DESCRIPTION

Modern cars are digital devices, controlled with multiple ECUs and millions of lines of software code. They are the frontline of modern embedded device development. With respect to unique safety requirements and rapid development of V2x communications, automotive security benefits from the expertise of other embedded applications.

This special 2-day edition of our Embedded Security for Automotive is brought to you by embedded device security veterans, with years of expertise in securing payment and content protection application. In this training you will look at an automotive solution from an attacker’s perspective. You will learn how ECUs can be hacked, and identify ways to apply this knowledge to your product and make it more robust. As a result, you will obtain the expertise to make effective security-related decisions throughout the entire development lifecycle of a vehicle electronic system.

COURSE OUTLINE

The following topics are covered during the training:

Day 1: Fundamentals of security

• Part 1: Fundamentals of security engineering
  • Recognize security assets in a given Target Of Evaluation (TOE)
  • Systematically find attack paths: attack trees
  • Profile the attackers
  • Rate attacks and prioritize attack paths
  • Common defense methods (built-in vs built-on security)

• Part 2: An introduction to Embedded Systems
  • Identify the relevance of a component for security
  • Develop a basic understanding of PCB layout
  • Tools used to interact with the target device
  • Memories an interlude
  • Attacker perspective: assumptions and specifications

Day 2: Attacks on automotive embedded systems (ECUs)

• Model the attack surface of the Riscurino board
• Retrieve assets from the TOE: dumping the MCU non-volatile memory (firmware)
• Implementation attacks and Misra-C guidelines
• Side channel attacks- retrieve keys from crypto algorithm implementations
• Use the JIL system to rate attacks
• Use FI to bypass the UDS security access