Finding, Managing, Preventing Vulnerabilities: An Automotive Perspective
summary
Claims that memory safety dominates automotive CVEs (about half of analyzed CVEs) and that ~75% of exploited bugs are memory-corruption lead to concrete actions: migration to safer languages/APIs, compiler hardening, fuzzing and runtime memory tagging. Practical tooling includes CycloneDX SBOMs (1.4+), automated SBOM+VEX adoption, CodeQL-style static queries for crypto use, and a built vulnerability-management pipeline tying ECUs, functions and services to owners. Built an embedded IDS and long‑term update/testing workflows to support 10–20 year vehicles.
AI-written summary · about
chapters (10)
- 0:00Session introduction
- 2:03Company and agenda
- 5:56Automotive architecture
- 11:27Vulnerability overview
- 15:11Memory safety analysis
- 20:33Prevention and V-model
- 25:18Supply chain security
- 30:20VEX and vulnerability disclosure
- 36:05Cryptographic material
- 40:33Vulnerability management
related talks
43mSecuring Software-Defined Vehicles: From Threat Awareness To Holistic Cybersecur...
41mPanel: Tackling Automotive Hardware Vulnerabilities
39mSoftware Security Engineering (Learnings from the past to fix ...)
50mSmashing the Stack: Let’s Make It Less Fun And Unprofitable!
23mSecure Code, Safe Future: Mastering Security in Critical Software Development
43mSecuring the Connected Car
01mFrom Bugs to Breaches
20mSecurity and Safety in the Modern Vehicles