US Carmakers Want Hackers To Help Them Improve Cybesecurity

Today's automobile is rapidly becoming a computer on wheels, with more micro-processing power than can be found in a typical home or office. 

It's not uncommon for a modern vehicle to use more than 100 million lines of code to control everything from the engine management system to the onboard infotainment technology. By comparison, there are about 8 million lines of code on the latest F-35 fighter jet.

Until recently, hackers tended to focus on desktop and laptop computers and, more recently, smartphones and tablets. But there are growing indications the "black hat" world of what's known as the "dark internet" is shifting attention to automotive targets.

When police in Houston, Texas, recently began reporting a series of unexplained robberies, the only apparent clue was a security camera video showing one of the thieves pulling out a laptop computer after breaking into the vehicle. After tapping on the keys for a few moments, the Jeep Wrangler's engine fired up and the thieves drove away.

There has long been fear that someone might find a high-tech way to break into vehicles. And just a year earlier, a pair of so-called "white hat" hackers had shown how they could remotely take control of a Jeep, demonstrating that by driving it into a ditch.

Hacking has become one of the auto industry's biggest concerns, especially as modern cars add more and electronic controls and infotainment systems. With a major cybersecurity conference scheduled for this coming week in Detroit, Jeep parent Fiat Chrysler Automobiles has taken one step to fight back, announcing a "bug bounty" for hackers who can find and help it patch vulnerabilities in its vehicles' software.

"The idea is to go out to the hacker community itself and ask for help," explained Casey Ellis, CEO and founder of Bugcrowd, a San Francisco-based collective that can draw on their knowledge and efforts of an estimated 32,000 hackers around the world. "Crowdsourcing is very effective when applied to this sort of problem."

It's not uncommon for a modern vehicle to use more than 100 million lines of code. By comparison, there are about 8 million lines of code on the latest F-35 fighter jet.

So far, most of the reported incidents have been the result of security experts uncovering vehicle vulnerabilities. That has led to recalls by a number of manufacturers including FCA and BMW, with Nissan shutting down a smartphone app used to control the Leaf battery-car because of potential problems.

The issue of cybersecurity "is real, critical, and here to stay," warned Ellis, whose firm tries to harness hacker skills for good - but who admits one of the challenges is not opening the door for "black hat" hackers to find new ways to crack into vehicle software code.

The concern in Houston is that thieves might have found a way to pair their own electronic car keys with the digital engine control systems in the vehicles they target.

And the situation is only getting worse, said Saar Dickman, an executive with Harman International, the multinational electronics firm and CEO of TowerSec, the Israeli firm he founded that is considered a leader in vehicle electronic security. 

He and other experts point to a number of potential concerns:

Hackers could take control of a vehicle remotely, shutting the vehicle down or causing steering or brakes to fail

That would become even more of a risk as automakers launch the first self-driving vehicles

That might even allow hackers to kidnap or kill motorists by programming in their own destinations

Personal data could become vulnerable, as has happened with smartphones, laptops and desktops.

In years past, hackers would have had to gain physical access to a vehicle, as seems to have been the case in Texas. But modern vehicles are adding a variety of wireless communications systems, such as onboard 4G LTE WiFi hot spots. Even the wireless tire pressure monitoring systems, or TPMS, required on all new vehicles, could give hackers a path into the vehicle, experts warn.

"You're providing more services and more access," said Dickman. "You want to embrace innovation, but you have to understand the risks that come with it."

Anti-viral software and other security systems have become the norm, whether on a cellphone or a corporate computer network, but vehicles provide some peculiar challenges, both BugCrowd's Ellis and TowerSec's Dickman agree. Not only are there a variety of "mission critical" devices and numerous access points, but it's a challenge to set up anti-hacking systems that can be constantly updated to block newly discovered threats.

Tesla has built into its battery-electric vehicles a system that allows it to use over-the-air, or OTA, updates, and that is likely to become the norm, rather than the exception in years to come. OTA also allows automakers to correct defective software code without issuing recalls forcing customer to drive into showroom service bays.

Even over-the-air updates might not be enough, however. TowerSec and other cybersecurity firms are working on new approaches, unique to automobiles, that would automatically lock out suspect software and revert to the original, factory code, if something unusual begins to happen.

One way or the other, automakers say they will have to address the issue - and quickly. The more high-tech equipment they build into the vehicles, the bigger the risk of being hacked.

NBC

« Snowden iPhone Case Alerts Users To Surveillance
Ransomware: Should You Pay The Ransom? »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

Alvacomm

Alvacomm

Alvacomm offers holistic VIP cybersecurity services, providing comprehensive protection against cyber threats. Our solutions include risk assessment, threat detection, incident response.

Authentic8

Authentic8

Authentic8 transforms how organizations secure and control the use of the web with Silo, its patented cloud browser.

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

Perimeter 81 / How to Select the Right ZTNA Solution

Perimeter 81 / How to Select the Right ZTNA Solution

Gartner insights into How to Select the Right ZTNA offering. Download this FREE report for a limited time only.

VisionWare

VisionWare

VisionWare provide consulting services and solutions in areas covering both physical and digital security.

Graphus

Graphus

Graphus provides a simple, powerful, automated solution that eliminates 99% of social engineering and spear phishing attacks against G Suite business Gmail users.

Shift Technology

Shift Technology

Shift Technology provides insurance companies with an innovative SaaS solution to improve and scale fraud detection.

Spanish Network of Excellence on Cybersecurity Research (RENIC)

Spanish Network of Excellence on Cybersecurity Research (RENIC)

RENIC is a membership based sectoral association that includes research centers and other agents of the research cybersecurity ecosystem in Spain.

Totaljobs

Totaljobs

Totaljobs is the UK’s largest hiring platform. We have over 280,000 live jobs adverts on our site, helping you to find any type of job in any industry, including cybersecurity.

Visium Technologies

Visium Technologies

Visium Analytics provides innovative data visualization, cybersecurity technologies and solutions to businesses to protect and secure their data assets.

CoverWallet

CoverWallet

CoverWallet combines deep analytics, thoughtful design and state of the art technology to help small businesses with all their insurance needs including Cyber Liability.

Collins Aerospace

Collins Aerospace

Collins Aerospace provides cybersecurity services and systems to protect critical infrastructure facilities and railroad operations.

NuID

NuID

NuID is a pioneer in trustless authentication and decentralized digital identity.

CyberSheath Services International

CyberSheath Services International

CyberSheath integrates your compliance and threat mitigation efforts and eliminates redundant security practices that don’t improve and in fact might probably weaken your security posture.

Rostelecom Solar

Rostelecom Solar

Rostelecom-Solar is a Cyber Security Company, providing software and managed detection and response (MDR) services to protect critical information from advanced cyber threats.

UST

UST

UST is a global provider of digital technology and transformation, IT services and solutions including managed security services.

Numen Cyber Technology

Numen Cyber Technology

Numen Cyber Technology is committed to becoming a Threat Discovery and Response expert for corporate customers.

Performance Technologies

Performance Technologies

As a leading IT Solutions Provider in Greece, Performance Technologies delivers reliable, long life solutions, ensuring continuous availability of business-critical services and information.

Xcelerate Solutions

Xcelerate Solutions

Xcelerate Solutions is a leading defense and national security company, providing integrated solutions in three service areas – Enterprise Security, Digital Transformation, and Strategic Consulting.

Metrics that Matter (MTM)

Metrics that Matter (MTM)

Metrics that Matter redefines how organizations approach cybersecurity by offering unprecedented insight into the value of their assets to criminals and tailored action plans to protect.