AutoRed is a vehicle security testing and research platform built to simulate modern automotive attack and defense scenarios.
The project combines:
- Multi-ECU vehicle simulation
- CAN bus communication
- Offensive security testing
- Intrusion detection and prevention
- Security monitoring
- Embedded software development
- Firmware reverse engineering
AutoRed was developed to demonstrate the skills commonly required for Automotive Security Engineering and Vehicle Software Red Team roles.
Simulated Electronic Control Units (ECUs):
- Engine ECU
- Door ECU
- Brake ECU
- Gateway ECU
Communication occurs over a virtual CAN network using SocketCAN (vcan0).
Inject malicious CAN messages onto the vehicle network.
Examples:
- Unauthorized door unlock commands
- ECU impersonation
- Malicious frame injection
Capture legitimate CAN traffic and replay it later.
Capabilities:
- Traffic capture
- Frame parsing
- Message replay
- Gateway detection
The Gateway ECU monitors CAN traffic and performs:
- Message inspection
- Threat detection
- Traffic filtering
- Security event generation
Detects:
- Excessive Door ECU activity
- Potential CAN spoofing attacks
- Replay attack behavior
Automatically:
- Blocks suspicious CAN traffic
- Records security events
- Escalates threat levels
Real-time dashboard built with Streamlit.
Displays:
- Vehicle telemetry
- Threat level
- Active alerts
- Attack type
- Blocked messages
- Security event timeline
The Engine ECU was implemented in C using Linux SocketCAN.
Technologies:
- C
- GCC
- Linux CAN Sockets
- SocketCAN
This demonstrates low-level automotive software development and CAN frame generation.
Created a vulnerable ECU firmware image and performed:
- Static analysis
- Symbol extraction
- Secret discovery
- Vulnerability assessment
Cross-compiled firmware for ARM using:
- arm-linux-gnueabi-gcc
Performed architecture comparison and firmware inspection.
Performed firmware reverse engineering using:
- Ghidra
- strings
- nm
Recovered:
main()process_input()unlock_doors()diagnostic_mode()
Identified:
- Hardcoded secrets
- Unsafe memory operations
- Dormant functionality
- Debug metadata exposure
+------------------+
| Engine ECU (C) |
+------------------+
|
+------------------+
| Door ECU |
+------------------+
|
+------------------+
| Brake ECU |
+------------------+
|
v
SocketCAN
vcan0
|
v
+------------------+
| Gateway ECU |
+------------------+
|
+-----------------+-----------------+
| |
v v
Intrusion Detection Intrusion Prevention
| |
+---------------+-------------------+
|
v
Security Logging
|
v
Streamlit Dashboard
- Python
- C
- CAN Bus
- SocketCAN
- vcan
- CAN Spoofing
- CAN Replay
- Threat Emulation
- IDS
- IPS
- Security Monitoring
- GCC
- ARM Cross Compilation
- Linux CAN Sockets
- Ghidra
- strings
- nm
- Streamlit
TESLA_DIAGNOSTIC_2026
An attacker extracting firmware could recover embedded secrets and potentially gain access to diagnostic functionality.
strcpy(buffer, user_input);Potential stack-based buffer overflow leading to memory corruption or arbitrary code execution.
Recovered functions:
unlock_doors()diagnostic_mode()
Hidden functionality increases attack surface and may expose undocumented capabilities.
Recovered:
- Function names
- Source file names
- Build information
Reduces reverse engineering effort and exposes implementation details.
This project demonstrates:
- Automotive Security
- Vehicle Network Security
- CAN Bus Analysis
- Embedded Software Development
- Firmware Reverse Engineering
- Red Team Methodologies
- Security Monitoring
- Intrusion Detection and Prevention
- ECU fuzzing
- CAN message authentication
- Secure OTA simulation
- UDS diagnostics
- Automotive threat modeling
- Hardware CAN integration
Samartha Suresh