Vehicle diagnostics has become essential for detecting in-vehicle errors and ensuring safety. While the Unified Diagnostic Services (UDS) protocol is widely adopted for diagnostic operations, it relies on the ISO 15765-2 standard as the transport protocol over the Controller Area Network (CAN), which was designed without inherent security considerations. In this paper, we identify eight novel attack scenarios that exploit specific transport layer mechanisms in the ISO 15765-2 standard, including Flow Control manipulation, Sequence Number violations, and error handling abuses. We evaluate these attacks on a real passenger vehicle using two distinct diagnostic tools to demonstrate their practical impact. Our results confirm that three of these attack scenarios successfully induce denial of diagnostic services, leading to abnormal diagnostic results such as concealed faults and manipulated sensor readings. These findings highlight critical vulnerabilities that can deceive technicians and drivers, potentially exposing vehicles to significant safety risks.

翻译：车辆诊断已成为检测车载错误并确保安全性的关键。尽管统一诊断服务（UDS）协议被广泛应用于诊断操作，但其依赖的ISO 15765-2标准作为控制器局域网（CAN）的传输协议，在设计之初并未考虑安全机制。本文识别了八种新型攻击场景，这些场景利用了ISO 15765-2标准中的特定传输层机制，包括流量控制操纵、序列号违规及错误处理滥用。我们通过两种不同的诊断工具在真实乘用车上评估了这些攻击，以验证其实际影响。结果表明，其中三种攻击场景能够成功诱导诊断服务拒绝，导致异常诊断结果，例如故障隐藏与传感器读数篡改。这些发现揭示了可欺骗技术人员和驾驶员的关键漏洞，可能使车辆面临重大安全风险。