Security analysis on the MASA intelligent cameras

Intelligent Transportation Systems (ITS) have revolutionized the transportation networks used by millions of road users every day. While Advanced Driver-Assistance Systems (ADAS) have contributed to enhancing the travel experience and safety, more innovations are emerging. Recently, Cooperative ITS technologies have begun to be deployed on everyday vehicles. These technologies use Vehicle-to-Everything (V2X) communications to share safety-critical information - such as vehicle direction, speed, and position - to further enhance road safety. Specifically, this work analyzes one of the devices used in the Modena Automotive Smart Area (MASA), a living lab located in Modena where novel Cooperative ITS (C-ITS) technologies are tested. The subject of this research is the MASA camera, an intelligent device deployed along roads to detect, classify, and share the position and direction of various road users with nearby V2X-equipped vehicles. This enables these vehicles to build a more accurate world model that includes elements such as bicycles and pedestrians, which typically lack C-ITS devices. The required computation is performed on-device, and only anonymized data are transmitted externally to ensure the privacy of road users. While applications such as the road side cameras are highly beneficial, they enable unprecedented interactions with the environment that can be exploited by malicious actors to carry out attacks against ITS and even impact the physical safety of users. For this reason, this work presents a Vulnerability Assessment and Penetration Testing (VAPT) activity conducted on the MASA smart cameras, which identified several vulnerabilities in the current software implementation. These vulnerabilities were later used to develop a mitigation guideline. The testing targeted two potential attack vectors: the smart camera network and the device's maintenance serial port. This effort revealed open vulnerabilities that were subsequently addressed in the mitigation guide. The suggested mitigations included patches to the software stack, network and system configuration changes, and the use of security software capable of fully or partially addressing each vulnerability. In particular, this work highlighted the need for a novel client-side MQTT Web Application Firewall (WAF) a new approach to securing MQTT application logic with a plug-and-play security layer that requires minimal software modifications. While many WAF solutions are available for the widely used HTTP protocol, no such component currently exists for MQTT clients. The proposed solution is implemented as a plugin for the Mosquitto MQTT broker. This plugin can be installed on edge devices without requiring excessive computational, storage, and memory resources, making it particularly suitable for the MASA use case scenario. It can be configured with custom firewall rules to enhance the device's security posture. Given the performance requirements of the MASA cameras, the firewall has been extensively tested against various loads to measure the introduced latency and jitter. The benchmarks show no significant delays when the firewall is deployed in the intended scenario.