authentication before deactivating the TPMS, and log all deactivation events with timestamps.

• Encrypt tire identities, changing the encryption key with each car restart, then discard the original tire ID