Keynotes &Talks

From Garage Testing to CI Pipelines: Towards automated Security Testing of Automotive Containers – Reinhard Kugler

Linux and containers are now a common deployment technique in modern automotive ECUs, including Infotainment systems and HPCs. The security testing and prototyping still remain a challenge and companies still are adapting to modern software development and building practices like CI/CD. The main goal to moving from ad-hoc testing approaches to fully automated Dynamic Application Security Testing (DAST) is accompanied by several challenges:

• Support for automotive environments such as CAN in IT build environments (CI)
• Integration of testing tools with the system under test (SUT)
• Automation of test cases to provide repeatable and cost effective testing

This talk outlines the integration of automotive applications into automated build systems for automotive software and explores practical testing approaches such as smart fuzzing, automation with Scapy  and combinatorial testing.

Foundational Security from Ethernet to CAN: Prototyping CANsec and FDAL with Scapy – Dr. Friedrich Wiemer

MACsec has become the foundational link-layer security for automotive Ethernet. CAN and CAN FD, which still carry most safety-critical in-vehicle traffic, have no comparable foundation. We close this gap by extending MACsec downward: reuse MACsec for CANsec — the Layer 2 security protocol for CAN XL under specification in CiA 613-2. To make CANsec available on CAN FD as well, we additionally developed the CAN FD Adaptation Layer (FDAL). It extends the same Layer 2 trust foundation to the billions of CAN FD nodes already deployed today.

Scapy accompanied this work end-to-end. Building on the existing CAN XL functionality in the Linux kernel, we integrated it in Scapy, and implemented CANsec and FDAL as additional layers, developed alongside our specification work to validate real-world functionality. The same code base produced CANsec test vectors shared with silicon and stack vendors, and powered a proof-of-concept Ethernet application over CANsec protected CAN FD.

Autopsy of Modern Connected Cars – Dr. Enrico Pozzobon

While automotive security has moved forward, the forensic reality of these systems remains a “black box.” Based on a FIA study, this talk presents the technical challenges found in performing independent audits on three modern electric vehicles to extract the ground truth behind their data-handling practices.

We will detail the specific methodologies and hardware/software toolkit required to achieve:

• Network Interception: Building Man-in-the-Middle (MITM) setups for Automotive Ethernet and USB links. We will discuss intercepting telemetry and mapping hidden endpoints in environments protected by TLS and mTLS.
• Storage Forensics: A deep dive into extraction strategies, ranging from “in-situ” eMMC dumping to the invasive desoldering and reballing required for UFS memories. We also cover the recovery of forensic artifacts from encrypted NVMe storage and gateway-managed SD logs.
• Software Reversing: Practical analysis of the infotainment stack, including decompiling Android Automotive (GAS) applications and reverse engineering native QNX and Linux binaries to trace how sensor data is repackaged for the cloud.

Unlocking Hidden Bluetooth Capabilities with Scapy – Antonio Vasquez Blanco

Bluetooth security research lacks support for advanced capabilities comparable to monitor mode in WiFi adapters. Beyond the standardized interfaces of Bluetooth controllers lies a layer of vendor-specific functionality where powerful features exist but are typically inaccessible through conventional tooling.

Starting from real-world Bluetooth security research and existing tooling gaps, this talk explores direct controller interaction over USB, the discovery of vendor specific HCI commands, and how reverse engineering efforts can be turned into practical tooling by extending Scapy. Along the way, we unlock capabilities such as MAC spoofing and low level protocol access, features that are normally hidden from the operating system and standard Bluetooth stacks.

About Scapy

Scapy, a Python program, revolutionizes network packet manipulation by offering extensive capabilities including packet sending, sniffing, dissecting, and forging. This multifaceted tool empowers users to construct bespoke solutions for network probing, scanning, and security testing. Unlike conventional networking tools, Scapy boasts an interactive interface enabling users to craft, decode, and interpret packets with unparalleled flexibility. Its domain-specific language simplifies packet description and manipulation, epitomized by its ability to describe packets in just a few lines of code. Scapy’s unique approach diverges from traditional tools by providing raw, uninterpreted data, facilitating nuanced analysis and eliminating biases inherent in interpreted results.