Connected Cars Are The New Attack Vector

Smart devices are connecting to just about everything that runs on electricity to the Internet. However often these devices are not very cyber secure. These smart devices are often dispatched with outdated and inadequate security measures. This creates all sorts of new avenues for cyber-attacks, and one of the most concerning is attacks on smart vehicles. 

While a hack of a home smart device might lead to nothing more than an invasion of privacy or a botnet attack, hacks of connected cars could be used for terrorism and assassinations.

Are Cyber-Attacks on Connected Cars an Inevitability?
A new report from Los Angeles-based group Consumer Watchdog helps to bring the threat to connected cars into focus.
The problem is tied into one that is endemic with smart devices – they tend to ship with inadequate security. Sometimes they are properly secured from the beginning. In other cases, there is no way to patch their firmware once a vulnerability develops.
One would think that something that could be weaponized in the way a vehicle can would have more of a security focus, but the new report makes clear that is not the case. 

The report, which bears the grim but appropriate name “Kill Switch”, consulted with engineers and technologists in the automotive industry for five months to assess how vulnerable the average vehicle is to hacking. Bear in mind that the study focuses on the tens of millions of standard vehicles currently operating on American highways, not self-driving cars.

The worrying central finding is that the majority of the 2020 line of vehicles from the top 10 auto manufacturers will be connected to the Internet and will also be vulnerable to cyber-attacks. Most of these vehicles are about to go on the market in the fall.

Current and Future Threats
At present, there are about 50 million vehicles in the United States that have Internet connectivity. That’s about 20% of all vehicles on the road. That percentage will sharply increase starting with the 2020 model year due to a commitment by all of the major manufacturers to add connectivity features to many new models going forward. 

Ford, GM and Toyota plan to have all of their vehicles connected to the Internet starting with this upcoming model year. That would mean about 17 million new “connected cars” on American roads each year.

The report has a particular focus on the potential mass cyber-attacks. When an exploit is discovered in one vehicle type, or perhaps even in one manufacturer’s software that is deployed through many of their models, it could be used to quickly gain control of millions of vehicles.

There is a potential threat to all aspects of the vehicle. Acceleration could be ramped up remotely, and brakes could be disabled or engaged suddenly. It is even possible for steering to be controlled remotely under the right circumstances. The window and door locks could also be engaged by an attacker.

The main vulnerability cited by the report is the “head” system of these vehicles, which is primarily used for infotainment systems, GPS navigation and various “creature comfort” features linked to smart phone control. 
Though they are screening these risks from the public, industry executives have acknowledged them as “high” and “difficult to detect” in mandatory disclosures to investors. 

Some expert hackers consulted for the report said that “time and money” were the only barriers to compromising connected cars. In addition to the vulnerable head units, there is concern about the software being used at the core of the various automotive systems. Manufacturers often contract this software from third parties, and some of it is based on open-source systems with little method of holding authors accountable and unknown security risks.

Cars can be Killing Machines
The report projects that if a “fleet-wide” attack were to occur, 3.75 million connected cars would be infected and over a quarter of a million drivers could be on the road at the time of the attack. This would lead to over 130,000 injuries and 3,000 deaths. The estimated death toll would be slightly greater than that of the September 11 attacks, making this a valid national security concern.

So what can be done about connected Car Hacks?
Consumer Watchdog suggested one immediate measure to guard against cyber-attacks on connected cars, the mandatory installation of a manual “kill switch”, estimated to cost about 50 cents per vehicle, that would entirely disconnect the car from the Internet and any local networks when engaged. 

In addition to disabling remote control of the car, this would allow for quicker national recovery in the wake of a fleet attack that leaves the safety status of a manufacturer’s connected cars in doubt for an extended period.
Additionally, the report recommends that CEOs should sign formal statements accepting legal liability for the cyber security status of their connected cars and that the industry should adopt an agreement to not connect vehicles to wide-area networks until their security is proven against cyber-attacks.

