Master Thesis - Security Assessment of Over-the-Air (OTA) Software Updates in Connected Vehicles

Threat Modeling and Automated Security Validation of Over-the-Air Software Updates in Heavy-Duty Vehicles Introduction Thesis work is an excellent way to get closer to Scania and build relationships for the future. Many of today's employees began their Scania career with their degree project. Background: OTA updates are critical to maintaining and improving vehicle software. Compromised update processes can introduce unauthorized firmware, downgrade attacks, or disruption of vehicle functions. Objective The thesis worker will: Analyze the OTA update architecture and associated attack surfaces. Develop a threat model using STRIDE and attack trees. Investigate firmware authenticity, integrity, authorization, and anti-rollback protections. Develop automated security test cases for OTA update workflows. Evaluate resilience against interrupted updates, replay attempts, and manipulated update metadata. Research questions: 1. What are the most significant cybersecurity threats affecting automotive OTA update mechanisms? 2. How effectively do existing security controls prevent unauthorized or manipulated updates? 3. How can OTA security validation be automated and integrated into release testing? Expected deliverables A complete OTA threat model, security requirements traceability matrix, automated Python-based test suite, and a technical evaluation report. Value for Scania: Strengthens OTA security assurance and provides reusable test cases supporting cybersecurity engineering under UN R155 and software update management under UN R156. Education/program/focus Indicate education, program or focus: Software development Number of students: 1 Start date for the thesis work: 2027-01-11 Estimated time required: <6 months Contact persons and supervisors Adela Åberg, Unit Head, adela.aberg@scania.com, Mostafa Imam, Master Thesis supervisor mostafa.imam@scania.com Application: Your application must include a CV, personal letter and transcript of grades A background check might be conducted for this position. We are conducting interviews continuously and may close the recruitment earlier than the date specified. Publication date from - to 2026-11-05 to 2026-11-20.