Permissions & components
Dangerous permissions granted to shell, exposed activities and services, and the SELinux posture of the device.
Engine · Infotainment
The screen is an attack surface too.
Modern infotainment runs Android, with apps, permissions and services like any device. AutoST connects over ADB and runs a full hardening assessment of the head unit.
In short
The IVI engine assesses Android infotainment units over ADB. It performs recon of packages, permissions, exposed components, pullable files and SELinux posture, runs static analysis of APKs (manifest flags and secret scanning), and can run functional tests with screenshots and live logcat streaming. Findings are grouped by severity with per-finding remediation and flow into the shared fix plan.
What it assesses
A full head-unit hardening check
Pullable files
System and app files that can be pulled off the device, a common path to secrets and sensitive data.
APK static analysis
Manifest flags and secret scanning across installed APKs, to catch debuggable builds and hard-coded credentials.
Functional & logcat
Functional tests with screenshots and live logcat streaming, so you see the device as it runs.
FAQ
Frequently asked questions
How does AutoST connect to the IVI?
Over ADB, the Android Debug Bridge, to a head unit or an emulator. From there it enumerates packages, permissions, components and files.
Does it just list issues?
No. Each finding comes with remediation, and all of them flow into the shared fix plan alongside the UDS, DoIP and SOME/IP findings.
See it on your ECU
Run AutoST on your own ECU
In one hour we scope a pilot: your bench, your protocols, the targets and what success looks like.
- A concrete test plan for your setup
- Works on CAN, CAN FD, DoIP and SOME/IP
- NDA on request before we start
Your demo is withTom ZaubermannFounder of Zyberum, ex-lead of the VW InCar Security Testing Lab
Already trusted by Tier 1, Tier 2 suppliers and OEMs. References on request.
Or send us a message
We reply within one business day.