Measuring Incomplete Hardening Across Production-Class Automotive Firmware Stacks

Abstract

Vehicle firmware often contains security components whose effective deployment cannot be inferred from their presence alone. This paper examines four anonymized production-class firmware corpora: an Adaptive AUTOSAR-class ADAS platform, a domain-controller–IVI pair, a distributed multi-ECU ADAS network, and a split Android/cluster architecture. We operationalize Automotive Firmware Hardening Completeness (AFHC) as an evidence model for comparing five control areas: authentication, credential protection, policy enforcement, network exposure, and release-build control. The analysis correlates configurations, headers, ELF binaries, certificates, startup paths, and service bindings. It identifies deterministic diagnostic material, extractable private keys, a configured reverse diagnostic path, broad interface bindings without authentication markers in the inspected files, permissive mandatory access control, empty root password-hash fields, and engineering artifacts in release images. These observations establish static evidence of incomplete hardening, not runtime exploitability. The main result is a traceable cross-stack account of where deployed security mechanisms and firmware evidence disagree, together with release checks aligned with ISO/SAE 21434 and UNECE R155/R156.