# Audit and retrospective of an automotive application: Carplay — Etienne CHARRON, Khadim

**URL:** <https://discourse.ossbase.org/t/audit-and-retrospective-of-an-automotive-application-carplay-etienne-charron-khadim/667>\
**Category:** 2025 talks / workshops\
**Tags:** 2025, talk, hacklu\
**Created:** [August 26, 2025, 8:55am UTC](https://discourse.ossbase.org/t/audit-and-retrospective-of-an-automotive-application-carplay-etienne-charron-khadim/667 "2025-08-26T08:55:40Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![system](https://discourse.ossbase.org/uploads/default/original/1X/4713f3d4fec85f7513775fc2dd36f548a49f8faa.jpeg) [@system](https://discourse.ossbase.org/u/system)\
**Post date:** [August 26, 2025, 8:55am UTC](https://discourse.ossbase.org/t/audit-and-retrospective-of-an-automotive-application-carplay-etienne-charron-khadim/667/1 "2025-08-26T08:55:41Z")

</div>

**Join us at hack.lu 2025 — [Info & Registration](https://2025.hack.lu/info/)**

**Duration:** 30 min  
  
**Type:** Talk  
  
**Speakers:** Etienne CHARRON, Khadim

**Abstract**

In this presentation, we share the methodology used during a security audit of the Carplay application. This application exposes services to external car interfaces through Bluetooth and Wi-Fi. **Our work focused on identifying vulnerabilities that could lead to compromise the multimedia equipment, by an attacker already connected to the car’s Wi-Fi hotspot.**

During this analysis, we present how we identified the function responsible for parsing external data sent to the car, how we fuzzed it and discovered a bug already known by Apple (CVE 2023-23494).

**Description**

Vehicle security is essential due to their longevity and the potential impacts on the physical integrity of their users.

The In-Vehicle Infotainment (IVI) System is an interesting target for an attacker looking for initial access through remote interfaces such as Bluetooth or Wi-Fi. The Carplay application uses Wi-Fi, to allow a user to access iPhone’s services from the IVI (navigation, phone calls, third-party applications such as Spotify…)

Developed by Apple, the application’s source code is not publicly available, and few security analyses have been conducted on it.

In this presentation, we share the methodology used during a security audit of the Carplay application. Our work focused on identifying vulnerabilities that could lead to the compromise of the multimedia equipment, by an attacker already connected to the car’s Wi-Fi hotspot.

During this analysis, we present how we identified the function responsible for parsing external data sent to the car, how we fuzzed it and discovered a bug already known by Apple (CVE 2023-23494).

[View on pretalx](https://pretalx.com/hack-lu-2025/talk/LPVDSH/)