1. From Garage Testing to CI Pipelines: Towards automated Security Testing of Automotive Containers – Reinhard Kugler

Linux and containers are now a common deployment technique in modern automotive ECUs, including Infotainment systems and HPCs. The security testing and prototyping still remain a challenge and companies still are adapting to modern software development and building practices like CI/CD. The main goal to moving from ad-hoc testing approaches to fully automated Dynamic Application Security Testing (DAST) is accompanied by several challenges:

• Support for automotive environments such as CAN in IT build environments (CI)
• Integration of testing tools with the system under test (SUT)
• Automation of test cases to provide repeatable and cost effective testing

This talk outlines the integration of automotive applications into automated build systems for automotive software and explores practical testing approaches such as smart fuzzing, automation with Scapy and combinatorial testing.

2. Foundational Security from Ethernet to CAN: Prototyping CANsec and FDAL with Scapy – Dr. Friedrich Wiemer

MACsec has become the foundational link-layer security for automotive Ethernet. CAN and CAN FD, which still carry most safety-critical in-vehicle traffic, have no comparable foundation. We close this gap by extending MACsec downward: reuse MACsec for CANsec — the Layer 2 security protocol for CAN XL under specification in CiA 613-2. To make CANsec available on CAN FD as well, we additionally developed the CAN FD Adaptation Layer (FDAL). It extends the same Layer 2 trust foundation to the billions of CAN FD nodes already deployed today.

Scapy accompanied this work end-to-end. Building on the existing CAN XL functionality in the Linux kernel, we integrated it in Scapy, and implemented CANsec and FDAL as additional layers, developed alongside our specification work to validate real-world functionality. The same code base produced CANsec test vectors shared with silicon and stack vendors, and powered a proof-of-concept Ethernet application over CANsec protected CAN FD.

3. Autopsy of Modern Connected Cars – Dr. Enrico Pozzobon

While automotive security has moved forward, the forensic reality of these systems remains a “black box.” Based on a FIA study, this talk presents the technical challenges found in performing independent audits on three modern electric vehicles to extract the ground truth behind their data-handling practices.

We will detail the specific methodologies and hardware/software toolkit required to achieve:

• Network Interception: Building Man-in-the-Middle (MITM) setups for Automotive Ethernet and USB links. We will discuss intercepting telemetry and mapping hidden endpoints in environments protected by TLS and mTLS.
• Storage Forensics: A deep dive into extraction strategies, ranging from “in-situ” eMMC dumping to the invasive desoldering and reballing required for UFS memories. We also cover the recovery of forensic artifacts from encrypted NVMe storage and gateway-managed SD logs.
• Software Reversing: Practical analysis of the infotainment stack, including decompiling Android Automotive (GAS) applications and reverse engineering native QNX and Linux binaries to trace how sensor data is repackaged for the cloud.

4. Unlocking Hidden Bluetooth Capabilities with Scapy – Antonio Vasquez Blanco

Bluetooth security research lacks support for advanced capabilities comparable to monitor mode in WiFi adapters. Beyond the standardized interfaces of Bluetooth controllers lies a layer of vendor-specific functionality where powerful features exist but are typically inaccessible through conventional tooling.

Starting from real-world Bluetooth security research and existing tooling gaps, this talk explores direct controller interaction over USB, the discovery of vendor specific HCI commands, and how reverse engineering efforts can be turned into practical tooling by extending Scapy. Along the way, we unlock capabilities such as MAC spoofing and low level protocol access, features that are normally hidden from the operating system and standard Bluetooth stacks.

5. EU Cyber Resilience Act: Myths, Expectations and Practical Implementation - Janine Funke and Charan Krishnamurthy

The EU Cyber Resilience Act (CRA) is one of the most significant new cybersecurity regulations for digital products, yet many organizations still struggle to understand what it really means in practice. This session separates fact from fiction by addressing common myths around CRA compliance, discussing what conformity assessment and future Notified Bodies are expected to focus on, and sharing practical lessons learned from early implementation activities. Attendees will gain a clear understanding of how organizations can approach CRA readiness pragmatically, avoid common pitfalls, and build on existing cybersecurity practices rather than starting from scratch.

6. Beyond Blind Fuzzing: AI for Automotive Cybersecurity Testing – Dr. Natasha Alkhatib

Modern vehicles rely on dozens of networked electronic control units, creating an expanding attack surface for cyber threats. Yet identifying vulnerabilities before attackers exploit them remains slow and resource-intensive, as conventional fuzzing and penetration testing waste valuable effort on invalid inputs without understanding how vehicle systems actually behave.

In this talk, Dr. Natasha Alkhatib will demonstrate how artificial intelligence can transform automotive security testing. Using a local AI model, the system learns how a vehicle's electronics respond, identifies high-risk areas, and focuses testing on the most security-critical functions instead of probing blindly. This intelligent approach uncovers exploitable vulnerabilities significantly faster than traditional methods.

Drawing on real evaluation results across targets with different security postures, Dr. Alkhatib will discuss the potential of AI-driven security testing and what it means for the future of automotive cyber resilience and the growing role of AI in protecting connected vehicles.

