Secure Our Streets 2025

This presentation explores the evolution of product cybersecurity requirements in the automotive industry, highlighting the influence of emerging regulations such as UN ECE R.155 and standards like ISO/SAE 21434 on the cybersecurity landscape.

It also addresses the complexities and challenges arising from contractual obligations across the automotive value chain and offers practical recommendations for reducing this complexity through better alignment between regulatory, technical, and commercial requirements.

Asymmetric cryptography is now in widespread use, but algorithms that are secure today will be broken by the quantum computers of tomorrow. Most of todays and upcoming automotive security measures (e. g. ECU integrity protection, secure onboard communication, V2X, access control etc.) rely on classical cryptography that will be vulnerable. Although a breakthrough in quantum computing might be years away, companies need to prepare for the smooth transition to quantum-secure systems. Finding suitable post-quantum algorithms and migrating to quantum-secure systems can pose many challenges. This presentation aims to facilitate the understanding of challenges in the migration to post-quantum cryptography and describe viable solutions based on existing research. First, post-quantum algorithms and their impact on functions and protocols are analyzed under consideration of ongoing standardization processes and migration research projects. After that, the considerable differences between algorithms based on practical examples and benchmarks on common automotive hardware targets, e.g., Aurix TC375, are described. In the practical examples we focus on the lattice-based algorithms Falcon and Dilithium and briefly point out differences from other mathematical primitives. Furthermore, practical solutions for migration of Public Key Infrastructures (PKIs) are illustrated and respective advantages and disadvantages are discussed. The various categories of crypto agility are presented to highlight the wide scope of methods in this field. At the end, a general strategy for migration is proposed that considers the general uncertainty about the quantum threat by planning ahead and increases the trust in novel post-quantum algorithms by the implementation of suitable solutions.

The rapid integration of connected technologies in modern vehicles has introduced significant cybersecurity challenges, particularly in securing critical systems against advanced threats such as IP spoofing and rule manipulation. This study investigates the application of CHERI (Capability Hardware Enhanced RISC Instructions) to enhance the security of Intrusion Detection Systems (IDSs) in automotive networks. By leveraging CHERI’s fine-grained memory protection and capability-based access control, the IDS ensures the robust protection of rule configurations against unauthorised access and manipulation. Experimental results demonstrate a 100% detection rate for spoofed IP packets and unauthorised rule modification attempts. The CHERI-enabled IDS framework achieves latency well within the acceptable limits defined by automotive standards for real-time applications, ensuring it remains suitable for safety-critical operations. The implementation on the ARM Morello board highlights CHERI’s practical applicability and low-latency performance in real-world automotive scenarios. This research underscores the potential of hardware-enforced memory safety in mitigating complex cyber threats and provides a scalable solution for securing increasingly connected and autonomous vehicles. Future work will focus on optimising CHERI for resource-constrained environments and expanding its applications to broader automotive security use cases.

Five years ago, we presented “Automotive Penetration Testing with Scapy” at TROOPERS19—a talk that quickly became one of the most-watched sessions on the TROOPERS YouTube channel. In the intervening years, the automotive domain has evolved significantly, particularly in the realm of **Automotive Ethernet** (e.g., 100/1000BASE-T1). Modern vehicles now rely heavily on protocols like **Diagnostics over IP (DoIP)**, **SOME/IP**, and **AUTOSAR PDUs**, combined with sophisticated security approaches and **Over-the-Air (OTA)** update mechanisms. In this fresh deep dive, we revisit the automotive Ethernet security landscape, illustrating how **Scapy** has adapted to accommodate these emerging protocols and testing scenarios. We will demonstrate advanced techniques, including restbus simulations for SOME/IP, emulating malicious OTA update servers, and exploring cutting-edge features in UDS—such as authentication services—all through carefully crafted packet injection and analysis.

This study examines the automation of converting Threat Analysis and Risk Assessment (TARA) data into the openXSAM format within the automotive industry, addressing the growing need for cybersecurity in modern, interconnected vehicles. By leveraging both qualitative and quantitative research methods, the study identifies challenges in data standardization, evaluates current practices, and explores the potential of automation to streamline processes and enhance compliance with ISO/SAE 21434 and UNECE Regulation No. 155. The findings demonstrate that automated data conversion could significantly improve efficiency, data integrity, and interoperability across the automotive supply chain, thereby supporting industry-wide cybersecurity objectives. This research offers valuable insights for automotive engineers, cybersecurity professionals, and policymakers, emphasizing the need for robust tools and collaborative efforts to standardize and automate TARA data processes.

