Automobiles today have powerful computers interacting with one another, receiving volumes of data from a complex network of sensors. As the industry is moving to more automated driving, more powerful computers are added to the mix for real time vision processing.
Multiple computer systems, like any system, have unexplored vulnerabilities that can be exploited. In BlackHat 2015, security researchers demonstrated the remote exploitation of vulnerabilities in vehicles’ computer systems.
>See also: Connected car security: why identity should be in the driving seat
From inside of their homes, researchers were easily able to remotely disable the braking systems and stop the engine while the vehicle was travelling full speed on a highway thousands of miles away.
This resulted in a voluntary recall, National Highway Traffic Safety Administration (NHTSA) Recall Campaign Number 15V461000, of 1.4 million vehicles and served as a wakeup call for the automotive industry.
Today, auto manufacturers are beginning to pay more attention to cybersecurity risks in automotive software design, partitioning, and separation of components to make it harder for adversaries attacking and gaining control of key subsystems.
Another NHTSA report, Cybersecurity best practices for modern vehicles (Report No. DOT HS 812 333), provides general cybersecurity guidelines for the automotive industry.
The key elements include layered approaches for risk mitigation, guidelines for avoiding hard coded encryption keys, proper methods for preserving privacy, secure system update recommendations, and limiting exposure to ECU (Electronic Control Unit) parts of any car.
>See also: Securing the connected car in the digital age
Modern cars are equipped with sophisticated sensors, cameras, and radar systems that process terabytes of data daily (Giga Bytes of data per minute) to implement new safety features, such as Pedestrian Detection and Avoidance, Lane Tracking, Adaptive Cruse Control, Collision Mitigation & Breaking, Road Departure Tracking, and Blind Spot detection.
Sophisticated vision systems and sensor networks in cars are vulnerable to external and environmental effects on the sensors, cameras, and radar systems. Recent research reveals attackers can easily confuse such sophisticated detection systems used in current and future automobiles by simply using a few small stickers on a stop sign to make a car “think” the stop sign is a 45 mph speed limit sign.
With seemingly small alterations having the potential to drastically change the recognition processes of automotive systems, adversaries can effortlessly launch attacks on autonomous and semi-autonomous vehicles.
Simpler, yet very effective attacks are seen in cars’ keyless entry systems. Researchers were not only able to gain access to the cars using radio-based tools, but could also start the engine and drive the car.
The attack involved copying and impersonating the original key fob signal using off-the-shelf radio devices. The effected number of vehicles were staggering, 24 car models from 19 different car manufacturers including luxury models.
>See also: The present and future of connected car data
As vehicles become more sophisticated, and as smart roads and cars are able to communicate to each other to improve predictive driving (avoiding traffic jams, announcing accidents ahead), standards known as Vehicle-to-Vehicle (V2V) and Vehicle-to-Infrastructure (V21) communication have emerged.
In December 2016, NHTSA proposed a rule that would mandate V2V communication, allowing cars to ‘talk’ to each other to avoid crashes. Both V2V and V2I communications require strong trust mechanisms.
By 2020, according to some predictions, there will be over 250 million cars on the roads globally. With each car having an average of 200 complex sensors and networks of processors consuming data, security and privacy standards have become increasingly essential to the success of connected cars, regardless of the vehicles’ autonomy.
Privacy is a major concern in V2V and V2I systems. While each vehicle communicates with other vehicles or to surrounding infrastructure (such as roads or signs), the drivers’ privacy will be compromised if proper measures and protections are not in place.
According to AppGuard, the endpoint cyber security software company, maintaining trust and yet preserving privacy has become a major challenge in V2V and V2I protocols, a challenge that has become an emerging field in the future of autonomous and semi-autonomous driving cars in order to maintain security for safety and preserving driver’s privacy.
>See also: How cyber attackers will shift gear once connected cars hit the road
AppGuard developed the Trustica™ platform to deliver essential safety, security, and privacy for the automotive industry and the IoT world.
Connected cars are sophisticated computer systems on wheels with fully capable Wi-Fi, 4G communication. Cars today communicate with driver’s mobile devices. The infotainment systems “talking” with Apple and Android phones connect over Bluetooth to driver phones and have full access to drivers’ contact lists, e-mails, SMS messages and their Web Browser history.
Such information is cached in infotainment systems and can be easily accessible to adversaries in valet parking scenarios, or to those gaining access to the car by other means, or through a vulnerability in the Wi-Fi system connected to infotainment, exposing the user’s private information to the outside world.
NHTSA Cybersecurity best practices for modern vehicles report provides that general cybersecurity guidelines for the automotive industry is just a beginning. However, how well such recommendations will be observed is dependent on the manufacturer.
Unlike traditional cybersecurity practices, security and privacy in automotive driving has significant safety consequences. Today’s mobile phones and tablets are already equipped with the protocol adopted for V2I/V2V Dedicated Short Range Communications (DSRC), which is a two-way short-to-medium-range wireless communications protocol that enables very high data transmission critical in communications-based active safety applications.
Mobile phones and vehicles, when enabled, can easily inform of approaching vehicle and activate the vehicle’s pedestrian collision prevention system, also known as Vehicle-to-Pedestrian (V2P) communication.
>See also: Connected cars ‘are not are not ready to withstand malware attacks’
AppGuard believes that without trust and anonymity in place to preserve the privacy of the pedestrian, DSRC’s same life serving technology can be used as a ‘weapon’ against a known pedestrian for nefarious reasons.
That is why a platform like Trustica™ enables anonymity of vehicles and cars, yet delivers trusted identities to avoid adversaries’ attempts to abuse the trust, compromise privacy, and attack systems with spoofed identities to compromise safety of the underlying V2V/V2P/V2I premises.
Cyber security and the preservation of privacy and information about the drivers and pedestrians in the new brave connected world has utmost safety implications that cannot be taken lightly.
NHTSA’s Cybersecurity best practices for modern vehicles report and frameworks like Trustica™ that establish and manage trust, security, and privacy for safety are the only ways to create the much-needed security and privacy substrate for delivering protection in an increasingly connected and automated world.
Sourced from Mike Fumai, COO and president of AppGuard
