ISO/SAE 21434 Compliance: Efficient (vehicle) penetration tests are one thing, regulatory requirements such as ISO/SAE 21434 and UN R155 are another? In this module, you will learn how penetration tests are managed in accordance with regulatory requirements. You will learn how to develop test strategies that meet the requirements of automotive standards and understand the crucial role that testing should play. You will learn how to examine the proper consideration of cybersecurity in development (cybersecurity goals, cybersecurity controls, etc.).

Fundamentals of cryptography in vehicle development: With this module, we refresh your know-how when it comes to the application of cryptography, encryption methods, handling keys (etc.) in practice. With reference to development work in the automotive environment, we will jointly develop valuable insights into pitfalls and hurdles in the implementation/configuration of cryptography based on common mistakes in automotive practice. Not least with the help of practical exercises. This cryptography knowledge update will provide you with valuable benefits for the subsequent modules of the Vehicle Hacking training.

Compromising diagnostic tools and UDS security analysis: In this module, you will learn how Unified Diagnostic Services (UDS for short) work. Learn step by step to what extent the UDS widely used in automotive electronics can be effectively attacked. In this module, we transfer what you have learnt directly from theory to practice: with an adaptive implementation of the UDS protocol on a mock ECU, you will have the opportunity to work out potential attack vectors independently and gain realistic experience.

Manipulation of the CAN bus system: For the automotive industry, the Controller Area Network bus (CAN bus for short) is still the central protocol for connecting control units in vehicles. In this module, you will learn about the functionalities of the CAN bus in technical detail. We then systematically work through potential vulnerabilities and associated attack techniques (such as spoofing, tampering, error frame propagation and CAN injection) and show you the consequences and risks that can arise.

Manipulation of hardware communication: In this module, we go one step deeper and introduce you to the level of hardware communication interfaces such as SPI, I2C and UART. You will not only acquire extensive basic knowledge about the respective information and communication streams, but also learn about vulnerability exploitation/exploitation practices. From sniffing to injection and man-in-the-middle attacks, you will get to know a range of established attack techniques on hardware communication.

Manipulation of on-chip debugging interfaces: In this module, you will learn about the functionality of on-chip debugging and associated interfaces such as JTAG, SWD (and others). Full of power, but (hopefully) not to the point of blowing up in our faces, you will learn how on-chip debugging can serve in terms of vulnerability/vulnerability exploitation in automotive systems. We will discuss how to identify different pins, how to communicate with the respective debugging interface and, of course, how to manipulate them should the system deny access.

Memory manipulation via hardware interfaces: Join us in this module to delve deeper into the architecture of electronic control units (ECUs). Learn how you can manipulate information and communication flows in a targeted manner. You will discover the possibilities of extracting and (manipulatively) injecting information into the memory unit. Together with the previous modules HW Communication and Debugging Interfaces, you will evolve your knowledge to a new level.

"Fault injection" attack technique: In this module, you will learn how to bypass a wide range of security mechanisms using the effective technique of fault injection. You will be surprised how relatively easy it can be to overcome the labour-intensive implementation of security, if you have sufficient (physical) access and the necessary patience. We will introduce you to the multifaceted methods and different implementations of the fault injection technique. You will gain basic knowledge of how fault injection can be set up and executed and which risks result from this.