This presentation explores the complexities and best practices in vulnerability management within the automotive software supply chain, with a focus on the challenges in complex software, including open-source components, third-party libraries, and proprietary software. The most important topics are the SBOM generation process, the difference between source code and binary code analysis, and the difficulties in identifying and mitigating vulnerabilities. In addition, we consider the role of Vulnerability Disclosure Reports (VDRs) and Vulnerability Exploitability Exchange (VEX) in providing a robust foundation for effective vulnerability management.

APIs are the backbone of today’s connected vehicle ecosystem—powering everything from remote commands, over-the-air updates, to EV charging—but they’re also becoming prime targets for attackers. While cybersecurity teams focus on perimeter defenses and known vulnerabilities, API abuse often flies under the radar, leaving vehicles exposed to threats hiding in plain sight. This session takes a practical look at how automotive APIs are being exploited in the wild and why current security practices aren’t enough. We’ll break down real-world examples, including the VIN Spray technique—where attackers used API manipulation and social engineering to pair unauthorized users with vehicles—and recent research showing how attackers can activate vehicle functions through dealership APIs using nothing more than a license plate. The core challenge? A lack of correlation between API traffic and connected vehicle data like telematics, ADAS events, or sensor anomalies. Without this context, it’s nearly impossible to distinguish normal API usage from malicious intent. We’ll walk through practical strategies and frameworks for bridging this gap, including: Detecting anomalous API behavior with contextual triggers from in-vehicle data Building rules and models that account for cross-layer API abuse Implementing real-time detection pipelines to flag suspicious vehicle-command activity

As vehicles evolve to be more software-defined, automotive cybersecurity must also adapt to meet the demands of increased system complexity, real-time threat detection, and distributed architecture. Edge AI, the deployment of artificial intelligence directly on a vehicle’s computing systems, offers a promising path forward. It enables low-latency, context-aware cybersecurity capabilities critical for protecting software-defined vehicles (SDVs) and their complex software ecosystems. However, realizing edge AI’s full potential requires overcoming significant technical and operational challenges, while ensuring alignment with growing regulatory demands. This presentation examines key questions surrounding edge AI implementation and integration, including: How can edge AI models be optimized for reliable, low-latency threat detection across resource-constrained automotive embedded systems? What challenges arise in deploying and maintaining AI models at the edge in vehicles? How does edge AI complement cloud-based security operations and support regulatory compliance within a holistic cybersecurity architecture for SDVs?

Due to the recent advances in the development of powerful quantum computers, the issue of cryptographic agility has once again become a focus of cyber security. While increasing the key lengths of existing algorithms has primarily provided the necessary security in recent years, this approach is not an option for the threat presented by quantum computers in asymmetric cryptography. This is due to the fact that the mathematical problems on which asymmetric cryptography is based can be solved much more efficiently with the help of these new types of processors. As a result, the affected algorithms must be completely replaced in order to guarantee the necessary security in the future. This flexible replacement of cryptographic algorithms is known as crypto-agility and is particularly relevant for systems that are to be supplied with software updates over several years. Modern cars based on the SDV principle can be described as one type of such system. The idea is that the functionality of the vehicles is no longer defined by the hardware, but by the implemented software, which can be continuously enhanced during runtime. Resource-limited systems, which are primarily used in real-time applications, pose a particular challenge. This special type of control device relies on microcontrollers, which compensate for their lower performance with hardware accelerators for dedicated functions. As modern cryptographic algorithms have high resource requirements, they are primarily implemented with appropriate hardware support. The advantage of this approach is the high-performance computation, but these hardware accelerators cannot be updated, which is a problem in the context of crypto-agility. For this reason, this presentation proposes a concept that enables the updating of existing ECUs for real-time capable applications based on the AUTOSAR Classic Platform. To prove the correctness of the corresponding approach, all post-quantum algorithms currently standardized by NIST are implemented and evaluated on two different automotive microcontroller generations.

Threat Analysis and Risk Assessment (TARA) is one of the cornerstones for complying with UN-R155 automotive cybersecurity regulation. In fact, the UN-R155 requires OEMs to perform risks assessments and demonstrate the appropriate management of risks throughout vehicle lifecycle. To meet this regulation, automotive stakeholders rely on the ISO/SAE 21434 standard which addresses several cybersecurity aspects including TARA methods. More specifically, the UN-R155 provides a list of threats to be considered in TARAs. These threats are not always relevant when analyzing a given feature as it depends on the attacker’s motivation. If we consider the threat related to physical attacks, a vehicle user would be more interested in tuning his vehicle than triggering safety related feared events; whereas a thief would be interested in inviolability related features, and he has very limited interest in infotainment features. In this talk, based on our experience with the ISO/SAE 21434 standard, we describe how to achieve pragmatic and efficient risks assessments. First, we propose improvements related to attack feasibility rating. Then, relying on TVRA methodology, we show how relevant threat agents’ capabilities and motivation can be considered to focus on relevant attack paths and determine risk values that better reflect the probability of real attacks, thus facilitating risk treatment decisions.

