During a TSC last year (minutes) Apex and TierIV proposed doing a threat modelling of the Autoware project. This work was going to involve NDIAS and Alias Robotics. Does anybody know if this initiative resulted in any outcome?
I am very interested in learning if there is any security-related analysis or secure development lifecycle implementation carried out in any of the member companies around Autoware. Is anybody out there interested in security aspects of Autoware?
Any leads would be greatly appreciated. Thank you very much in advance.
Hi @LiyouZhou, speaking from Alias Robotics’ side, we indeed proposed quite a while ago a number of actions concerning how to improve Autoware’s DevOps (refer to some preliminar work we published https://arxiv.org/pdf/2003.10402.pdf for an intuition in the process). This included ideas on kicking off cooperations on threat modeling, pen testing and related however to this date , except for you, I’m not aware of anyone else showing interest on kickstarting and/or supporting an effort on this (and frankly, neither who NDIAS is 
but please educate me on this).
Nevertheless, I’m not actively joining the meetings so I might be missing something. Pinging @EndikaGu who’s more tuned to this in case he has some additional information. Also, pinging @Dejan_Pangercic since from the notes, it seems it was Apex.AI the driver of this discussion.
From Alias, we’ve dedicated some resources on familiarizing ourselves with the architecture of Autoware and are in good shape to start working on this unfortunately, as I guess many in the community these days, we have limited bandwidth so we’ll probably need some support. Very open to cooperations! If there’s enough interest, happy to organize a meeting and discuss this.
Cheers,
1 Like
We are certainly happy to have contributions on this front and will support you in any way we can but the majority of developers are currently working toward implementing our first Operational Design Domain, automated valet parking.
@LiyouZhou @vmayoral @JWhitleyWork at Apex.AI we indeed brought up the threat model topic in Autoware TSC meeting minutes for May 15, 2019.
Since then, in August 2019, Apex.AI worked with Alias Robotics and we got the threat model analysis done on our internal code base which is based on ROS 2 (=Apex.OS) and parts of Autoware.Auto.
Alias Robotics found a few threats and vectors of attacks related to the Autoware.Auto based code and also proposed the mitigation roadmap.
We were going to openly release the full report but we did not yet manage to fix all of the elements of the mitigation roadmap (we are prioritizing fixing security flaws related to our core product, Apex.OS).
If you guys are able to commit to fixing of the security flaws related to the Autoware.Auto based code - we can share that part of the report with you.
Regarding https://arxiv.org/pdf/2003.10402.pdf, it would be great if elements of it could gradually become the steps in Autoware.Auto Contributor’s Guide.
D.