#HITB2022SIN #COMMSEC Fuzzing The MCU Of Connected Vehicles For Security And Safety
Outlines #HITB2022SIN #COMMSEC Fuzzing The MCU Of Connected Vehicles For Security And Safety and evaluates key implications for security practitioners.
Summary
Automotive Domain Context
Huawei inspector Ho Chen (Flag Sky) explains modern vehicle domain architectures where HMI domains expose Bluetooth, Wi-Fi, and cellular links while powertrain/chassis DCUs control safety-critical ESP/ABS functions—creating paths from infotainment compromise into vehicle control. Safety (unintentional failure) and security (malicious exploitation) both matter for MCU software.
MCU-Fuzz Tool Motivation
Traditional MCU testing relies on manual review, unit tests, and static analysis with coverage metrics, but vehicle-control systems need stronger assurance. Chen proposes MCU-Fuzz to apply coverage-guided fuzzing to domain-controller MCU firmware, complementing rather than replacing existing methods.
Hardware-Assisted Design
Automotive MCUs like NXP S32G offer limited RAM, Autosar RTOS without MMU, and GCC constraints that block common AFL injection. MCU-Fuzz uses embedded trace macrocell (ETM) hardware debug trace for coverage feedback instead of software instrumentation, enabling intelligent fuzzing where conventional host fuzzers cannot run directly on-target.
Related talks
Hack In The Box Security Conference (HITBSecConf)·31 min
Thomas Weber
Provides #HITB2022SIN #COMMSEC Faking At Level 1: How Digital Twins Save Your PLCs and evaluates key implications for security practitioners.
Hack In The Box Security Conference (HITBSecConf)·35 min
R. Sasi · V. Singh
Details #HITB2022SIN #COMMSEC Building An Army Of Bots By Hijacking a Twitter Handle and evaluates key implications for security practitioners.
Hack In The Box Security Conference (HITBSecConf)·34 min
Zoltan Balazs
Details #HITB2022SIN #COMMSEC Web3 + Scams = Its A Match and evaluates key implications for security practitioners.