From new industry standards to dealing with false positives and growing dependencies within automotive software systems, Sergej will detail the current challenges of keeping automotive software secure. 

In this talk, Andreas will show how contemporary software engineering can help to write more secure code and detect vulnerabilities already during development.

He will revisit historical vulnerabilities in the automotive space and take a look at common classes of bugs present in embedded software. 

Using these examples, he will show how modern programming language evolution and tooling can tackle and prevent these issues. 

In addition, he will examine current trends towards more secure and safe programming languages eliminating the shown bug classes in the future.

Software testing typically requires these three steps:

1. test case generation

2. target program execution 

3. execution feedback analysis.

Researchers have been focusing on improving the test case generation and execution feedback analysis while the topic of target program execution is under-studied, because executing the target program seems to be an easy task.

However, through industry practice, we find that target program execution can be challenging for libraries or IoT software.

Therefore, we propose two techniques for emulation based fuzzing on IoT software and automated fuzz driver generation.

We have implemented prototypes for these techniques and used them to find dozens of vulnerabilities in open-source libraries and routers.

Michal and Victor will speak about the importance of end-to-end security verification, including fuzzing on SW and real interfaces.

They will present how this can be used as a pillar integrated as part of the CI/CD and how it can also be monitored from the Vehicle Security Operating Centers used by OEMs.