> For the complete documentation index, see [llms.txt](https://niroh.gitbook.io/niroh/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://niroh.gitbook.io/niroh/conferences-speaking-and-community/decode-ph-2025-can-bus-basics-and-attacks.md).
# Decode PH 2025 - CAN Bus Basics and Attacks
**Event:** [DECODE PH 2025 - Automotive Cybersecurity by VicOne](https://www.facebook.com/share/p/1HGiP4o65B/), [LinkedIn - VicOne post](https://www.linkedin.com/posts/vicone-auto_decode-2025-vicone-automotive-security-activity-7369647993660055552-KR2a?utm_source=li_share\&utm_content=feedcontent\&utm_medium=g_dt_web\&utm_campaign=copy)\
**Event Date:** September 9, 2025\
**Role:** Speaker (with Aaron and the VicOne PH Team)\
**Topic:** Introduction to CAN Bus Basics and Attacks
Together with my colleagues from VicOne PH, I had the opportunity to speak at DECODE PH 2025 on a topic closely related to my day-to-day work: the Controller Area Network (CAN bus) and how it can be manipulated through injection attacks.
The talk was designed for individuals who are new to automotive security or simply curious about the field. We started with the fundamentals: what CAN Bus is, how Electronic Control Units (ECUs) communicate over it, and why a protocol designed in the 1980s, without built-in authentication or encryption, continues to operate in almost every modern vehicle on the road today.
From there, we explored CAN bus injection attacks, discussing how crafted or replayed frames can be used to influence vehicle behavior, and why these security concerns become increasingly important as vehicles become more connected and software-defined.
To make the concepts more tangible, we conducted two live demonstrations:
* **Instrument cluster demo** - demonstrating how injected CAN frames can directly manipulate what the driver sees, including speedometer readings and warning indicator behavior.
* **Live vehicle demo** - extending the same concepts to an actual vehicle, giving the audience a real-world view of how CAN injection attacks can affect a production environment beyond a bench setup.
The goal was not to provide an attack playbook, but to build intuition by helping the audience understand *why* automotive security matters and *how* accessible some of these concepts have become as vehicles evolve into interconnected networks of software-driven systems.
Special thanks to TrendMicro's DECODE PH organizers for providing the platform, and to everyone who attended and engaged with us during the session.
Instrument cluster responding to replayed CAN messages
Live CAN injection demonstration on a vehicle
Other Photos are uploaded here: [DECODE PH Facebook Page](https://www.facebook.com/share/p/1cmd3YCFvQ/)
