VehicleSec '26 Technical Sessions

The popularity of electric scooters has grown in recent years, both for personal use and through rental apps. E-scooters are typically managed via a mobile app and powered by internal components, such as the battery, the battery management system (BMS), the driving system (DRV), and the Bluetooth Low Energy system (BTS). Despite their safety implications, there is little research on the security and privacy of these proprietary and undocumented internals and their associated attacker models. To fill this gap, we present the first security and privacy assessment of the internal components of two popular Xiaomi e-scooters. We cover the M365 (2016) and Mi3 (2023) e-scooters, and their Mi Home companion app.

Via reverse-engineering (RE), we uncover four critical design vulnerabilities on the e-scooter internals, such as arbitrary code execution on the BMS. Based on these issues, we develop E-Trojans, five novel attacks that flash a malicious BMS firmware to exploit the e-scooter’s internal components. The attacks can be performed physically via the debug port of the BMS, wirelessly over Bluetooth Low Energy (BLE), and remotely from a malicious app on the victim’s phone. They have a critical and real-world impact as they violate the safety, security, availability, and privacy of e-scooters and their users. For instance, they can permanently damage the e-scooter battery by undervolting it below the safety threshold or track the user by utilizing e-scooter internal values as a fingerprint.

We implement our attacks and RE findings in a modular and low-cost toolkit. Our toolkit binary patches BMS firmware by adding malicious capabilities, such as disabling battery safety thresholds, which enables our attacks and the creation of new ones. We test our attacks on real M365 and Mi3 e-scooters, empirically confirming their effectiveness and practicality. We propose four practical countermeasures that improve the security, privacy, and safety of the Xiaomi e-scooter ecosystem and its millions of users. We responsibly disclosed our findings to Xiaomi, which acknowledged and addressed them.

Controller Area Network (CAN) buses in modern vehicles lack fundamental security mechanisms, leaving them vulnerable to message-injection attacks. While Transformer-based Intrusion Detection Systems (IDS) are a promising solution, existing designs struggle to balance performance with efficiency, either discarding payload context or incurring high computational costs and vocabulary explosion when modeling full CAN frames. We present CANBERT+, an optimized BERT-based IDS designed to consider realistic deployment viability without sacrificing message context, which makes 6 times faster. CANBERT+ represents each CAN message as a single token augmented with multi-layer embeddings for the identifier, data length, and payload bytes with the elimination of redundant layers. This approach differentiates payload nuances while maintaining short sequence lengths to allow the model to capture byte-level context. Following a two-stage training process, self-supervised pre-training on benign traffic and supervised fine-tuning on attacks, we evaluated CANBERT+ on eight public datasets covering spoofing, fuzzing, DoS, and replay attacks. The model consistently outperforms traditional machine learning baselines and prior BERT-based IDSs; notably, it improves the F1 score on replay attacks from 0.60 to 0.72, which is 20% improvement. Furthermore, we introduce two compact variants that reduce model size by up to 205 times while preserving high detection accuracy, making the approach suitable for resource-constrained automotive hardware.

Machine Learning (ML)-based Controller Area Network (CAN) Intrusion Detection Systems (IDS) are widely studied and used to detect and mitigate attacks on in-vehicle communication. Despite frequent reports on high detection performance for well-established datasets, the practical applicability and robustness against real-world attackers of the trained solutions is rarely discussed. This work presents a preliminary analysis of the practical robustness of ML-based CAN IDS solutions, with a focus on per-frame, binary intrusion detection approaches. Our approach consists of three steps: (1) We analyze common datasets used for training and evaluating ML-based CAN IDS, (2) train human-interpretable decision trees on the datasets and investigate their learned classification rules1, and (3) critically evaluate the models against a practical attacker model. We observe that many commonly used CAN IDS datasets only include simple and easily distinguishable attacks. Consequently, ML-based models trained on these datasets tend to learn dataset-specific statistical artifacts or shortcuts rather than robust or semantically meaningful detection logic, a finding we demonstrate specifically within the scope of per-frame, binary detection. While our results are preliminary and limited to this detection paradigm, they show that high detection performance is not inherently indicative of practical robustness. We therefore argue that new detection strategies founded upon vehicle specifications and domain knowledge, in combination with ML tools, may offer more transparent and reliable protection than purely ML-driven approaches, and we call for broader evaluation across more diverse detection settings in future work.

