DEF CON 32 - The hack, the crash and two smoking barrels. - Thomas Sermpinis
Source: YouTube · DEFCONConference · published Oct 16, 2024 · 39:38
The automotive industry continues to use outdated and insecure technologies in modern vehicles, creating serious safety risks that manufacturers often refuse to address or fix 1:25-1:29.
Key Takeaways:
• Modern vehicles rely heavily on the 40-year-old CAN bus protocol which lacks standard encryption and message authentication, making them vulnerable to attacks 4:29-5:05
• Thomas discovered critical vulnerabilities that could trigger blind spot detection sensors mid-drive, potentially causing steering interruption during lane changes 10:35-11:03
• Vulnerability disclosure in the automotive industry is extremely difficult, with many manufacturers ignoring findings or making excuses rather than fixing issues 15:49-16:03
• Security researchers face unfair accusations when trying to report vulnerabilities, including being accused of collaborating with "hostile nations" 18:18-18:32
• Even a $10 ESP32 microcontroller has better security features (like proper random number generation) than expensive automotive safety systems 34:40-35:00
Despite these challenges, Thomas emphasizes that positive change is possible through continued research, responsible disclosure, and advocating for better security practices across the industry 35:26-35:58.
Sources:
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Cybersecurity. Commonly maps to: Security and Risk Management, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
hello so thank you for joining um it's an immense honor to be here with you today uh something that I would never expect to happen but this is the hack the crash and Two Smoking Barrels and how I almost killed an engineer and I must mention that uh basically I had no lowers advising me before my talk so I will not if if you will not be able to reach me after the talk it was nice meeting you and now why you are here because some people in the industry really pissed me off and I wanted to be the one taking the stage and now that I got probably your attention let's start I'm Thomas and yeah my pictures are usually so bad that making it black and white didn't really help it's like my accent it can only go worse and people also know me as Crow Tom and the main thing you need to know about me is…