Securing Software-Defined Vehicles: From Threat Awareness To Holistic Cybersecur...
Talkat Open Source Summit Japan + AI_dev: Open Source GenAI & ML Summit + Automotive Linux Summit 2025 · 2025-12-08..12-10·
summary
Software-defined vehicles produce hundreds more CVEs yearly (over 500 reported last year) and a concrete cloud-to-vehicle exploit shows why: an unvetted dealer web portal plus missing backend authorization lets an attacker register as a dealer, use a assign owner API (found with Burp-like analysis) to add themselves as vehicle owner, unlock/start cars and exfiltrate owner data; OEMs ship a patch two months after 2024 disclosure. Recommendations include defense-in-depth, automated DevSecOps (SAST/DAST/fuzz), VSOC + OTA fixes, and a post-quantum crypto library (Kyber/Dilithium/Falcon/HQC) with Autosar wrappers for migration.
AI-written summary · about
chapters (13)
- 0:00Introduction
- 1:47Software-defined vehicles
- 5:41Potential threats across vehicle ecosystem
- 9:32Security solutions
- 11:40Post-quantum cryptography
- 16:15Real-world automotive attack
- 23:01End-to-end security
- 24:30Organizational security
- 26:14Secure development lifecycle
- 32:38Security testing
- 35:50DevSecOps validation
- 36:32Security operations
- 39:19Q&A
related talks
19mSecuring the future of mobility: Automotive threat modeling
41mPanel: Tackling Automotive Hardware Vulnerabilities
43mSecuring the Connected Car
57mFinding, Managing, Preventing Vulnerabilities: An Automotive Perspective
20mSecurity and Safety in the Modern Vehicles
22mSecuring IoT for Life: Navigating the Challenge of Constant Change
40mSecuring the Connected Car
01h 04mYour Car “Knows” You: Security in Connected Vehicles & Roadway Infrastructure