TheAutoCyberEngineer @TheAutoCyberEng

I’m practicing with real past incidents to eventually move toward more predictive assessments. What are you currently working on in automotive cybersecurity or threat modeling? Open to connecting with others doing interesting work. #Cybersecurity #TARA #ISO21434 #VehicleSecurity

This week I started building my first TARA report using the Kia hack as a case study. A proper TARA helps define measurable cybersecurity goals, identify risks, and implement solutions all aligned with ISO/SAE 21434.

Think of it like deleting a local admin account on a computer and creating a new one. Once in, they could remotely unlock doors, locate the car, and honk the horn. This was possible due to weak authentication on Kia’s dealership backend. #AutomotiveCybersecurity #KiaHack

Researchers took over Kia vehicles using only the license plate number. They created a fake dealership account → converted plate to VIN → called an internal endpoint that returned owner details → removed the real owner and took control. samcurry.net/hacking-kia #VehicleSecurity

This makes firmware a high-value target in automotive cybersecurity. For those transitioning into the field what’s been your biggest challenge? For the pros: How do you evaluate firmware risks during TARA on chassis systems? #Cybersecurity #EBCM #AUTOSAR #VehicleSecurity”

Most people don’t realize their brakes run on software. While breaking down the EBCM for TARA, the MCU firmware stood out as a critical asset. It contains ABS/ESC logic, safety monitors, diagnostics, and runs on AUTOSAR Classic. Vehicles stay on the road for 10–15 years.

From a cybersecurity perspective, it’s a high-value target because it has direct influence over vehicle dynamics. Here’s a breakdown of its key hardware and software assets that are typically analyzed during TARA. #AutomotiveCybersecurity #VehicleSecurity #CyberSecurity #CARS

keyboard_arrow_left Previous keyboard_arrow_right Next

The EBCM (Electronic Brake Control Module) is one of the most safety-critical ECUs in a vehicle. It controls ABS and stability functions and can modulate brake pressure multiple times per second.

keyboard_arrow_left Previous keyboard_arrow_right Next

‼️🚨 BREAKING: GitHub has been compromised by TeamPCP. GitHub has confirmed the internal breach. A poisoned VS Code extension on an employee device exfiltrated ~3,800 internal repositories. TeamPCP is already selling the data on a cybercrime forum.

keyboard_arrow_left Previous keyboard_arrow_right Next

For those transitioning into automotive cybersecurity — what’s been your biggest challenge? Also, which tangible asset concerns you the most? #AutomotiveCybersecurity #ISO21434 #ThreatModeling #VehicleSecurity #CyberSecurityEngineering

Last week I hit a wall trying to identify assets in Gas, Hybrid & Electric vehicles. Found clarity in Chapter 7 of “Automotive Cybersecurity Engineering Handbook” by Dr. Ahmad MK Nasser. #AutomotiveCybersecurity #ISO21434 #ThreatModeling #VehicleSecurity #CyberSecurity #tesla

Key lesson: Tangible assets (Brake Control Module, Hybrid Control Unit, Electric Motor & Inverter) matter far more than vague intangible ones. This is why proper asset identification under ISO/SAE 21434 is critical.

For those transitioning into automotive cybersecurity — what’s been your biggest challenge? Also, what key assets would you prioritize in Gas, Hybrid, or Electric vehicles? #AutomotiveCybersecurity #HEAVENS #ISO21434 #ThreatModeling #VehicleSecurity #CyberSecurity

Spent the past week deep in HEAVENS 2.0 (aligned with ISO 21434). Key lesson: You can’t protect what you don’t understand. This week I tried mapping the Internal Combustion Engine architecture from a cybersecurity perspective and hit a wall. It’s far more complex than expected.

. How are organizations actually implementing this in practice? #AutomotiveCybersecurity #ThreatModeling #ISO21434 #VehicleSecurity #CyberSecurityEngineering

Threat modeling in software (STRIDE, PASTA) vs automotive (HEAVENS 2.0 & ETAS under ISO/SAE 21434) is on another level. A modern vehicle has hundreds of ECUs, real-time constraints, and safety-critical systems. Threat modeling here is no longer optional it’s a strategic necessity

keyboard_arrow_left Previous keyboard_arrow_right Next

Lexus RX 350 stolen in <90s in Milton via CAN Bus Injection at the headlight Legacy CAN architecture with weak authentication strikes again Mercedes: secure gateways + segmentation Tesla: crypto + PIN-to-Drive Time for Toyota/Lexus to accelerate #Automotive #Cybersecurity #CANBus

UN ECE R155 + R156 in one post: R155 needs manufacturers to prove a full Cyber Security Management System (risk ID, monitoring, response). R156 requires secure, authentic over-the-air updates with no manipulation possible. Your future car now legally needs both. #cartech

What excites or concerns you most? #AutomotiveCybersecurity #ZonalArchitecture #VehicleSecurity #CyberSecurityEngineering #ConnectedVehicles"

Biggest change in car design since the assembly line: Flat → Domain → Zonal Architecture. Zones with local gateways + short cables + central computer at 10Gbps+ = less weight, easier manufacturing, true “data center on wheels” Cybersecurity bonus: easier control implementation