Connected Cars: A New and Dangerous Vector for Cyber Attacks
The march of the smart device is relentless, connecting just about everything that runs on electricity to the internet. Unfortunately, there is also no market segment where attitudes toward cybersecurity are currently more lax. Smart devices often ship with outdated, inadequate security measures. This creates all sorts of new avenues for cyber attacks, and one of the most concerning is attacks on smart vehicles. While a hack of a home smart device might lead to nothing more than an invasion of privacy or a botnet attack, hacks of connected cars could be used for terrorism and assassinations.
Are cyber attacks on connected cars an inevitability?
A new report from Los Angeles-based group Consumer Watchdog helps to bring the threat to connected cars into focus.
The problem is tied into one that is endemic with smart devices – they tend to ship with inadequate security. Sometimes they are properly secured from the beginning. In other cases, there is no way to patch their firmware once a vulnerability develops.
One would think that something that could be weaponized in the way a vehicle can would have more of a security focus, but the new report makes clear that is not the case. The report, which bears the grim but appropriate name “Kill Switch”, consulted with engineers and technologists in the automotive industry for five months to assess how vulnerable the average vehicle is to hacking. Bear in mind that the study focuses on the tens of millions of standard vehicles currently operating on American highways, not self-driving cars.
The worrying central finding is that the majority of the 2020 line of vehicles from the top 10 auto manufacturers will be connected to the internet and will also be vulnerable to cyber attacks. Most of these vehicles are about to go on the market in the fall.
Current and future threats
At present, there are about 50 million vehicles in the United States that have internet connectivity. That’s about 20% of all vehicles on the road. That percentage will sharply increase starting with the 2020 model year due to a commitment by all of the major manufacturers to add connectivity features to many new models going forward. Ford, GM and Toyota plan to have all of their vehicles connected to the internet starting with this upcoming model year. That would mean about 17 million new “connected cars” on American roads each year.
The report has a particular focus on the potential mass cyber attacks. When an exploit is discovered in one vehicle type, or perhaps even in one manufacturer’s software that is deployed through many of their models, it could be used to quickly gain control of millions of vehicles.
There is a potential threat to all aspects of the vehicle. Acceleration could be ramped up remotely, and brakes could be disabled or engaged suddenly. It is even possible for steering to be controlled remotely under the right circumstances. The window and door locks could also be engaged by an attacker.
The main vulnerability cited by the report is the “head” system of these vehicles, which is primarily used for infotainment systems, GPS navigation and various “creature comfort” features linked to smart phone control. The head system is necessarily connected to the vehicle’s Controller Area Network (CAN), the nerve center that all of the other potential safety issue areas are connected to. The industry-standard CAN was designed in the 1980s before anyone could conceptualize the widespread use of a cellular connection and the internet. Thus, a compromise of the head unit could open the door for lateral cyber attacks on other components.
The automotive industry does not currently have any serious plan on the table to address this issue. By 2022, two-thirds of all new vehicles will have a potentially insecure head unit connection.
The experts consulted for this report believe that the auto industry is intentionally downplaying these risks as car makers have not been able to develop adequate security for the head unit, but would stand to lose a great deal of money by delaying the roll-out of these new vehicles if the connectivity features were put on hold until then. Experts report that the industry’s approach to date has been “patch as discovered” (through measures such as bug bounty programs), a policy that could prove disastrous if the first contact with a new vulnerability is when someone uses it to cause a freeway pile-up. Though they are screening these risks from the public, industry executives have acknowledged them as “high” and “difficult to detect” in mandatory disclosures to investors.
Some expert hackers consulted for the report said that “time and money” were the only barriers to compromising connected cars. In addition to the vulnerable head units, there is concern about the software being used at the core of the various automotive systems. Manufacturers often contract this software from third parties, and some of it is based on open-source systems with little method of holding authors accountable and unknown security risks.
Cars can be killing machines
The report projects that if a “fleet-wide” attack were to occur, 3.75 million connected cars would be infected and over a quarter of a million drivers could be on the road at the time of the attack. This would lead to over 130,000 injuries and 3,000 deaths. The estimated death toll would be slightly greater than that of the September 11 attacks, making this a valid national security concern.
So what can be done about connected car hacks?
Consumer Watchdog suggested one immediate measure to guard against cyber attacks on connected cars – the mandatory installation of a manual “kill switch”, estimated to cost about 50 cents per vehicle, that would entirely disconnect the car from the internet and any local networks when engaged. In addition to disabling remote control of the car, this would allow for quicker national recovery in the wake of a fleet attack that leaves the safety status of a manufacturer’s connected cars in doubt for an extended period.
Additionally, the report recommends that CEOs should sign formal statements accepting legal liability for the cyber security status of their connected cars and that the industry should adopt an agreement to not connect vehicles to wide-area networks until their security is proven against cyber attacks.