In this talk, Andreas will show how contemporary software engineering can help to write more secure code and detect vulnerabilities already during development.

He will revisit historical vulnerabilities in the automotive space and take a look at common classes of bugs present in embedded software. 

Using these examples, he will show how modern programming language evolution and tooling can tackle and prevent these issues. 

In addition, he will examine current trends towards more secure and safe programming languages eliminating the shown bug classes in the future.

WATCH HERE

Software testing typically requires these three steps:

1. test case generation

2. target program execution 

3. execution feedback analysis.

Researchers have been focusing on improving the test case generation and execution feedback analysis while the topic of target program execution is under-studied, because executing the target program seems to be an easy task.

However, through industry practice, we find that target program execution can be challenging for libraries or IoT software.

Therefore, we propose two techniques for emulation based fuzzing on IoT software and automated fuzz driver generation.

We have implemented prototypes for these techniques and used them to find dozens of vulnerabilities in open-source libraries and routers.

WATCH HERE

Fuzz testing has proven itself as a powerful approach for finding previously undiscovered vulnerabilities and robustness issues. 

However, while the fuzz testing tool is key, the timing and scope of its application during the development is crucial as well.

This talk addresses these pain points and explains how fuzz testing can be beneficial when integrated early and systematically at every stage of the product development process.

WATCH HERE

In their talk,  René and Rosemary will share some insights on how they utilized fuzzing to improve overall software quality and how this can be integrated into existing verification and validation processes. 

They will further describe some of their experiences while applying coverage-guided fuzzing in ongoing automotive projects, what challenges they faced and how they overcame them.

WATCH HERE

Michal and Victor will speak about the importance of end-to-end security verification, including fuzzing on SW and real interfaces.

They will present how this can be used as a pillar integrated as part of the CI/CD and how it can also be monitored from the Vehicle Security Operating Centers used by OEMs.

WATCH HERE

Rakshith Amarnath is a project lead for R&D at Bosch Corporate Research. In this talk, Rakshith will tell you why fuzzing needs to be rethought in the context of automotive software.

Presentation topics:

Why fuzz automotive software?
What's the difference?
Why do we need to rethink?
Thoughts on rethinking

WATCH HERE

Victor is currently working at Continental Automotive near Frankfurt and leads the Security&Privacy for Human Machine Interface Business Unit. He is a tech geek who is passionate about UNECE R155 readiness preparation and the combination of automated driving, machine learning and the impact on CyberSec.

Presentation topics:

Achievements with Fuzzing at Continental
The future of software testing in the automotive industry
Fuzzing in Machine Learning

WATCH HERE

Yasemin Acar's research focuses on human factors in computer security, investigating how to implement secure software development practices. It has shown that working with developers on these issues can resolve problems before they ever affect end users.

Presentation topics:

Reasons why humans fail to secure software
How can we make secure programming easier?
Takeaways from research for practice

WATCH HERE

At the end of FuzzCon - Automotive Edition, all speakers joined for a panel discussion about automotive software security with a special focus on fuzzing.

WATCH HERE