UK Government is offering £2m to boost Cyber Security for Driverless Vehicles 
Now the Government’s innovation agency Innovate UK and the Centre for Connected and Autonomous Vehicles, CCAV, are offering £2m for projects working on cyber security for driverless vehicles.The money will be available for up to five projects, which can involve public sector or academic bodies, in the development of a testing facility.

Innovate UK said any proposals for support should involve ways to measure resilience and maintain cyber security for roadside infrastructure, vehicles and supporting services.

Projects should also provide input specifications for one or more new cyber test facilities and explore opportunities to develop new services. Successful proposals will lead to funding up to £400,000 for project costs, with public authorities or academic institutions eligible to share up to 50%. The competition will be open for applications until 25 September.

CPO Magazine:        PlaceTech

You Might Also Read: 

BMW Cars Can He Hacked:

Cybersecurity In Self-Driving Cars:

US And France To Permit Fully Driverless Cars On Public Roads:

 

 


 

 

« Foreign Cyber Intrusions On The USA
Home Working Can Often Be A Security Threat »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

LockLizard

LockLizard

Locklizard provides PDF DRM software that protects PDF documents from unauthorized access and misuse. Share and sell documents securely - prevent document leakage, sharing and piracy.

DigitalStakeout

DigitalStakeout

DigitalStakeout enables cyber security professionals to reduce cyber risk to their organization with proactive security solutions, providing immediate improvement in security posture and ROI.

Authentic8

Authentic8

Authentic8 transforms how organizations secure and control the use of the web with Silo, its patented cloud browser.

Clayden Law

Clayden Law

Clayden Law advise global businesses that buy and sell technology products and services. We are experts in information technology, data privacy and cybersecurity law.

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

CERT.at

CERT.at

CERT.at is the Austrian national Computer Emergency Response Team.

Systancia

Systancia

Systancia offer solutions for the virtualization of applications and VDI, external access security, Privileged Access Management (PAM), Single Sign-On (SSO) and Identity and Access Management (IAM).

Auth0

Auth0

Auth0 is a cloud service that provides a set of unified APIs and tools that instantly enables single sign-on and user management for any application, API or IoT device.

Fair Isaac Corporation (FICO)

Fair Isaac Corporation (FICO)

FICO provides analytics software and tools used across multiple industries to manage risk, fight fraud, optimize operations and meet strict government regulations.

Cynerio

Cynerio

Cynerio develops cybersecurity protections for medical devices, comparing network behavior with a database of medical workflows.

First Point Group (FPG)

First Point Group (FPG)

First Point Group provide a global technological recruitment service worldwide. Within that we have a specialist team of Cyber Security recruiters.

Elevate Security

Elevate Security

Elevate is the leading Security Behavior Platform, changing employee security habits while giving security teams unprecedented visibility.

Kindus

Kindus

Kindus is an IT security, assurance and cyber security risk management consultancy.

CYMOTIVE Technologies

CYMOTIVE Technologies

Combining Israeli cyber innovation with a century of German automotive engineering. CYMOTIVE operates under the assumption that connectivity is a game changer for the automotive industry.

NANO Corp

NANO Corp

At NANO Corp, we keep your network visible, understandable, operational and secure with state-of-the-art technology.

Protos Labs

Protos Labs

Protos Labs enables insurers & enterprises to make better cyber risk decisions through holistic, real-time risk management tools.

ARC Risk and Compliance

ARC Risk and Compliance

ARC Risk and Compliance is a consulting company comprised of a team of AML Specialists completely focused on anti-money laundering compliance and the technologies used to support compliance programs.

SPIE Switzerland

SPIE Switzerland

SPIE Switzerland AG, a subsidiary of the SPIE Group, is a Swiss full-service provider of ICT, multi-technical and integral facility services.

Deloitte Denmark

Deloitte Denmark

Swift incident management, worldwide support, and advanced defense strategies ensure comprehensive recovery and enterprise security with our IR service.

OrbiSky Systems

OrbiSky Systems

OrbiSky Systems is a British tech startup specializing in data management and cybersecurity solutions.

Harness

Harness

Harness delivers an end-to-end software delivery platform that helps engineering teams achieve the highest levels of engineering excellence.