Speaker
Description
The industry increasingly adopts Linux for automotive and industrial use cases, since companies like Red Hat or Canonical engaged in development of Linux platforms in safety-critical domains. Using container technologies or just a bootable images on restricted silicon, now software operates cyber-physical processes. Those platforms are often cloud-connected because of maintainability, attracting new threat actors to that domain. Defenses in this area are limited, because of blind spots in endpoint protection solutions regarding electronics.
The missing integrations can be found in non-IP bus systems, such as the CAN bus as well as on-board interfaces to flash chips, FPGA or the protocols themselves like SPI or I2C. While less common in the IT world those missing capabilities are missing out in comprehensive observability resulting in unnoticed cyber attacks against IOT platforms.
This talk showcases the use of eBPF for protocols like CAN, DMA and SPI to create observability as well as defenses against cyber attacks in automotive or industrial contexts, such as secure updates, injection attacks and non-IP filters.