Modern vehicles are increasingly evolving into complex IoT systems that rely on lightweight messaging protocols for Vehicle-to-Everything (V2X) communication. MQTT-SN, a UDP-based variant of MQTT designed for low-power and resource-constrained devices, is widely adopted in such environments. However, MQTT-SN’s reliance on stateless transport and gateway-centric design introduces additional attack surfaces, particularly in the form of implicit, state-dependent protocol logic maintained at gateways. This paper presents SNFuzz, a gateway-centric and state-oriented fuzzing framework designed to systematically explore vulnerabilities in MQTT-SN gateway implementations. SNFuzz models gateway-managed protocol states and enables exploration of deep, state-dependent behaviors through response-driven execution. This design allows SNFuzz to uncover vulnerabilities that are difficult to detect using existing fuzzers designed for connection-oriented protocols. We implement a prototype of SNFuzz and evaluate it on three MQTT-SN gateway implementations. Compared with state-of-the-art network fuzzers, SNFuzz achieves higher coverage of gateway-managed states and systematically explores deep protocol paths that prior approaches fail to reach. Our evaluation identifies a high-severity denial-of-service vulnerability in EMQX, which has been reported to the developers. Beyond MQTT-SN, our findings highlight the importance of state-aware fuzzing for gateway-centric IoT protocols operating over stateless transports.

Crowdsourced navigation platforms infer congestion from GPS-derived telemetry, enabling real-time traffic estimation and control at city scale. However, because these systems rely on device-reported location traces, they are vulnerable to Sybil attacks, where an adversary injects fabricated "vehicles" and synthetic slowdowns using emulators, scripted clients, or device farms. Such attacks have been publicly demonstrated to create "ghost" cars and phantom congestion that distort the displayed traffic layer and influence routing decisions.

We propose using street cameras as a real-time validation layer for GPS-based traffic inference. Street cameras add an independent signal grounded in physical observation ("eyes on the road"), rather than device-reported telemetry alone. They also sit on a different attack surface than mobile devices: manipulating camera evidence targets physical infrastructure rather than the mobile client, and is often more expensive to scale than client-side Sybil injection. By cross-checking camera-observed vehicle activity against GPS-based mobile traces, camera feeds provide a conservative verification layer, and can be used to raise integrity alerts.

In this paper, we implement an end-to-end GPS-camera pipeline that (i) matches cameras to nearby road links, (ii) aligns and stabilizes the streams, (iii) scores mismatch using a residual-based detector to produce alerts, and (iv) extends coverage to blind spots using nearby intersections.

We evaluate the system using New York City DOT street cameras (200+ active in Manhattan) together with GPS-based traffic levels collected via the TomTom API. The pipeline achieves {91.5% detection} under a moderate injected attack (Δ=+0.05) and reaches ≅{99% detection} for stronger attacks. We further address blind spots: using only neighbors, we retain a high-load consensus signal in {96.68%} of Manhattan tested locations.

Digital license plates are increasingly being introduced as an option for motorists and fleet operators alike. Naturally, turning such an important identification device into a digitally controlled, internet-connected device opens up the possibility for abuse of such devices. In this paper, we introduce CIAplates, an attack created by combining physical adversarial attack generation and fast electrophoretic display (EPD) technology to turn commercially available digital license plates into a covert adversarial attack delivery vector for automated license plate recognition (ALPR) systems, showing that such abuse is indeed possible. We investigate, implement, and evaluate multiple adversarial attack generation methods on physical hardware, both in test bed and real-world conditions, achieving successful attacks against OpenALPR, Plate Recognizer, and Qwen3-VL while using less than 6.2% of the total plate area for perturbations, highlighting the plausibility of real-world attacks. Furthermore, we show that countermeasures to a CIAplates attack can be practically implemented, paving the way to further research and implementation of defenses in future systems.

