Articles
It's a nightmare scenario for a car maker. The millions on R&D spent to develop a market-leading feature for its newest models proves to be a massive, show-stopping flaw, and deters people from buying the car.
It's a scenario that several top car companies around the world are dealing with, after security experts have repeatedly exposed the vulnerabilities in the computer software running their latest vehicles in recent months.
The exposures have so far led one manufacturer, Fiat Chrysler, to recall 1.4 million Jeep Cherokees after, after security researchers remotely hijacked one as it drove down a highway in the US. The recall could be the first of many.
There are as many different vehicle architectures and ECUs (Electronics Control Units) as there are different vehicles on the market. Andy Davis, research director at information security consultancy NCC Group, says its likely that more vulnerabilities will be discovered.
“The research community, the OEMs and Tier One suppliers are realising this is a problem. But in some vehicles today, if you are in a head unit you can send a message to control other parts of the car.”
Internet-connectivity enables mapping and infotainment, email and google searches in cars, but critics have slammed the rush-to-market of these features, saying the consideration of security has been an “afterthought”.
Davis' research, which was this month presented to one of the world's largest conference on hacking, Black Hat in Las Vegas, has alarmed people because it uses broadcast technology. This opens up the possibility that many cars could be simultaneously commandeered and disabled.
Similarly to the Fiat Chrysler vulnerabilities, it uses a DAB signal, transmitted by off-the-shelf parts and a laptop, to send code to a vehicle's infotainment system. Once compromised, the code can then control other parts of the vehicle, such as steering and braking.
The automotive industry must learn from IT to protect from hackers, Davis says: “There is a lack of awareness in engineering about how to secure embedded systems in vehicles.
“The awareness is low because traditionally it would be the IT department that deals with hackers. Engineering would deal more with the local side of security- locking and immobilisers – protecting against physical attacks.”
The mindset has to change, says Davis, and automotive companies should consider adopting an IT concept called the “secure development lifecycle”. This dictates that security is considered in all parts of a product's design from day one and that there are plans in place to “respond” and “remediate” in case of an attack.
The architecture and design of vehicles is already changing as they feature more electronics and driver assistance systems. The adoption of a secure development lifecycle will affect this even further, further complicating the inclusion of popular new connectivity features.
Davis says: “There's no such thing as a 100% secure car, no software is 100%, there will always be bugs in the code. It's about minimising the risks. Developers have to segregate, add layers of security, create hoops for the attacker to jump through.
“Some OEMs are more aware than others, and are segregating CAN and introdusing measures such as the multilayering of security networks so that you can't route to every ECU in the vehicle.
“But these issues won't stop the OEMs. People want these cool new features and are quick to forget scare stories. They will pay for progress.”