Article details
- Category
- Blog
- Published
- Reading time
- 10 min read
- Author
- AutoSec Academy · Offensive Security Practice
Offensive work against vehicle systems is less glamorous than the conference talks suggest. The same categories of finding recur across manufacturers and suppliers, and almost all of them are implementation gaps rather than design flaws.
The recurring categories
- Diagnostic authentication that is weak, static, or shared across an entire vehicle line
- Debug and test interfaces left reachable on production parts
- Implicit trust between domains — a compromised infotainment path reaching further than the architecture diagram suggests
- Input validation on bus messages that assumes a well-behaved sender
- Cryptographic material handled correctly in design and carelessly in production tooling
Reporting that changes something
A finding that engineering cannot act on has no value. Report in the language of the affected component and its owning team, state the precondition an attacker needs, and be explicit about what you did not test. An honest scope statement makes the rest of the report credible.
The purpose of an offensive engagement is not to prove that a vehicle can be attacked. It is to give the people who build it a prioritised, reproducible list of what to fix first.