US Carmakers Want Hackers To Help Them Improve Cybesecurity

Today's automobile is rapidly becoming a computer on wheels, with more micro-processing power than can be found in a typical home or office. 

It's not uncommon for a modern vehicle to use more than 100 million lines of code to control everything from the engine management system to the onboard infotainment technology. By comparison, there are about 8 million lines of code on the latest F-35 fighter jet.

Until recently, hackers tended to focus on desktop and laptop computers and, more recently, smartphones and tablets. But there are growing indications the "black hat" world of what's known as the "dark internet" is shifting attention to automotive targets.

When police in Houston, Texas, recently began reporting a series of unexplained robberies, the only apparent clue was a security camera video showing one of the thieves pulling out a laptop computer after breaking into the vehicle. After tapping on the keys for a few moments, the Jeep Wrangler's engine fired up and the thieves drove away.

There has long been fear that someone might find a high-tech way to break into vehicles. And just a year earlier, a pair of so-called "white hat" hackers had shown how they could remotely take control of a Jeep, demonstrating that by driving it into a ditch.

Hacking has become one of the auto industry's biggest concerns, especially as modern cars add more and electronic controls and infotainment systems. With a major cybersecurity conference scheduled for this coming week in Detroit, Jeep parent Fiat Chrysler Automobiles has taken one step to fight back, announcing a "bug bounty" for hackers who can find and help it patch vulnerabilities in its vehicles' software.

"The idea is to go out to the hacker community itself and ask for help," explained Casey Ellis, CEO and founder of Bugcrowd, a San Francisco-based collective that can draw on their knowledge and efforts of an estimated 32,000 hackers around the world. "Crowdsourcing is very effective when applied to this sort of problem."

It's not uncommon for a modern vehicle to use more than 100 million lines of code. By comparison, there are about 8 million lines of code on the latest F-35 fighter jet.

So far, most of the reported incidents have been the result of security experts uncovering vehicle vulnerabilities. That has led to recalls by a number of manufacturers including FCA and BMW, with Nissan shutting down a smartphone app used to control the Leaf battery-car because of potential problems.

The issue of cybersecurity "is real, critical, and here to stay," warned Ellis, whose firm tries to harness hacker skills for good - but who admits one of the challenges is not opening the door for "black hat" hackers to find new ways to crack into vehicle software code.

The concern in Houston is that thieves might have found a way to pair their own electronic car keys with the digital engine control systems in the vehicles they target.

And the situation is only getting worse, said Saar Dickman, an executive with Harman International, the multinational electronics firm and CEO of TowerSec, the Israeli firm he founded that is considered a leader in vehicle electronic security. 

He and other experts point to a number of potential concerns:

Hackers could take control of a vehicle remotely, shutting the vehicle down or causing steering or brakes to fail

That would become even more of a risk as automakers launch the first self-driving vehicles

That might even allow hackers to kidnap or kill motorists by programming in their own destinations

Personal data could become vulnerable, as has happened with smartphones, laptops and desktops.

In years past, hackers would have had to gain physical access to a vehicle, as seems to have been the case in Texas. But modern vehicles are adding a variety of wireless communications systems, such as onboard 4G LTE WiFi hot spots. Even the wireless tire pressure monitoring systems, or TPMS, required on all new vehicles, could give hackers a path into the vehicle, experts warn.

"You're providing more services and more access," said Dickman. "You want to embrace innovation, but you have to understand the risks that come with it."

Anti-viral software and other security systems have become the norm, whether on a cellphone or a corporate computer network, but vehicles provide some peculiar challenges, both BugCrowd's Ellis and TowerSec's Dickman agree. Not only are there a variety of "mission critical" devices and numerous access points, but it's a challenge to set up anti-hacking systems that can be constantly updated to block newly discovered threats.

