Kamel Ghali: Hack the Fleet — Inside DEF CON's Car Hacking Village

So you just mentioned that you are teaching a course.

So is that at DEF CON or is that just something separate after? Yes, that is at DEF CON.

So you're probably familiar, a lot of cybersecurity conferences and events, they'll have like a conference where they have presentations, talks, workshops, sponsor booths, etc.

And then cybersecurity training as well.

So the cybersecurity training is usually more hands on, it's usually kind of a separate ticket, you have to pay separately for the training and for the conference.

where you'll have an instructor who teaches you, you know, an intensive two-day class about something, right? A lot of conferences will have the training days before the conference.

DEF CON, I think, is a bit rare in that they do the conference first and then they have the training afterwards.

So...

I think it's just a byproduct of how cramped Hacker Summer Camp is, that whole kind of week or so of cybersecurity activities in Las Vegas with Black Hat and B-Sides and, excuse me, and DEF CON.

But yeah, the training at DEF CON, it's the official DEF CON training.

I'll be delivering a car hacking masterclass.

So I'm very excited for it.

I'm going to be looking at a lot of A lot of different parts of the automotive, you know, security ecosystem.

So vehicles themselves, connected infrastructure like EV chargers, so on and so forth.

Nice.

So do you actually bring like ECUs in and set them up for, you know, training? Like what does the course look like curriculum wise? And like who are you trying to attract? Is it the hackers? Is it the professional cybersecurity engineers that work at the Ford and GM and the big OEMs? Or kind of what are you targeting there? Great question.

So I'm actually going to pull up my course listing and kind of just like make sure I don't misquote myself on the actual content in there.

But the idea is, is that it's, I'm trying to make a class that's valuable for everyone.

So not only the engineers and the hackers, we're going to be do the actual, we're going to do a lot of the hands on technical security work, the penetration testing, the hacking, of course, there's a lot of valuable content for them, a lot of hands on technical engineering exercises.

But there's a lot of content that's also relevant for the manager, or the, excuse me, executive class as well, right? So it kind of takes a walk through the overall automotive cybersecurity industry, explaining the history of the industry, how we got here, what we're doing, and then going into a couple of really in-depth case studies on past exploits that have been published targeting automotive systems.

And

then

from there, yeah.

And then from there, we go into just a tiny bit of like the regulations and stuff that are surrounding automotive cybersecurity.

And not only for cars, but there's a lot of regulations that are kind of mimicking the automotive security legislative structure that's being applied to other smart products like IoT devices, so on and so forth.