What actually breaks — with the demonstrations, not the hypotheticals.
Most V2X threat writing is a list of nouns. This page is the two published results that used real hardware and real attack code, plus the threat classes the standards explicitly acknowledge.
Demonstrated in 2026, against production units, with a $300 radio.
Researchers at Universidad Politécnica de Madrid demonstrated carry-off GNSS spoofing against commercial Commsignia on-board and roadside units, using a HackRF One software-defined radio with GPS-SDR-SIM and GNU Radio. Tested at 90, 145 and 200 km/h, the attack successfully corrupted the position and speed carried in the victim's V2X messages.
The detail worth dwelling on: the spoofing induced acceleration peaks approaching 20 m/s² — a value no road vehicle produces, and therefore trivially detectable by a first-class plausibility check. This is the argument for misbehaviour detection in one experiment. The signature of the attack was physically implausible; nothing in the cryptography could see it, and a simple kinematic sanity check could.
Mitigation discussed but not tested: Galileo OSNMA, of which the authors observe that deployment in V2X “is still at a very early stage.”
Retrieved as a preprint marked © 2026 IEEE. The final publication venue has not been confirmed.
68 attacks, and how few get caught.
Qualcomm's V2X Application Spoofing Platform, published at NDSS VehicleSec 2023.
VASP implements 68 distinct Basic Safety Message attacks in six families: value-type attacks (ghost node, self-telemetry falsification, constant and random offsets), kinematic-field attacks (position, speed, acceleration, heading, yaw rate, dimensions), application-targeted attacks (fake Emergency Electronic Brake Light events, Intersection Movement Assist disruption), mobility-based attacks that build plausible trust before striking, channel flooding and denial of service, and random mixes — each with persistent and sporadic policies. It is built as a sub-module of the Veins simulator.
The detection results are the headline, and they are sobering:
- VeReMi detectors caught 2 of 68 attacks with high confidence.
- F2MD caught 11.
- VASP's own detectors reached over 80% success on 37 of the 68.
Position, speed and acceleration remain the most exploitable fields. Code is public at github.com/quic/vasp. Where it sits in the open-source landscape →
The reading: cryptographic authentication is necessary and nowhere near sufficient. Every one of those 68 attacks can be launched by a device holding valid, unrevoked credentials — a genuine vehicle whose owner has modified its firmware, or a cloned device built around an extracted key. Authentication tells you the sender is allowed to speak. It tells you nothing about whether what they said is true.
What the standards explicitly acknowledge, and what each answers with.
| Threat | Mechanism | Standards-level countermeasure |
|---|---|---|
| Ghost vehicle injection | Fabricated BSM/CAM describing a vehicle that does not exist | Plausibility checks against onboard sensors and local environment; misbehaviour reporting |
| Sybil attack | One device presenting many valid pseudonyms simultaneously to fake a traffic jam or a platoon | Bounded pseudonym pools — the C2C-CC profile caps simultaneously valid pseudonyms at 20; cross-message consistency detection |
| Replay | Recording and re-broadcasting a genuine signed message later or elsewhere | generationTime in the security header plus replay-protection services in ETSI TS 102 940 |
| GNSS spoofing | Falsifying the position source rather than the message | Kinematic plausibility, multi-constellation receivers, Galileo OSNMA, inertial cross-check |
| Jamming / denial of service | Saturating the channel, or flooding with messages that force expensive verification | Congestion control; bounded verification strategies such as advanced verify-on-demand |
| RSU compromise | Physical capture of a roadside unit holding broad-permission application certificates | Tamper detection with credential wipe; secure boot; restricted SSP permissions; separated safety and commercial credentials |
| Key extraction and cloning | Recovering a signing key from a device an attacker holds | Tamper-resistant secure element with non-extractable keys — the only real answer |
| Tracking / linkage | Correlating pseudonyms across a rotation, or with an identifier recorded by a separate system | Synchronised cross-layer ID change; randomised 10–30 minute rotation; application-scoped certificate permissions |
Nothing normative yet, and there is a structural reason why.
ETSI TS 103 097 V2.2.1, published March 2026 and the newest European profile, contains no post-quantum content; its cryptographic set is ECDSA, SHA-2, ECIES and AES-128. IEEE 1609.2-2025's post-quantum content is not publicly documented, and nothing is claimed about it here.
The obstacle is size. An ECDSA P-256 signature is 64 bytes with a 32- or 33-byte public key. ML-DSA-44, standardised as FIPS 204, produces roughly 2,420-byte signatures with roughly 1,312-byte public keys — around forty times both. A CAM at 10 Hz already stresses the channel budget; a 2.4 KB signature plus a post-quantum certificate would force fragmentation and blow the congestion-control budget entirely. Falcon-512 is more attractive on size at roughly 666-byte signatures, but carries floating-point and constant-time implementation hazards on automotive microcontrollers. SPHINCS+ is far too large for broadcast.
Active research to follow: Practical Post-Quantum Authentication for V2V Communications (IACR ePrint 2022/483); qSCMS, a post-quantum reworking of the butterfly provisioning flow; and a 2026 Elsevier implementation-focused review of post-quantum cryptography for intelligent transportation systems.
Practical position for a hardware designer today: choose a secure element with cryptographic agility — the ability to add algorithms through an applet or firmware update rather than a silicon respin — and assume the migration will be forced by policy rather than by an attack. NXP's EdgeLock Secure Enclave in the i.MX 94 already advertises post-quantum readiness, which is the direction of travel. How applet upgradeability handles this →
Where this fits.
Misbehaviour detection
The layer that catches an authenticated device that is lying.
Hardware root of trust
The only real answer to key extraction, and the throughput cost of verifying under flood.
V2X PKI
What the permissions in a certificate do and do not prevent.
Pseudonymity and privacy
The bounded pseudonym pool that limits a Sybil attack.
Open source
VASP, VeReMi and F2MD — the test corpus for anyone building detectors.
AmbiRSU
Tamper detection and credential wipe on unattended roadside hardware.
Questions this page answers.
Can V2X be hacked?
V2X messages cannot be forged without a valid private key, and the standards require that key to live in tamper-resistant hardware. But authentication is not truthfulness: a device holding perfectly valid credentials can still transmit false data, because its GNSS was spoofed or its firmware was modified. Published research demonstrates both — GNSS carry-off spoofing against commercial on-board units using a roughly $300 software-defined radio, and a 68-attack platform for falsified safety messages. This is why misbehaviour detection exists alongside the PKI.
What is a Sybil attack in V2X?
One device presenting many valid pseudonymous identities at the same time, to simulate a traffic jam, a platoon or a group of witnesses. The countermeasures are structural: pseudonym pools are bounded, with the European profile capping simultaneously valid pseudonyms at twenty, and cross-message consistency checks look for multiple identities behaving as one physical object.
Is V2X vulnerable to GPS spoofing?
Yes, and it is one of the more practical attacks, because it falsifies the input rather than the message. A 2026 study demonstrated it against commercial hardware at highway speeds. The mitigations are kinematic plausibility checking — spoofed positions frequently imply physically impossible accelerations — multi-constellation receivers, inertial cross-checks, and eventually Galileo's authenticated navigation message, whose deployment in V2X is still very early.
Is V2X quantum-safe?
Not yet, and nothing normative exists. The newest European security profile, published March 2026, contains no post-quantum content. The obstacle is size: a post-quantum signature is roughly forty times larger than the ECDSA signature it would replace, which does not fit in a 10 Hz broadcast on a congested channel. The practical answer for hardware designers today is cryptographic agility — a secure element whose algorithms can be updated by applet rather than silicon respin.