Over the last fifteen years a steady stream of research results have identified significant cybersecurity issues in a range of automotive systems. This has included multiple remote takeover demonstrations on stock passenger vehicles - with adversarial control of drivetrain, brakes and steering systems among others. However, in spite of these results, there is little evidence of similar attacks "in the wild". In this talk, I'll explore why this discrepancy likely exists. In particular, we'll examine what makes cyberattacks attractive in some domains and not in others, and how this doctrine manifests in the automotive context in particular. We'll highlight the role that real-world adversarial "hacking" plays in the current automotive ecosystem and discuss what kinds of scenarios might change today's status quo.

The automotive industry is transitioning to software-defined architectures, making Over-the-Air (OTA) updates essential for managing the long-term lifecycles of modern vehicles, which often exceed a decade. Although Public Key Cryptography (PKC) currently secures these updates, it remains vulnerable to emerging quantum threats. While Post-Quantum Cryptography (PQC) is a feasible solution, its improper adoption in the automotive sector may lead to larger key storage requirements and higher computational costs, thereby hindering the security of resource-constrained devices. To address long-term deployment concerns and comply with vehicle software update requirements, we propose a quantum-safe authentication protocol to deliver software OTA updates securely over the vehicle-to-cloud (V2C) link. Our protocol employs Leighton-Micali Signatures (LMS) for Original Equipment Manufacturer (OEM) server identification and the Module-Lattice-Based Key-Encapsulation Mechanism (ML-KEM) to establish session keys for OTA updates. To mitigate server-side bottlenecks in bursty-request scenarios, we introduce a one-time ticket-gating approach that filters out invalid requests, preventing flooding or DoS attacks against the OEM server. Security analysis demonstrates that our protocol preserves authenticity, confidentiality, integrity, and anti-rollback properties while resisting critical threats, including replay and quantum attacks. Comprehensive performance results show that it achieves more security traits with adequate functional overhead compared to existing works in the context of automotive systems.

Vehicular networks rely on embedded devices (Electronic Control Units (ECUs), CAN bus nodes, and sensor modules) that communicate via digital ON/OFF switching signals. A compromised or counterfeit device that passes cryptographic checks poses a critical threat to vehicle safety. We present a hardware fingerprinting framework that authenticates embedded devices by analyzing the intrinsic analog characteristics of their digital switching behavior. The key insight is that every digital transition (a CAN bus bit transition, an ECU command pulse, a GPIO toggle) forces hardware through abrupt state changes where manufacturing variations in output drivers, clock sources, and passive components become observable as device-specific imperfections. We extract 211 features from captured waveforms and propose a hybrid classification strategy combining a cycle-based Random Forest (Approach A) and an OVA stacked ensemble (Approach B), achieving 99.5% real-time accuracy under controlled mounting conditions (93.6% without) and 100% device type accuracy across 8 devices spanning 4 hardware types, including same-model clone pairs. We demonstrate this framework on embedded development platforms as a proof-of-concept step toward automotive ECU authentication, laying the groundwork for physical-layer authentication in CAN bus and ECU security contexts, subject to validation on automotive hardware.

Autonomous vehicles must remain safe and effective when encountering rare long-tailed scenarios or cyber–physical intrusions during driving. We propose a risk-aware human-in-the-loop framework, RAIL, that explicitly closes the detect–respond–learn loop within a unified runtime architecture. RAIL introduces an interpretable Intrusion Risk Index (IRI) that fuses heterogeneous runtime cues, including curvature actuation integrity, time-to-collision proximity, and observation-shift consistency, through a weighted Noisy-OR to enable probabilistic, source-decomposed risk quantification at control rate. When risk rises, a contextual bandit selects cue-specific shields and a graded authority blending mechanism interpolates between nominal and safeguarded actions, preserving efficiency under low risk while enabling proactive containment under threat. RAIL further integrates dual reward shaping and risk-prioritized replay so that takeovers and near misses steer learning. Across MetaDrive and CARLA, RAIL matches expert-level success while reducing safety violations and operator interventions relative to RL, safe RL, offline and imitation baselines. Under Controller Area Network (CAN) injection and LiDAR spoofing, RAIL reduces attack success rates by up to 48% and lowers disengagement under attack by more than 50%, demonstrating that explicit multi-source risk modeling yields substantial robustness gains in safety-critical autonomy.