Tesla has built into its battery-electric vehicles a system that allows it to use over-the-air, or OTA, updates, and that is likely to become the norm, rather than the exception in years to come. OTA also allows automakers to correct defective software code without issuing recalls forcing customer to drive into showroom service bays.

Even over-the-air updates might not be enough, however. TowerSec and other cybersecurity firms are working on new approaches, unique to automobiles, that would automatically lock out suspect software and revert to the original, factory code, if something unusual begins to happen.

One way or the other, automakers say they will have to address the issue - and quickly. The more high-tech equipment they build into the vehicles, the bigger the risk of being hacked.

NBC

« Snowden iPhone Case Alerts Users To Surveillance
Ransomware: Should You Pay The Ransom? »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Cyber Security Supplier Directory

Cyber Security Supplier Directory

Our Supplier Directory lists 6,000+ specialist cyber security service providers in 128 countries worldwide. IS YOUR ORGANISATION LISTED?

The PC Support Group

The PC Support Group

A partnership with The PC Support Group delivers improved productivity, reduced costs and protects your business through exceptional IT, telecoms and cybersecurity services.

Resecurity, Inc.

Resecurity, Inc.

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

Alvacomm

Alvacomm

Alvacomm offers holistic VIP cybersecurity services, providing comprehensive protection against cyber threats. Our solutions include risk assessment, threat detection, incident response.

Clayden Law

Clayden Law

Clayden Law advise global businesses that buy and sell technology products and services. We are experts in information technology, data privacy and cybersecurity law.

Alliance for Cyber Security (ACS)

Alliance for Cyber Security (ACS)

An alliance of all major players in the field of cyber security in Germany with a mission to strengthen Germany’s resistance to cyber-attacks.

CSIS Security Group

CSIS Security Group

CSIS provide actionable threat intelligence, prevention, incident response and 24/7 managed security services.

Global Forum on Cyber Expertise (GFCE)

Global Forum on Cyber Expertise (GFCE)

GFCE is a global platform for countries, international organizations and private companies to exchange best practices and expertise on cyber capacity building.

Wallarm

Wallarm

Wallarm is the only unified, best-in-class API Security and WAAP (Web App and API Protection) platform to protect your entire API and web application portfolio.

J2 Software

J2 Software

J2 Software is a leading African Information Security and ICT business providing information security, governance, risk and compliance solutions.

AKATI Sekurity

AKATI Sekurity

AKATI Sekurity is a security-focused consulting firm providing services specializing in Information Security and Information Forensics.

Council to Secure the Digital Economy (CSDE)

Council to Secure the Digital Economy (CSDE)

CSDE brings together companies from across the ICT sector to combat increasingly sophisticated and emerging cyber threats through collaborative actions.

KETS Quantum Security

KETS Quantum Security

KETS harnesses the properties of quantum mechanics to solve challenging problems in randomness generation and secure key distribution and enable ultra secure communications.

FPT Software

FPT Software

As a leading technology service provider, FPT assists customers of all sizes and from any industries in implementing and adapting digital technologies including cybersecurity.

TopSOC Information Security

TopSOC Information Security

TopSOC Information Security provide a wide range of security consultation, implementation and training services.

HiScout

HiScout

HiScout is your integrated management system for IT governance, risk & compliance.

CrossCountry Consulting

CrossCountry Consulting

CrossCountry Consulting is a trusted business advisory firm that provides customized finance, accounting, human capital management, risk, operations and technology consulting services.

Nasuni

Nasuni

The Nasuni File Data Platform offers the protection, detection, and recovery of file shares from ransomware attacks or random disasters within minutes.

V2X

V2X

V2X delivers IT support, networking, and cybersecurity solutions that ensure optimal mission support and performance.

Paramount Defenses

Paramount Defenses

Paramount Defenses have unrivaled capability in two of the most critical areas in cyber security today – Active Directory Security and Privileged Access.

Amplifier Security

Amplifier Security

Amplifier Security are on a mission to empower security teams to modernize their practice by connecting the dots between their security stack and their people.