Ford & Reu: Attacks on Truck Diagnostic Adapters (VDA)
A DEF CON 31 talk on the security of Vehicle Diagnostics Adapters (VDA) — devices that connect to trucks via diagnostic ports to read data and update ECU firmware.
The researchers reverse engineered the device, extracted firmware via UART, and found that updates could be installed without signature verification — simply by sending firmware over USB or even Wi-Fi. This allows attackers to modify the adapter’s firmware and potentially interfere with ECU updates.
The talk also covers defensive approaches, such as removing unnecessary features (Wi-Fi, Bluetooth) directly from firmware to reduce the attack surface. The research was also adapted for educational use and automotive security CTF challenges.
The researchers reverse engineered the device, extracted firmware via UART, and found that updates could be installed without signature verification — simply by sending firmware over USB or even Wi-Fi. This allows attackers to modify the adapter’s firmware and potentially interfere with ECU updates.
The talk also covers defensive approaches, such as removing unnecessary features (Wi-Fi, Bluetooth) directly from firmware to reduce the attack surface. The research was also adapted for educational use and automotive security CTF challenges.