LinhPTK | May 24, 2017
Ever since car manufacturers came out with keyless entry in the ’90s, consumers have demanded more and more convenience features on their vehicles. Drivers want cars that park themselves while companies like Google are working on developing self-driving vehicles. These features are made possible through wireless technology and communications through smartphones, but the convenience also opens up vulnerabilities to hackers. Not many consumers realize that the ability to unlock their cars with the touch of a button means that attackers can do the same.
What Makes Cars so Vulnerable to Hacking?
Prior to the technology boom fueled by the Internet, car owners only had to worry about physical hot-wiring and carjacking. Automakers developed better locking systems and alarms to deter criminals. Today, cars have in-vehicle computer systems that feature touchscreen controls and communicate wirelessly with smartphones. As the user’s controls become more convenient, hackers gain access to those same features through innovative measures.
Consumers spend millions of dollars every year on anti-virus and anti-spyware software for their personal computers to protect them from Trojans and malware. They ensure that their software and browsers have the latest updates to limit the amount of vulnerabilities, but they neglect to take this same cautious approach to their vehicles’ electronic systems. However, consumers are not entirely to blame for this security failure. Automakers have been so focused on implementing the latest and greatest technology that they neglected to conduct thorough research and testing during the development phases.
Since carmakers have been dedicated to designing mechanical engines and structures with high integrity for decades, they are finding out the hard way that advanced technology comes with a steep learning curve. Software and hardware developers understand that they have to stay ahead of malicious attackers by thoroughly testing their products for vulnerabilities before releasing them to the market. Automakers are used to testing for safety and performance but not necessarily hacking. It turns out that hackers can penetrate a vehicle’s systems using only a smartphone and laptop.
Gaining knowledge is the best starting point for building a better defense. Since the early summer of 2015, car manufacturers have been stepping up their game by organizing groups and associations where developers can share knowledge of technologies to benefit the entire industry. One such program that launched in June of 2015 is the Automotive Information Sharing and Analysis Center, or Auto-ISAC. This central hub allows participants to exchange knowledge of cyber threats and vulnerabilities within various systems, software and hardware. In addition to automotive companies, other industries are free to join in, including auto parts suppliers, technology companies and telecommunication providers. Even President Obama supports Auto-ISAC and encourages the swapping of cyber-security information. Founders have set up legal protections for sharing data to prevent company-specific information from leaking to certain entities like Google.
There are several other groups that devote their time to security testing and solution development. The SAE evaluates technology while creating best practices for safeguarding against cyber-security threats in vehicles. USCAR has the Cyber-Physical Systems Task Force, and the Pentagon’s DARPA often funds projects directed at automobile security. In addition to having auto engineers simulate attacks on their vehicles, manufacturers take advantage of cyber conferences to benefit from additional testing and knowledge exchanges. One enhancement to security that carmakers have implemented is the use of GPS systems and electronic theft-prevention technology. These features help reduce the number of stolen cars and help police locate those that do get stolen. One of the most effective methods that automakers use is threat modeling where engineers use the latest methods of hacking to test vehicles’ security.
Security of Vehicle Hardware
Car manufacturers have more expertise on the hardware side of security because these features are built into the vehicles. Tesla, in particular, has one of the most secure vehicles in regards to defending against hot wiring. Even if an attacker gains access to the electronic controls of the Model S, the ignition still requires the driver’s key to be inserted before someone can drive off with it. Isolating the auto control systems from the communications-based systems is an important step in securing the vehicle. Researchers found the Tesla’s Model S is more secure because it requires both physical access and wireless control of the infotainment system to conduct a successful hack.
With the Tesla hack, the attacker had to physically plug his laptop into a network cable in the dashboard. This feat enabled him to input Trojans that gave access to critical controls when someone else was driving. Based on this test, other manufacturers can follow Tesla’s lead by completely isolating the infotainment system and limiting vehicles’ controls. Better hardware for locking mechanisms can help prevent attackers from gaining that initial physical access so that they can never touch the advanced technology and driver’s features.
Security of Vehicle Software
Vehicle software is the bigger issue when it comes to cyber security. Cars are becoming more and more interconnected through Internet browsers, internal modems, telecommunication devices and smartphone apps. With the Tesla example, once the attacker gained physical access, his Trojan allowed him to remotely disable the engine among other user privileges.
