Securing the Connected Car
summary
Connected-car security focuses on concrete failures and fixes: Tesla uses OTA updates and claims a 50% accident reduction and new revenue from Autopilot; the Jeep Cherokee breach by Charlie Miller and Chris Valasek exploits a guessable Wi‑Fi provisioning password, an unauthenticated V850 chip firmware update and leads to a 1.4 million cars recall. Expect 1–25 bugs per KLOC, average remediation near 110 days and exploit probability near 90% by 60 days. Practical defenses shown: signed firmware, dual‑partition rollback, phased rollouts (campaign management) and Linux OTA tooling (Mender.io).
AI-written summary · about
chapters (21)
- 0:00Intro
- 2:29About me
- 3:37Session overview
- 4:34Software defined car: New revenues
- 5:42Cost savings by using open sour
- 8:02The software defined car requires OTA updates
- 10:19Jeep Cherokee hacked in July 2015
- 12:11Jeep Cherokee Head Unit with Wifi
- 13:25Wifi-based breach: Short-range
- 14:48Cellular-based breach: Country-wide
- 17:28CAN bus
- 18:12Putting it together
- 21:08The Controller Area Network (CAN) bus
- 22:13More complexity leads to larger attack surface
- 26:36Security patching is done too late
- 29:56Why security patching happens too late
- 31:54Patching connected devices is harder
- 33:33Embedded client patching process Overview
- 35:09Choice of update type has tradeoffs
- 36:31Strategies to reduce the risk of bricking
- 39:27Prepare for securing the software defined ca
related talks
40mSecuring the Connected Car
20mSecurity and Safety in the Modern Vehicles
41mPanel: Tackling Automotive Hardware Vulnerabilities
43mSecuring the Connected Car
43mSecuring Software-Defined Vehicles: From Threat Awareness To Holistic Cybersecur...
38mNation-State at Fault: The Future of Automotive Accidents?
41mThe Trajectory of Automotive Cybersecurity and the Role of AI
51m0-days & Mitigations: Roadways to Exploit and Secure Connected BMW Cars