Connected Cars Are The New Attack Vector
Smart devices are connecting to just about everything that runs on electricity to the Internet. However often these devices are not very cyber secure. These smart devices are often dispatched with outdated and inadequate security measures. This creates all sorts of new avenues for cyber-attacks, and one of the most concerning is attacks on smart vehicles.
While a hack of a home smart device might lead to nothing more than an invasion of privacy or a botnet attack, hacks of connected cars could be used for terrorism and assassinations.
Are Cyber-Attacks on Connected Cars an Inevitability?
A new report from Los Angeles-based group Consumer Watchdog helps to bring the threat to connected cars into focus.
The problem is tied into one that is endemic with smart devices – they tend to ship with inadequate security. Sometimes they are properly secured from the beginning. In other cases, there is no way to patch their firmware once a vulnerability develops.
One would think that something that could be weaponized in the way a vehicle can would have more of a security focus, but the new report makes clear that is not the case.
The report, which bears the grim but appropriate name “Kill Switch”, consulted with engineers and technologists in the automotive industry for five months to assess how vulnerable the average vehicle is to hacking. Bear in mind that the study focuses on the tens of millions of standard vehicles currently operating on American highways, not self-driving cars.
The worrying central finding is that the majority of the 2020 line of vehicles from the top 10 auto manufacturers will be connected to the Internet and will also be vulnerable to cyber-attacks. Most of these vehicles are about to go on the market in the fall.
Current and Future Threats
At present, there are about 50 million vehicles in the United States that have Internet connectivity. That’s about 20% of all vehicles on the road. That percentage will sharply increase starting with the 2020 model year due to a commitment by all of the major manufacturers to add connectivity features to many new models going forward.
Ford, GM and Toyota plan to have all of their vehicles connected to the Internet starting with this upcoming model year. That would mean about 17 million new “connected cars” on American roads each year.
The report has a particular focus on the potential mass cyber-attacks. When an exploit is discovered in one vehicle type, or perhaps even in one manufacturer’s software that is deployed through many of their models, it could be used to quickly gain control of millions of vehicles.
There is a potential threat to all aspects of the vehicle. Acceleration could be ramped up remotely, and brakes could be disabled or engaged suddenly. It is even possible for steering to be controlled remotely under the right circumstances. The window and door locks could also be engaged by an attacker.
The main vulnerability cited by the report is the “head” system of these vehicles, which is primarily used for infotainment systems, GPS navigation and various “creature comfort” features linked to smart phone control.
Though they are screening these risks from the public, industry executives have acknowledged them as “high” and “difficult to detect” in mandatory disclosures to investors.
Some expert hackers consulted for the report said that “time and money” were the only barriers to compromising connected cars. In addition to the vulnerable head units, there is concern about the software being used at the core of the various automotive systems. Manufacturers often contract this software from third parties, and some of it is based on open-source systems with little method of holding authors accountable and unknown security risks.
Cars can be Killing Machines
The report projects that if a “fleet-wide” attack were to occur, 3.75 million connected cars would be infected and over a quarter of a million drivers could be on the road at the time of the attack. This would lead to over 130,000 injuries and 3,000 deaths. The estimated death toll would be slightly greater than that of the September 11 attacks, making this a valid national security concern.
So what can be done about connected Car Hacks?
Consumer Watchdog suggested one immediate measure to guard against cyber-attacks on connected cars, the mandatory installation of a manual “kill switch”, estimated to cost about 50 cents per vehicle, that would entirely disconnect the car from the Internet and any local networks when engaged.
In addition to disabling remote control of the car, this would allow for quicker national recovery in the wake of a fleet attack that leaves the safety status of a manufacturer’s connected cars in doubt for an extended period.
Additionally, the report recommends that CEOs should sign formal statements accepting legal liability for the cyber security status of their connected cars and that the industry should adopt an agreement to not connect vehicles to wide-area networks until their security is proven against cyber-attacks.
UK Government is offering £2m to boost Cyber Security for Driverless Vehicles
Now the Government’s innovation agency Innovate UK and the Centre for Connected and Autonomous Vehicles, CCAV, are offering £2m for projects working on cyber security for driverless vehicles.The money will be available for up to five projects, which can involve public sector or academic bodies, in the development of a testing facility.
Innovate UK said any proposals for support should involve ways to measure resilience and maintain cyber security for roadside infrastructure, vehicles and supporting services.
Projects should also provide input specifications for one or more new cyber test facilities and explore opportunities to develop new services. Successful proposals will lead to funding up to £400,000 for project costs, with public authorities or academic institutions eligible to share up to 50%. The competition will be open for applications until 25 September.
You Might Also Read:
Cybersecurity In Self-Driving Cars:
US And France To Permit Fully Driverless Cars On Public Roads:
