Car Hacking | Gabriel Cirlig & Stefan Tanase | hardwear.io

Overview

This talk explores automotive cybersecurity, arguing that modern cars are essentially computers on wheels and therefore inherently vulnerable to hacking attacks. The speakers emphasize the importance of hardware security conferences in fostering dialogue between security researchers and the automotive industry to prevent future compromises of connected vehicles.

Attack Vectors

The speakers categorize attacks into two main types: those requiring physical access and those requiring remote access. Their proof-of-concept demonstration combines both approaches, leveraging physical USB port access paired with remote hacking techniques. They note that current vulnerabilities are amplified by increasing wireless connectivity in vehicles, including Bluetooth and other communication interfaces.

Technical Details

A critical vulnerability example discussed is the RDS (Radio Data System), which transmits data packets over airwaves decoded by in-car radio units. Malicious actors can craft malformed data packets to crash radio units or establish entry points for remote code execution exploits. The speakers stress that comprehensive input sanitization across all system layers is essential but frequently absent in current automotive system design. They note that vulnerabilities from older exploits, such as Bluebugging, may resurface in modern embedded systems.

Industry Challenges

Automotive engineers are highly skilled but typically designed isolated infotainment systems not intended for external connectivity. As vehicles become connected, this legacy approach creates security gaps. The industry lacks sufficient understanding of how cyber attacks translate into physical threats to passengers, creating cultural resistance to prioritizing cybersecurity measures.

Key Takeaways

The speakers advocate for automotive manufacturers to implement cybersecurity with the same rigor applied to physical safety features such as airbags and seatbelts. They stress that conferences like hardwear.io are essential platforms for bridging the gap between security researchers and hardware vendors. They also call for teaching developers secure coding practices from an attacker's perspective, not merely to prevent system crashes. Active engagement between security researchers and automotive vendors is presented as critical to establishing security-first development in the automotive industry.