X XFediYour place in the Fediverse
XFEDI

Remote profile

ActivityPub
Profile banner

Dávid Sámoczi

@[email protected]

Embedded & product security engineer — automotive (ISO/SAE 21434) and medical devices. TARA, pentest, hardware security, EU Cyber Resilience Act.
CISSP · Product Owner · Budapest, Hungary 🇭🇺
Opinions my own.

Open remote profile ↗
Posts

Australia is moving to adopt UN R155 and R156 as draft ADR 115 and ADR 116. Neither says where the back end that operates a connected fleet runs, who administers it, or under whose law it can be compelled. Fortify Labs: the drafts "still don't address where the back-end infrastructure is located, who has access to it, or who maintains it." Copying a UN regulation gets you type approval, not an answer to which jurisdiction holds your telemetry.

https://hvia.asn.au/call-for-impact-analysis-on-proposed-cyber-regs/

#infosec #UNR155 #AutomotiveSecurity #TypeApproval

Media attachment
Heavy Vehicle Industry AustraliaCall For Impact Analysis On Cyber Regs - Heavy Vehicle Industry AustraliaHVIA members have expressed support for harmonising Australian Design Rules with the current United Nations Regulations on Cyber Security and Software Update, but have raised concerns about significant compliance costs.
↩ Reply ♡ 0 · ↻ 0 ↗ Original

The GeNesys breach didn't touch a single vehicle. Attackers sat in a German dealer-management platform from 8 to 29 September and left with VINs, delivery dates, outstanding financing amounts, contact details and the salesperson's name. One dealer alone has identified 3,374 records. That's a pretexting kit, not a privacy incident - and it sits in a layer R155 and R156 don't reach: both bound a vehicle type, not a dealer's software vendor.

https://theautowire.com/2026/10/16/genesys-dealer-software-breach-germany-payment-fraud/

#infosec #AutomotiveSecurity #DataBreach #UNR155

Media attachment
The Auto WireHackers Spent Three Weeks in German Dealer Software and Walked Off With Buyers’ Delivery Dates and Loan AmountsA three-week hack of GeNesys dealer software in Germany exposed buyers' order numbers, delivery dates and loan amounts, the raw material for payment-redirect scams.
↩ Reply ♡ 0 · ↻ 0 ↗ Original