That's got to include stuff like the stereo and navigation systems, which seems like cheating. The engine-management and safety-related systems are bound to be much smaller, and certainly don't need to me so large.
They are attack surfaces. Everything in the car is networked. Look at the paper: you can attack the engine through the gps. Maybe that was a different paper but I think it's in there.
They are attack surfaces ... you can attack the engine through the gps.
Sure, but the "attack surface" of the engine management firmware itself isn't enlarged by the presence of an insecure GPS system, is it?
I don't know if the people developing engine management firmware think about fire-walling themselves off from the rest of the in-car network. Certainly, they should. If they do, then the size of the code in the rest of the car doesn't seem relevant in terms of securing the really important stuff.