This paper presents PIBuster, a new attack vector against the EV charging infrastructure. The attack targets the Qualcomm HomePlug GreenPHY modems used inside CCS chargers and vehicles, and is enabled by a common misconfiguration in their Parameter Information Block (PIB). The vulnerability allows an attacker to overwrite the PIB of modems, which contains many critical fields. We create a safe laboratory testbed for evaluating PIB security, use it to pinpoint the necessary conditions for the attack, and determine that a single configuration byte is responsible. We collect a large dataset of PIBs from real-world EV chargers, and evaluate them using our test bed, determining that 41 out of 69 charging stations exhibit the vulnerable configuration. Finally, we identify a specific high-impact attack that results in a persistent denial of service, and that can only be resolved by replacing hardware.

This session explores how modern vehicle infotainment systems can be exploited to gain deep access to a car’s network. It demonstrates implanting a persistent backdoor, establishing a reverse shell, and leveraging exposed ADB and other services to interact directly with the CAN bus. Attendees will follow the full attack chain, from initial foothold to complete vehicle network access and gain insights into the security implications of connected mobility. The findings highlight critical vulnerabilities that could allow remote manipulation of safety-critical systems and offer practical lessons for improving automotive cybersecurity.

This presentation explores the integration of Artificial Intelligence (AI), particularly Large Language Models (LLMs), in safety-critical automotive systems and the emerging cybersecurity risks they introduce. We discuss the current gaps in regulations like UN Regulation No. 155 (UN R155) regarding AI-specific threats such as adversarial attacks and data poisoning. The talk proposes extending existing frameworks to include AI-focused security measures, leveraging industry standards like OWASP Top 10 for LLMs, MITRE ATLAS, and the Automotive Threat Matrix. Finally, it highlights how the Cybersecurity Management System (CSMS) can evolve to ensure secure AI deployment throughout the vehicle lifecycle, aligning automotive cybersecurity with the latest AI-driven challenges.

Required innovation in the automotive market is driven by inter-connectivity and software, increasing the attack surface. In the case of an actual incident, companies should be prepared to respond appropriately, and to ensure this in the area of business and IT incident response, simulations are an established way to practice this response. In the field of automotive systems, the awareness for the need to respond to incidents exists, but incident response simulation or training for incidents is not common. In this presentation, we identify different requirements towards an appropriate incident response, showcase different techniques that can be employed to perform incident response simulation, and evaluate them in an automotive context. Finally, an example showcasing the benefits and challenges of automotive incident response simulation is presented. From this, we draw the conclusion that it is beneficially and recommended to perform incident response simulation in the scope of IT security.

The Threat Analysis and Risk Assessment (TARA) is a central element of the cybersecurity engineering process in the automotive domain, as mandated by ISO/SAE 21434. It defines the rationale for security controls and documents system-level risks and assumptions, serving as the foundation for regulatory compliance and engineering decisions. A commonly used method for risk quantification within TARAs is the attack potential-based approach, adapted from evaluation schemes like Common Criteria. In theory, it enables a structured assessment of feasibility and attacker effort. In practice, however, its reliability hinges on the evaluator’s understanding of real-world attack scenarios and techniques. Based on observations from multiple development projects across OEM and supplier environments, this paper highlights a critical gap: most TARAs are authored by engineers with limited or no hands-on experience in penetration testing, software exploitation, or hardware attack techniques. As a result, the calculated attack potentials often suffer from false precision, giving a misleading impression of analytical rigor. The consequence is a systemic underestimation or misprioritization of threats. This paper calls for a re-evaluation of current practices, advocating for deeper integration of offensive security expertise into the TARA process to ensure its outputs reflect realistic threat feasibility.

As vehicles become increasingly connected, the cybersecurity landscape is evolving at a rapid pace. This timely discussion brings together leading voices from industry and academia to explore the challenges, innovations, and strategies shaping the future of automotive cybersecurity. Moderated by Faye Francy, Executive Director of Auto-ISAC, the conversation will feature insights from: Dr. Markus Tschersich – Head of Security & Privacy Research and Governance Jörn Eichler – Head of Security Engineering, Volkswagen AG & Head of Secure Systems Engineering Group, Freie Universität Berlin Christoph Krauss – Professor for Network Security, Darmstadt University of Applied Sciences / Head of Automotive Security Research, INCYDE From addressing today’s most pressing risks to building the secure systems of tomorrow, this panel will highlight collaborative approaches, cutting-edge research, and practical solutions driving resilience in the automotive sector.