7. WHAD: We have a demo! – Damien Cauquil and Romain Cayre

Wireless protocols like Bluetooth Low Energy, ZigBee or LoRaWAN seem pretty complex and you may think you need a lot of different hardware and libraries to play with those.

WHAD solves this by providing a unified Python library that supports multiple wireless protocols, heavily using Scapy for packet abstraction and providing its own customizable/hackable protocol stacks. WHAD makes development of proof-of-concepts, tools and wireless attacks simple, also making them compatible with any supported hardware interface. 

In this talk, we will explain how this framework works and show how it can be used to create powerful tools, manipulate wireless packets on-the-fly by combining some of the framework's basic tools or spawn fake devices that mimic legitimate ones.

8. V2X Wardriving - They Drive, We Listen – Dieter Schuster and Nikolai Puch

Vehicle-to-Everything (V2X) communication has quietly become a reality. Many modern vehicles now support Cooperative Intelligent Transport Systems (C-ITS), enabling Vehicle-to-Vehicle (V2V) and Vehicle-to-Infrastructure (V2I) communication. But how widespread is this technology? What infrastructure is already deployed? Which messages are exchanged, and what are the associated privacy and security implications?

In this talk, we provide an overview of the European C-ITS ecosystem, explain the underlying standards, and demonstrate how off-the-shelf hardware can be used to research V2X protocols. We present the tooling we developed to analyze real-world deployments, share our findings on current implementations and communication patterns, and discuss potential attack surfaces, privacy concerns, and open research questions. Attendees will gain practical insights into the current state of V2X security and the opportunities for further exploration.

1. Truck Hacking Workshop – Ben Gardiner

This four-hour TCAT training course introduces you to the TCAT platform and its role in vehicle cybersecurity workflows. Through a fast-paced combination of instruction and integrated hands-on labs, participants complete practical exercises in UDS and J1939 diagnostics, controller application enumeration, and vehicle data-flow analysis using simulators.

Requirements: Windows or Linux PC, no admin/root required, but must support Standard USB serial driver allowed (ACM) and standard USB ethernet driver allowed (CDC). Must have a terminal emulator (e.g. putty, teraterm, screen, or picocom) and an ssh client installed. PC must have a modern web browser.

2. Tool Assisted Reverse Engineering - Willem Melching

This four hour workshop introduces the participants to “Tool Assisted Reverse Engineering”. How can you leverage AI tooling to speed up reverse engineering of automotive firmware binaries? Suited for both beginner and advanced Ghidra users. The workshop will start with a short introduction by the instructor, but will be be mostly hands-on.

Requirements: Laptop with Ghidra installed, preferably in a VM. Bring an OpenRouter token for using open models (Kimi K3, GLM 5.3, etc). Claude/Codex subscription also works if you are approved for cybersecurity work. You’re welcome to bring your own firmware files to analyze.

3. Hacking ZigBee and ANT devices with WHAD – Damien Cauquil, Romain Cayre

This workshop will give attendees a good understanding of WHAD through the use of command-line tools and its Python API. Attendees will practice sniffing, packet injection and tool development with this framework to take control of various devices, such as a ZigBee lightbulb or IoT devices using proprietary protocols like ANT or Enhanced ShockBurst.

Requirements: A Linux computer is required for this workshop, although a virtual machine will be available for download (VMWare/VirtualBox) and some hands-on exercises will be also available in our new emulated lab environment.

4. AI-Assisted Penetration Testing of Embedded Systems – Jonas Horreis

Discover how AI can enhance penetration testing of embedded systems in this hands-on workshop. Participants will combine established security tools such as Scapy, Wireshark, tcpdump, and nmap with AI-assisted workflows for reconnaissance, protocol analysis, vulnerability assessment, and automated test orchestration. 

The AI dynamically adapts test workflows, recommends follow-up tests based on previous results, assists with troubleshooting, and supports report generation and severity ranking. Through practical exercises on Ethernet, CAN, diagnostics, and serial interfaces, participants will learn how to build efficient, repeatable, and adaptive security assessments for modern embedded systems.

Requirements: Laptop with VirtualBox installed, Access to an AI solution with agent capabilities. The virtual machine from the dissecto team can be used. Control devices will be connected via PCAN-USB or Ethernet – you device should be able to recognize and establish the respective connection.

5. EV Charger Hacking Workshop - Gagan Bagh, Benedikt Kopf

This four-hour workshop is built around a single question: what can you actually do to a charging station if you're standing next to it in the car park? Participants will work with an OCPP 1.6j charging point device and gain hands-on experience with the device throughout the entire session. Everything that follows grows directly out of what they discover by probing the hardware itself. By the end, they'll have worked through every interface the device exposes, understood the protocol it speaks, and carried out a complete attack chain from first contact all the way to running a live charging session on a backend they control.

The workshop closes with a CTF: One flag, seven steps.

Requirements: Laptop with Wi-Fi and Bluetooth, nRF Connect installed on a phone (iOS/Android).