> Markdown version of [/videos/1119-a-hitchhikers-guide-to-container-security-automotive-edition-2024?t=717](https://www.wearedevelopers.com/videos/1119-a-hitchhikers-guide-to-container-security-automotive-edition-2024?t=717). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# A Hitchhikers Guide to Container Security - Automotive Edition 2024

Can a compromised software container hijack a car's physical hardware? Watch a live instrument cluster hack. Then, discover how eBPF acts as both a defensive shield and stealthy threat.

- **Speakers:** [Reinhard](https://www.wearedevelopers.com/@reinhard)
- **Event:** World Congress 2024
- **Published:** August 20, 2024
- **Duration:** 21:49
- **URL:** https://www.wearedevelopers.com/videos/1119-a-hitchhikers-guide-to-container-security-automotive-edition-2024

## Summary

The presentation explores the evolution of automotive cybersecurity, contrasting infamous remote vehicle hacks with the industry's modern shift toward centralized High Performance Computers (HPCs). As manufacturers adopt cloud-native paradigms to run software within containers on embedded systems, the risk of an attacker pivoting from internet-facing infotainment units to critical physical networks persists. A live demonstration reveals how a compromised container can bypass traditional virtualization boundaries to directly manipulate physical hardware, such as an instrument cluster, via the vehicular communication network.

To mitigate these embedded computing risks, Extended Berkeley Packet Filter (EBPF) emerges as a critical defensive layer. Acting as an event-driven scripting engine for the Linux kernel, EBPF provides deep observability into automotive traffic without relying on resource-heavy sidecars. Security teams can deploy EBPF programs to monitor the local CAN network and dynamically block malicious firmware flashing attempts over hardware interfaces like the SPI bus. Crucially, these robust security policies can be enforced at the container level without needing to modify or restart the underlying application code.

While EBPF offers transformative embedded security capabilities, it also introduces sophisticated offensive vulnerabilities. Because EBPF operates directly in memory and modifies network packets on the fly, attackers can exploit it to deploy stealthy rootkits that manipulate real-time sensor data—such as engine RPMs—while leaving minimal trace on the system. Mastering both the defensive observability and the offensive potential of EBPF is essential for engineering resilient, software-defined vehicle architectures.

**Keywords:** automotive container security, embedded Linux virtualization, HPC vehicle architecture, remote vehicle exploitation, CAN bus manipulation, SPI bus monitoring, EBPF kernel tracing, sidecar-less observability, software-defined vehicles, EBPF rootkits, dynamic access control, vehicle network segmentation, infotainment system vulnerabilities, bare metal container runtime

## Chapters

1. **Analyzing past internet attacks on distributed vehicle systems** (00:00) — Early attacks leveraged command injection and port scanning to compromise independent electronic control units via infotainment networks.
1. **Overcoming physical wiring constraints in legacy automotive networks** (02:17) — Traditional vehicle architectures rely on deeply segmented networks of microcontrollers connected by complex wire harnesses.
1. **Centralizing vehicle networks with high performance computers** (04:56) — Modern automotive architectures adopt cloud-like centralized computing and operating systems to facilitate regulatory updates and virtualization.
1. **Deploying isolated container runtimes on embedded Linux systems** (06:45) — Running standard bare metal hypervisors and container orchestration engines introduces resource friction on constrained embedded chips.
1. **Injecting network messages directly from compromised container environments** (08:40) — Exposing physical hardware interfaces directly to Docker networks allows process environments to manipulate mission-critical systems like brakes and dashboard speedometers.
1. **Protecting hardware access controls using eBPF security hooks** (11:57) — Compiling secure byte code logic within the Linux kernel stops rogue system calls and network packets without altering local processes.
1. **Intercepting and filtering automotive network traffic with eBPF** (14:05) — Integrating standard cloud egress monitoring with embedded vehicle protocols enables software-defined networking oversight across local vehicle interfaces.
1. **Blocking unauthorized peripheral updates via SPI bus monitoring** (17:28) — Programming kernel-level listeners selectively drops volatile bus transactions before hardware flashing overwrites root device partitions.
1. **Uncovering stealthy offensive eBPF rootkits in critical infrastructure** (19:24) — Offensive kernel interventions manipulate memory states dynamically and suppress application tracing mechanisms while leaving little to no defensive footprint.

## Related Moments

- [Handling container constraints and fileless malware](https://www.wearedevelopers.com/videos/356-enhancing-workload-security-in-kubernetes) (from "Enhancing Workload Security in Kubernetes")
- [Ecosystem of tooling and future capabilities of eBPF](https://www.wearedevelopers.com/videos/1199-into-the-hive-of-ebpf) (from "Into the hive of eBPF!")
- [Introduction to eBPF as a secure virtual machine](https://www.wearedevelopers.com/videos/789-gentle-introduction-to-ebpf) (from "Gentle Introduction to eBPF")
- [Tackling functional complexity with localized vehicle electronic architectures](https://www.wearedevelopers.com/videos/258-on-developing-smartphones-on-wheels) (from "On developing smartphones on wheels")
- [Interfacing with core vehicle systems and handling software permissions](https://www.wearedevelopers.com/videos/499-for-the-cars-and-the-curious-android-drift) (from "For the Cars and the Curious: Android Drift")
- [Introduction to automotive security and digital forensics](https://www.wearedevelopers.com/videos/259-cyber-security-small-and-large) (from "Cyber Security: Small, and Large!")

## Related Articles

- [Walking Into The Era of Supply Chain Risks](https://www.wearedevelopers.com/magazine/106-walking-into-the-era-of-supply-chain-risks)
- [How software is steering vehicle technology](https://www.wearedevelopers.com/magazine/515-how-software-is-steering-vehicle-technology)
- [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing)
- [Dev Digest 138 - Are you secure about this?](https://www.wearedevelopers.com/magazine/486-dev-digest-138-are-you-secure-about-this)

## Related Jobs

- [Endpoint Security Engineer - OT](https://www.wearedevelopers.com/jobs/ext/1306782-endpoint-security-engineer-ot) at **ZEISS Group**
- [Penetration Tester / Red team Specialist](https://www.wearedevelopers.com/jobs/ext/293774-penetration-tester-red-team-specialist) at **Raiffeisen Bank International AG**
- [Endpoint Security Engineer - OT](https://www.wearedevelopers.com/jobs/ext/1998712-endpoint-security-engineer-ot) at **ZEISS Group**
- [Engineer, Offensive Security Organization](https://www.wearedevelopers.com/jobs/ext/1992296-engineer-offensive-security-organization) at **Twilio**
- [Endpoint Security Engineer](https://www.wearedevelopers.com/jobs/ext/1962698-endpoint-security-engineer) at **ZEISS Group**
- [Systems Engineer - Business Applications](https://www.wearedevelopers.com/jobs/ext/1358045-systems-engineer-business-applications) at **BWI GmbH**