Keynotes &Talks

1. From Garage Testing to CI Pipelines: Towards automated Security Testing of Automotive Containers – Reinhard Kugler

Linux and containers are now a common deployment technique in modern automotive ECUs, including Infotainment systems and HPCs. The security testing and prototyping still remain a challenge and companies still are adapting to modern software development and building practices like CI/CD. The main goal to moving from ad-hoc testing approaches to fully automated Dynamic Application Security Testing (DAST) is accompanied by several challenges:

• Support for automotive environments such as CAN in IT build environments (CI)
• Integration of testing tools with the system under test (SUT)
• Automation of test cases to provide repeatable and cost effective testing

This talk outlines the integration of automotive applications into automated build systems for automotive software and explores practical testing approaches such as smart fuzzing, automation with Scapy  and combinatorial testing.

2. Foundational Security from Ethernet to CAN: Prototyping CANsec and FDAL with Scapy – Dr. Friedrich Wiemer

MACsec has become the foundational link-layer security for automotive Ethernet. CAN and CAN FD, which still carry most safety-critical in-vehicle traffic, have no comparable foundation. We close this gap by extending MACsec downward: reuse MACsec for CANsec — the Layer 2 security protocol for CAN XL under specification in CiA 613-2. To make CANsec available on CAN FD as well, we additionally developed the CAN FD Adaptation Layer (FDAL). It extends the same Layer 2 trust foundation to the billions of CAN FD nodes already deployed today.

Scapy accompanied this work end-to-end. Building on the existing CAN XL functionality in the Linux kernel, we integrated it in Scapy, and implemented CANsec and FDAL as additional layers, developed alongside our specification work to validate real-world functionality. The same code base produced CANsec test vectors shared with silicon and stack vendors, and powered a proof-of-concept Ethernet application over CANsec protected CAN FD.

3. Autopsy of Modern Connected Cars – Dr. Enrico Pozzobon

While automotive security has moved forward, the forensic reality of these systems remains a “black box.” Based on a FIA study, this talk presents the technical challenges found in performing independent audits on three modern electric vehicles to extract the ground truth behind their data-handling practices.

We will detail the specific methodologies and hardware/software toolkit required to achieve:

• Network Interception: Building Man-in-the-Middle (MITM) setups for Automotive Ethernet and USB links. We will discuss intercepting telemetry and mapping hidden endpoints in environments protected by TLS and mTLS.
• Storage Forensics: A deep dive into extraction strategies, ranging from “in-situ” eMMC dumping to the invasive desoldering and reballing required for UFS memories. We also cover the recovery of forensic artifacts from encrypted NVMe storage and gateway-managed SD logs.
• Software Reversing: Practical analysis of the infotainment stack, including decompiling Android Automotive (GAS) applications and reverse engineering native QNX and Linux binaries to trace how sensor data is repackaged for the cloud.

4. Unlocking Hidden Bluetooth Capabilities with Scapy – Antonio Vasquez Blanco

Bluetooth security research lacks support for advanced capabilities comparable to monitor mode in WiFi adapters. Beyond the standardized interfaces of Bluetooth controllers lies a layer of vendor-specific functionality where powerful features exist but are typically inaccessible through conventional tooling.

Starting from real-world Bluetooth security research and existing tooling gaps, this talk explores direct controller interaction over USB, the discovery of vendor specific HCI commands, and how reverse engineering efforts can be turned into practical tooling by extending Scapy. Along the way, we unlock capabilities such as MAC spoofing and low level protocol access, features that are normally hidden from the operating system and standard Bluetooth stacks.

5. EU Cyber Resilience Act: Myths, Expectations and Practical Implementation – Janine Funke and Charan Krishnawurthy

The EU Cyber Resilience Act (CRA) is one of the most significant new cybersecurity regulations for digital products, yet many organizations still struggle to understand what it really means in practice. This session separates fact from fiction by addressing common myths around CRA compliance, discussing what conformity assessment and future Notified Bodies are expected to focus on, and sharing practical lessons learned from early implementation activities. Attendees will gain a clear understanding of how organizations can approach CRA readiness pragmatically, avoid common pitfalls, and build on existing cybersecurity practices rather than starting from scratch.

6. Beyond Blind Fuzzing: AI for Automotive Cybersecurity Testing – Dr. Natasha Alkhatib

Modern vehicles rely on dozens of networked electronic control units, creating an expanding attack surface for cyber threats. Yet identifying vulnerabilities before attackers exploit them remains slow and resource-intensive, as conventional fuzzing and penetration testing waste valuable effort on invalid inputs without understanding how vehicle systems actually behave.

In this talk, Dr. Natasha Alkhatib will demonstrate how artificial intelligence can transform automotive security testing. Using a local AI model, the system learns how a vehicle’s electronics respond, identifies high-risk areas, and focuses testing on the most security-critical functions instead of probing blindly. This intelligent approach uncovers exploitable vulnerabilities significantly faster than traditional methods.

Drawing on real evaluation results across targets with different security postures, Dr. Alkhatib will discuss the potential of AI-driven security testing and what it means for the future of automotive cyber resilience and the growing role of AI in protecting connected vehicles.

7. WHAD: We have a demo! – Damien Cauquil and Romain Cayre

Wireless protocols like Bluetooth Low Energy, ZigBee or LoRaWAN seem pretty complex and you may think you need a lot of different hardware and libraries to play with those. WHAD solves this by providing a unified Python library that supports multiple wireless protocols, heavily using Scapy for packet abstraction and providing its own customizable/hackable protocol stacks. WHAD makes development of proof-of-concepts, tools and wireless attacks simple, also making them compatible with any supported hardware interface. 

In this talk, we will explain how this framework works and show how it can be used to create powerful tools, manipulate wireless packets on-the-fly by combining some of the framework’s basic tools or spawn fake devices that mimic legitimate ones.

8. V2X Wardriving – They Drive, We Listen – Dieter Schuster and Nikolai Puch

Vehicle-to-Everything (V2X) communication has quietly become a reality. Many modern vehicles now support Cooperative Intelligent Transport Systems (C-ITS), enabling Vehicle-to-Vehicle (V2V) and Vehicle-to-Infrastructure (V2I) communication. But how widespread is this technology? What infrastructure is already deployed? Which messages are exchanged, and what are the associated privacy and security implications?

In this talk, we provide an overview of the European C-ITS ecosystem, explain the underlying standards, and demonstrate how off-the-shelf hardware can be used to research V2X protocols. We present the tooling we developed to analyze real-world deployments, share our findings on current implementations and communication patterns, and discuss potential attack surfaces, privacy concerns, and open research questions. Attendees will gain practical insights into the current state of V2X security and the opportunities for further exploration.

About Scapy

Scapy, a Python program, revolutionizes network packet manipulation by offering extensive capabilities including packet sending, sniffing, dissecting, and forging. This multifaceted tool empowers users to construct bespoke solutions for network probing, scanning, and security testing. Unlike conventional networking tools, Scapy boasts an interactive interface enabling users to craft, decode, and interpret packets with unparalleled flexibility. Its domain-specific language simplifies packet description and manipulation, epitomized by its ability to describe packets in just a few lines of code. Scapy’s unique approach diverges from traditional tools by providing raw, uninterpreted data, facilitating nuanced analysis and eliminating biases inherent in interpreted results.