Cybersecurity In Self-Driving Cars

Instead of taking you home from work, your self-driving car delivers you to a desolate road, where it pulls off on the shoulder and stops. 

You call your vehicle to pick you up from a store and instead you get a text message: Send $100 worth of Bitcoin to this account and it'll be right over.

You buckle your seatbelt and set your destination to a doctor's appointment, but your car won't leave your driveway. It senses it's been hacked and your home is its pre-programmed safe destination.

These three hypothetical scenarios, posited in a new white paper by University of Michigan researchers working with Mcity, illustrate the breadth of the cybersecurity challenges that must be overcome before autonomous and connected vehicles can be widely adopted.

While every new generation of auto tech brings new security risks, the vulnerabilities that come along with advanced mobility are both unprecedented and under-studied, the paper states.

The white paper introduces a tool called the Mcity Threat Identification Model, which could help academic and industry researchers analyse the likelihood and severity of potential threats.

The new model outlines a framework for considering: the attacker's skill level and motivation; the vulnerable vehicle system components; the ways in which an attack could be achieved; and the repercussions, including for privacy, safety and financial loss. The tool is believed to be the first of its kind focused on automated vehicles.

Understanding the Threats

"Cybersecurity is an overlooked area of research in the development of autonomous vehicles," said Andre Weimerskirch, lead author of the paper, who leads Mcity's cybersecurity working group and is also vice president of cybersecurity for Lear Corp.

"Our tool marks not only an important early step in solving these problems, but also presents a blueprint to effectively identify and analyse cyber-security threats and create effective approaches to make autonomous vehicle systems safe and secure."

Connected and automated vehicles are what researchers call a cyber-physical system, with components in the "real" and virtual worlds. The safety stakes are as high as these systems are hard to protect. Connected and automated vehicles will face familiar threats, and new ones, the report describes.

They will be vulnerable to those that regularly disrupt computer networks, like data thieves of personal and financial information, spoofers who present incorrect information to a vehicle, and denial-of-service attacks that move from shutting down computers to shutting down cars.

In addition, new threats unique to automated vehicles themselves emerge, hackers who would take control over or shut-down a vehicle, criminals who could ransom a vehicle or its passengers, and thieves who direct a self-driving car to relocate itself to the local chop-shop, for example.

Finally, there are security threats to the wide-ranging networks that will connect with autonomous vehicles, the financial networks that process tolls and parking payments, the roadway sensors, cameras and traffic signals, the electricity grid, and even our personal home networks.

"It might seem convenient for an autonomous car that gets within 15 minutes of your home to automatically turn on your furnace or air conditioner, open the garage and unlock your front door," the researchers write. "But any hacker who can breach that vehicle system would be able to walk right in and burglarize your home."

The New Threat Identification Model

To demonstrate the insight, the new model can provide, the researchers used it to examine vulnerabilities in automated parking, both parking assist technology and the more advanced remote, self-parking.

They determined that the most likely attacks are: a mechanic disabling the range sensors in park-assist or remote parking in order to require additional maintenance, and an expert hacker sending a false signal to your vehicle's receiver to turn off remote parking. Both received sixes on the researchers' 10-point scale, with 0 being lowest probability.

At the same time, the type of attack that would have the most impact would be a knowledgeable thief spoofing your remote parking signal in order to steal your car. This type of attack received a 7 on the researchers' scale of impact.

"Without robust, fool-proof cybersecurity for autonomous vehicles, systems and infrastructure, a viable, mass market for these vehicles simply won't come into being," said Huei Peng, Mcity director and the Roger L. McCarthy Professor of Mechanical Engineering.

"Funding this kind of research is a critical part of Mcity's mission to help break down barriers to widespread deployment of connected and automated vehicle-technology."

Phys.org

You Might Also Read:

Dubai  Launches First Standard For Driverless Cars:

Self-driving Uber Vehicle Strikes & Kills:

 

« Law Firms Are Uneducated & Exposed
GMail Users Warned Of Vulnerability »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Resecurity, Inc.

Resecurity, Inc.

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

BackupVault

BackupVault

BackupVault is a leading provider of automatic cloud backup and critical data protection against ransomware, insider attacks and hackers for businesses and organisations worldwide.

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

DigitalStakeout

DigitalStakeout

DigitalStakeout enables cyber security professionals to reduce cyber risk to their organization with proactive security solutions, providing immediate improvement in security posture and ROI.

IONU Security

IONU Security

IONU offer a security platform focused specifically on providing Data-centric Security.

National Trading Standards eCrime Team (NTSeCT)

National Trading Standards eCrime Team (NTSeCT)

The National Trading Standards eCrime Team tackles online consumer scams, rip-offs and fraud, as well as those committed by text or email.

Andrisoft

Andrisoft

Andrisoft develops WANGUARD, an anti-DDoS Software solution that monitors IP traffic using packet-based and flow-based Sensors, and protects networks

Telos

Telos

Telos offers cybersecurity solutions and services that empower and protect the world’s most security-conscious enterprises.

CybelAngel

CybelAngel

CybelAngel is a leading digital risk protection platform that detects and resolves external threats before these wreak havoc.

Ksmartech

Ksmartech

Ksmartech provide services related to security and authentication in all areas where the connection of people to objects, and objects and objects is necessary.

Beryllium InfoSec Collaborative

Beryllium InfoSec Collaborative

Beryllium InfoSec Collaborative is an information security and cyber security company with 40-plus years of experience across industry & government.

FDD Center on Cyber and Technology Innovation (CCTI)

FDD Center on Cyber and Technology Innovation (CCTI)

The Foundation for Defense of Democracies is a nonprofit research institute focusing on foreign policy and national security. Ares of focus include cyber security and technology innovation.

META-Cyber

META-Cyber

META-cyber was founded by engineers with experience in process and control-protection to provide cyber security for industrial infrastructure.

SOOS

SOOS

SOOS is the easy-to-integrate software security solution for your whole team. Build, catch, and fix vulnerabilities with SOOS Software Composition Analysis.

AnyTech365

AnyTech365

AnyTech365 is a leading European IT Security and Support company helping end users and small businesses have a worry-free experience with all things tech.

Blackpanda

Blackpanda

Blackpanda is Asia’s premier cyber security incident response group, hyper-focused on digital forensics and cyber crisis response.

Endor Labs

Endor Labs

Endor Labs gives developers and security teams the context they need to prioritize open source risk.

OneZero Solutions

OneZero Solutions

OneZero specialize in cybersecurity operations, information assurance, computer network operations, solutions engineering, and project management.

Jericho Security

Jericho Security

Jericho Security is on a mission to defend the world from the new threats of generative AI cyber attacks.

CyFlare

CyFlare

CyFlare’s security platform integrates your tools with ours – delivering true positives, automated remediation, and interactive analytics built for security management teams.