Automotive security has come a long way but where are we really headed? In this session, Bosch Chief Technical Expert Robert Kaster takes us on a journey through the history of automotive security from an engineer’s perspective, highlighting how the field has evolved and where the energy of today’s security community is focused. He will explore the organizational and technological challenges ahead, from embedding a “quality mindset” into security practices to navigating the complexities of Software-Defined Vehicles (SDVs) and long-term maintenance. Finally, Robert will offer insights on how to measure success in vehicle security and, just as importantly, how to make the case for sustained investment to ensure a secure future.

As agricultural machinery becomes increasingly connected and automated, cybersecurity has emerged as a critical factor for safety, compliance, and operational resilience. This panel discussion at SOS 2025 will explore the potential implications of the UNECE R155 regulation for agricultural-relevant vehicles, examining best practices, challenges, and strategies for implementing robust cybersecurity measures. Industry experts will share insights on regulatory requirements, product security processes, and real-world experiences in protecting agricultural equipment against emerging cyber threats, helping manufacturers, operators, and stakeholders stay ahead in an evolving regulatory landscape.

PANEL MEMBERS:

Bradley Nielsen
Machine Electrical Engineer, CNH
Brad Nielsen is the Vehicle Cybersecurity Architecture Lead at CNH Industrial, bringing more than 36 years of experience in machine electrical engineering and product security. Throughout his career at CNH, Brad has held multiple roles spanning machine product cybersecurity, machine communications standardization, diagnostic tool and protocol development, and machine control systems design.

He currently leads the authoring team for the ISO 24882 Off-Road Cybersecurity Standard and serves as the Security Expert Team Lead for the Agricultural Electronics Foundation (AEF). His expertise is centered on advancing connected vehicle security, ensuring robust protections across agricultural and off-road machinery.

John Potter
Product Cybersecurity Architect, John Deere
John Potter worked at John Deere for nearly 30 years. His last major role there was leading the development of next generation product security for embedded devices. Currently he works for Iowa State University, John Deere and DG Tech – helping development next generation (mostly agricultural) vehicle network architectures and security.

Nicolas Hummel
Digitization Expert, VDMA Agricultural Machinery
Nicolas Hummel is a Digitization Expert at VDMA Agricultural Machinery (since 2023), where he focuses on the development and standardization of interoperability standards, as well as safety and cybersecurity frameworks. He actively contributes to international standardization through ISO/TC 23/SC 19, helping drive the digital transformation of agricultural machinery.

Hans Juergen Nissen
Manager Solution Controls Strategy , John Deere
Hans Juergen Nissen is the Manager Solution Controls Strategy at John Deere’s Global Production Systems Organization, where he drives global strategies advancing solutions from automation to autonomy, with a focus on safety, security, and multi-brand integration. Since joining John Deere in 1997, he has held leadership roles in precision farming, systems engineering, and automation & electrohydraulics, contributing to the development of intelligent machine systems and control solutions worldwide. Beyond his corporate work, Hans-Jürgen has been a leading voice in ISOBUS standardization for over two decades. He chaired the ISO/SC19 Agricultural & Forestry Electronics Committee (2010–2019) and the AEF Automation Team (2008–2019), earning the VDI Max von Eyth Recognition Award (2011) for his contributions to agricultural technology.

Alex Roberts
Director, Product Security, AGCO Corporation
Alex Roberts is the Director of Product Security, bringing over 20 years of experience in engineering and cybersecurity. He holds a degree in Electrical and Computer Engineering from Wichita State University and spent a decade testing hardware and firmware for a major storage manufacturer before transitioning to the agriculture industry. For the past decade, Alex has focused on implementing product security practices in agricultural machinery, most recently leading preparations for the RED and CRA cybersecurity legislation in Europe. His work ensures that connected agricultural systems meet the highest standards of safety, compliance, and resilience.

Leonhard Stutz
Development Engineer, CLAAS
Leonhard Stutz is a Development Engineer at CLAAS, where he supports product development teams with expertise in cybersecurity. With more than 12 years of experience in the agricultural sector and nearly five years at CLAAS, he specializes in securing digital systems within agricultural machinery. He is an active contributor to international standardization and industry collaboration, serving as a member of ISO/TC 23/SC 19/JWG 12 in the development of ISO 24882, and participating in cybersecurity working groups within AEF and CEMA. Leonhard holds an academic background in Bioinformatics, bringing a strong interdisciplinary perspective to his work at the intersection of agriculture, technology, and security.