Some precautions carmakers take is to require special codes for software updates and take advantage of proven security techniques when preventing unauthorized access. The most notable breech in security involved Chrysler and its UConnect system. The company issued a voluntary recall of over one million vehicles from 2013 to 2015 model years for a software patch update. Luckily, the vulnerability was discovered by a researcher, so Chrysler had time to issue a patch before malicious attackers could utilize the information. The hacker used a backdoor entry method by gaining access through the infotainment system. From there, he could easily gain access to the vehicle’s critical safety system and control the car’s engine and steering wheel.
The biggest concern about Chrysler’s vulnerability was the method of patching affected vehicles. The update had to be done by hand, so owners had to either take their cars to a dealership or opt to have a USB stick containing the patch mailed to them. This method is a major inconvenience to drivers, especially since software often needs updates on a monthly basis. Unlike Chrysler, Tesla has been developing an OTA process, or over-the-air updates. Tesla has the ability to remotely distribute updates, and owners simply have to click “yes” when the car’s system prompts for the upgrade installation.
One major problem discovered in multiple manufacturers’ vehicles is the use of outdated software. Researchers found four-year-old browsers within infotainment systems that contained known vulnerabilities to remote hacks, including privilege escalation vulnerability. Other models contained outdated software versions that could have easily been updated prior to selling the vehicles. While the cars’ computer systems ran fine with older software, the manufacturers failed to take into account the underlying consequences.
Since cars are starting to use smartphones for communication and convenience features, they are also sharing the same vulnerabilities. Certain iOS apps for BMW and Mercedes gave hackers various levels of control. By planting a homemade device on the vehicle, an attacker could intercept signals when the driver used the app. This interception provided the hacker with login information, which allowed him to locate the car through GPS, unlock the doors and start the engine remotely.
Researchers admit that gaining initial access to a vehicle is not an easy task, but once that door is open, the possibilities are a bit frightening. With enough patience and knowledge of computerized systems, a hacker can slowly descend deeper into the vehicle’s controls. One hacker was able to alter the speedometer readout on a Tesla and concluded that the malicious potential is limitless.
The important lesson for car manufacturers here is that they need to conduct better software research and testing. Using outdated software with known problems is an ineffective way of protecting their cars and customers. A lot of Chrysler’s testing was conducted after selling the vehicles, and they learned that patching the problem created more inconveniences. If automakers want to keep up with the latest gadgets and technology, they also need to understand the features they are selling and have a reliable support team to address issues when they arise.
Improvement Options for Automobile Cyber Security
While car manufacturers are still learning about the implications of connecting their vehicles on the grid, they can adapt initiatives of other industries that have already dealt with such security concerns. They could certainly improve their patch management by looking at telecommunication providers. IT departments can share their knowledge of intrusion detection and prevention as well as the intricacies of security architecture. Some experts suggest vehicle manufacturers start storing data in the Cloud to greatly limit the risk of unauthorized remote access.
Tesla has already taken steps to mimic the security of commercial airliners by implementing a gateway between the touchscreen communication controls and the vehicle. This gateway makes cars more secure and difficult to hack. Adding safety features to the car in the event of an attack is also a smart step that Tesla has taken. If a hacker were to gain access to a Tesla and cut off the engine when someone is driving it, the vehicle will engage its emergency controls. Under five miles per hour, the brakes will activate. Above five miles per hour, the car will go into neutral to gradually slow down while the driver maintains control of the steering. Airbag functionality is also separated so that it will still activate if the car does crash.
The most prominent vulnerability of cars is the ease of backdoor entry. Once the infotainment system is hacked, it is easy for attackers to reach more critical functions of the vehicle. Engineers need to balance access points so that software can be repaired without compromising the security of critical systems. Storing data into the Cloud will prevent hackers from targeting single vehicles, and isolating networks will eliminate the links between systems.
While the simple solution would be to remove wireless features from vehicles and go back to manual controls, consumers would still demand more connectivity and convenience features. Fortunately, most hacks have been performed during testing phases where no one is at real risks. Researchers also report that it takes a lot of time and effort to gain initial access. They are still working on determining just how far they can go once they have hacked a vehicle’s systems, but this is an ongoing struggle as technology evolves.
For now, separating critical systems from convenience systems is the way to engineer a car. Industry-wide programs like Auto-ISAC will certainly improve the knowledge base of car manufacturers, and it is definitely a step in the right direction. Automakers will have to work hard to keep up with technology and emerging vulnerabilities while initiating continuous improvements to best practices in cyber security.