Securing vehicles and the systems around them, as an engineering discipline and as a compliance obligation. Coverage follows management systems and type approval under UNECE R155, the ISO/SAE 21434 process standard, vulnerability disclosure and incident reporting, and the horizontal EU rules now reaching the same software layer.
In the wiki: UNECE R155 · ISO/SAE 21434 · UNECE R156
A draft recommended national standard sets out what an in-vehicle intrusion detection system has to catch across the operating system, the external interfaces, the CAN and Ethernet buses and the off-vehicle links, and requires security logs to be kept for at least six months.
The Rome embedded-security company said it had raised $270 million at a $1.7 billion valuation, led by Headline and joined by the EIB Group and KfW Capital, naming vehicles among the machines it protects.
MOLIT, KATRI, KISA, the National Police Agency and Hyundai Motor ran a joint incident-response exercise built around malware distributed to vehicles from a compromised parts supplier's server.
TC260 published a security practice guide for cockpit data processing that bars cabin data from leaving the vehicle outside narrow exceptions and makes the carmaker responsible for what every in-car application collects.
Chinese outlets reported that the defunct carmaker's remaining entity told owners that paying third parties to crack and reflash their cars' infotainment systems counts as unauthorized modification, with consequences for warranty cover and possible criminal liability.
The transport ministry moved the September 1 application date to November 1 for vehicles already in production, citing earthquake damage to suppliers that left ordered cars unbuilt.
The revised Road Traffic Safety Law went out for public comment on August 28 with an official explanation that requires makers and importers of autonomous vehicles to guarantee network and data security, and bars exaggerated claims about self-driving functions.
A joint notice from MIIT and three sister ministries launched a one-year national inspection campaign that makes driver-assistance validation, cybersecurity and update logging conditions of market access.
A US federal advisory said a stack overflow in Bendix's EC80 commercial-vehicle brake controller can be used to run code and inject CAN traffic, and named replacement firmware for all eleven affected part numbers.
A draft mandatory national standard would require Chinese-market vehicles to use approved cryptography to verify software update packages, boot firmware in stages, and authenticate whoever writes calibration parameters through the diagnostic port.
Idaho National Laboratory is assessing whether Chinese-made lidar would create security risk if widely fitted to US vehicles, in a review reportedly funded by industry rather than government, according to TechCrunch.
Kaspersky published research on a campaign against Android head units in which the unit's own legitimate update component installed the payload.
The ministry put the approval draft of a security standard for the car-to-cloud link in vehicle-road cooperative systems out for public comment, at the head of a batch of 50 communications-industry standards.
Two Car Hacking Village sessions on August 9 described cloning a fob from a brute-forced rolling code, and operating a commercially available relay attack tool against a car.
The conference program scheduled a Car Hacking Village talk for August 8 whose abstract described reaching a production vehicle's internal network through a rogue DHCP server on its OBD Ethernet port.
An advisory published August 4 said KARR anti-theft systems used one Bluetooth authentication key across devices, letting anyone within radio range open the doors and stop the engine.
A European Commission factsheet published August 3 confirmed that reporting duties for actively exploited vulnerabilities and severe incidents begin on September 11, with part of the Data Act following a day later.
The cybersecurity and over-the-air updates task force will take up extending RXSWIN to UN R156 and pushing R155 duties down onto components and separate technical units.
Ministry inspectors spent two days at three Anhui automakers, randomly selecting sample vehicles and battery packs on site for national-standard compliance testing tied to production access.
PCA Cyber Security's Q2 threat report counted 345 unique automotive vulnerabilities, 161 of them high-severity — up from 75 the quarter before.
After a 9X owner lost vehicle functions for about 30 hours while traveling abroad, Zeekr promised an OTA-delivered switch for its cross-border restriction, off by default.