The rapidly evolving threat landscape targeting the automotive sector, particularly with the rise of Software-Defined Vehicles (SDVs) and extensive connectivity across vehicle, cloud, and charging ecosystems, necessitates a shift from traditional, static security testing towards dynamic, continuous validation. This presentation details a case study from Rivian, an American electric vehicle manufacturer focused on adventure and sustainability, showcasing our practical implementation and operationalization of a Continuous Threat Exposure Management (CTEM) program built upon a foundation of internally developed cybersecurity infrastructure integrated with powerful open-source solutions.

The regulatory landscape for automotive cybersecurity is undergoing significant transformation. On one hand, emerging domain-specific standards such as ISO/SAE PAS 8477 and ISO/SAE TR 8475 are contributing to the harmonization of automotive specific cybersecurity concepts. On the other hand, new horizontal regulations are being introduced that are particularly relevant for automotive-related products and services that fall outside the scope of traditional type approval processes. As automotive companies increasingly offer digital services that extend beyond the vehicle, and as suppliers and also OEMs operate in different roles and across multiple industries (or vehicle categories) a broader understanding of cybersecurity obligations is essential. The presentation will focus on the European Union’s Cyber Resilience Act (CRA), highlighting its implications and the opportunities it presents for the automotive industry. We will explore the conditions under which the CRA becomes applicable and examine its intersection with established standards such as ISO/SAE 21434. By comparing CRA requirements with existing automotive cybersecurity practices, we aim to clarify compliance pathways and identify areas of alignment. Additionally, we will offer a forward-looking perspective on how organizations can leverage the CRA as a catalyst for strengthening their overall product security posture. This includes developing tailored cybersecurity capabilities within a robust framework, which is also applicable for dual- or multi-use items.

Anne Zachos is a Cybersecurity Research Engineer at the National Motor Freight Traffic Association, Inc. (NMFTA)™. Anne has a strong background in embedded systems engineering and is dedicated to advancing cybersecurity within the trucking industry. Her work is centered on securing connected vehicle technologies, focusing on both the technical challenges of embedded firmware and the broader cybersecurity threats facing commercial transportation. Anne contributes to several American Trucking Association (ATA) TMC task forces as well as technical standards committees under SAE International. At NMFTA, Anne contributes both to research initiatives and educational efforts, helping to strengthen the industry’s overall cybersecurity posture and awareness.

A heightened global focus on software supply chain security — plus a range of emerging industry regulations — have made SBOMs (software bill of materials) an increasingly important initiative for automotive suppliers and manufacturers. Of course, the scope of SBOM programs often varies by an organization’s role in the automotive ecosystem. This presentation (“SBOMs in the Automotive Industry: Real-World Insights and Recommendations”) will focus on three distinct parts of the SBOM lifecycle I’ve observed from my work supporting automotive industry clients. I’ll provide an overview of each part of the lifecycle, plus actionable guidance for improving results. The three scenarios are as followers: 1. SBOM distribution and generation: Based on our experiences, most organizations across the automotive software supply chain — manufacturers along with all tiers of suppliers — are in a position to need at least basic SBOM generation capabilities. 2. SBOM ingestion and aggregation: While Tier 2 suppliers may not be concerned about ingesting and combining SBOMs from external teams, automotive manufacturers (and many Tier 1 suppliers) very much are. 3. SBOMs as a vehicle for continuous monitoring and vulnerability management: Similar to ingestion and aggregation, automotive suppliers without extensive supplier networks of their own may not be focused on using SBOMs to achieve vulnerability management objectives. But manufacturers and more interconnected suppliers often are. Each section of this talk — which is based on extensive firsthand experience directly supporting automotive manufacturers along with Tier 1 and 2 suppliers — will include specific guidance to help attendees understand how SBOM programs within their organizations can more effectively manage these parts of the SBOM lifecycle.

This session presents the development and impact of AutoRFKiller, a tool designed to exploit vulnerabilities in cars using learning code RF (radio frequency) technology for remote locking and unlocking. Over more than a year, the discovery and testing process culminated in responsible disclosure, resulting in two CVEs officially published by ASRG in June 2025. Attendees will gain a behind-the-scenes look at RF car hacking, the technical challenges of automating the exploit, and the complex process of coordinating with vendors for responsible disclosure. The talk also includes the public release of AutoRFKiller, offering a unique insight into real-world automotive cybersecurity, exploitation, and vulnerability management.