# Security-test your ECUs. Automatically.

> AutoST is an automated security testing platform for automotive ECUs, made by Zyberum GmbH in Germany. A test agent (Carbyne) connects to an ECU on the bench over CAN, CAN FD, DoIP or SOME/IP, while a web dashboard orchestrates the scans. It enumerates diagnostic sessions, services and data identifiers, imports ODX and CDD files to name DIDs and run routines, probes UDS SecurityAccess (0x27), fuzzes UDS and CAN, checks Android infotainment units over ADB, scores the risk and produces a ranked fix plan with PDF, SARIF, CSV and JSON output. It runs on your own servers or hosted by Zyberum and fits into CI/CD pipelines.

AutoST scans automotive ECUs for security weaknesses automatically: UDS, CAN, DoIP, SOME/IP and infotainment. Clear findings, a ranked fix plan and ISO/SAE 21434.

Source: https://auto-st.com/

AutoST connects to an ECU on your bench, maps its diagnostic surface, fuzzes it, checks its SecurityAccess and hands your team a ranked fix plan. The depth of a specialist, run by your own test engineers.

- 26+: UDS services scored per scan
- 4: transports: CAN, CAN FD, DoIP, SOME/IP
- ODX/CDD: import for DID names and routines
- SARIF: fix plan export for your tracker

## Three steps from bench to fix plan

No security specialists required. A test engineer wires it up and AutoST does the rest.

1. **1 · Connect** Define the ECU in the dashboard and pair the Carbyne agent on your bench. It talks CAN, CAN FD, DoIP and SOME/IP through a SocketCAN, Vector or Panda interface.
2. **2 · Scan** Pick the engines: enumeration, fuzzing, SecurityAccess, DoIP/SOME/IP, IVI. Upload an ODX or CDD file to name DIDs and drive routines. Watch progress live.
3. **3 · Fix** AutoST ranks every finding by risk, groups it into a fix plan with concrete remediation, and exports PDF evidence plus SARIF, CSV or JSON for your tracker.

## Every ECU, its risk and its last scan in one view

*AutoST dashboard listing ECU components with their risk level and security testing status*

Components grouped by project or vehicle line, each with a risk badge and the status of its last scan. Roles and groups keep teams and suppliers apart.

- Risk and last-scan status at a glance
- Groups per project, vehicle line or supplier
- Role-based access for teams and tenants

## One platform, every layer of the ECU

Each engine is a focused security test. Run one, or run them all and let the fix plan pull the findings together.

### UDS enumeration

Discovers diagnostic endpoints, sessions, every service and the readable DIDs, and flags the risky ones.

### DID & routine scanning

Imports ODX, PDX and CDD to name DIDs and call the right routines (0x31), with opt-in write-probing.

### SecurityAccess (0x27)

Tests seed randomness, weak seed/key algorithms, default keys, brute-force lockout and sequence enforcement.

### Fuzzing

Reproducible UDS and CAN fuzzing with live crash detection via TesterPresent and DTC monitoring.

### DoIP & SOME/IP

UDS over IP, DoIP routing activation and vehicle discovery, plus SOME/IP service and method mapping.

### Android IVI

Recon and hardening checks for Android infotainment over ADB: permissions, exposed components, SELinux.

## Findings become tasks your engineers can act on

*AutoST fix plan showing a ranked remediation task with what, risk and fix, plus CSV, SARIF and JSON export*

Every finding across every engine lands in one rehabilitation plan, ranked by severity. Each task says what was found, why it matters and how to fix it, with a workflow state and export to your ALM or PLM tracker.

- Severity-ranked, with what / risk / fix on every item
- List and Kanban views with assignees and status
- Export to CSV, SARIF 2.1.0 and JSON

## Specialist depth, without hiring specialists

### No pentest team needed

Your QA and test engineers run deep security tests. The hard-won knowledge is baked into the engines.

### Repeatable and automatable

Reproducible seeds, API tokens and a CI plugin mean the same scan runs on every build, not once a year.

### Your data stays yours

Run AutoST on your own servers or let us host it. Test results and reports belong to you.

## AutoST vs. the usual options

| | AutoST | Manual pentest | Home-grown scripts |
|---|---|---|---|
| Coverage of UDS, DoIP, SOME/IP, IVI | One platform, all of them | Depends on the tester | Whatever you had time to script |
| Repeatable on every build | Yes, via API and CI plugin | No, a point-in-time engagement | Only if you maintain them |
| Ranked fix plan with evidence | Built in, exportable | In the final report | You write it yourself |
| Runs without security specialists | Yes | No | Needs the author |

A pentest and AutoST work well together: use AutoST for broad, repeatable coverage and bring in specialists for the deep, creative work.

## FAQ

**What does AutoST test?**

AutoST tests automotive ECUs: it enumerates UDS diagnostics (sessions, services, DIDs), scans routines from ODX/CDD files, probes SecurityAccess (0x27), fuzzes UDS and CAN, tests DoIP and SOME/IP, and checks Android infotainment units over ADB. It scores the risk and produces a ranked fix plan.

**Do I need security experts to use it?**

No. AutoST is built so QA and test engineers can run deep security tests. You wire the ECU to the bench agent, pick the engines and read the results. The security knowledge is in the engines.

**What hardware and protocols are supported?**

CAN and CAN FD (ISO-TP), UDS (ISO 14229), XCP and CCP, DoIP (ISO 13400) and SOME/IP. The Carbyne bench agent runs on Windows and Linux and works with SocketCAN, Vector XL and comma.ai Panda interfaces.

**Can we run it on our own infrastructure?**

Yes. AutoST runs on your own servers as a container, or hosted by Zyberum. Test data and reports stay with you. It is multi-tenant with role-based access and groups.

**Does it fit into CI/CD?**

Yes. AutoST has long-lived API tokens and a CI plugin that triggers a scan, polls for the result, fails the build on findings and emits JSON, JUnit XML and a PDF. Any CI system can drive it through the REST API.

**Who makes AutoST?**

AutoST is built by Zyberum GmbH, an automotive security team in Hannover, Germany, founded by Tom Zaubermann, former lead of the InCar Security Testing Lab at Volkswagen AG.

---
AutoST by Zyberum. Canonical page: https://auto-st.com/