November 09, 2020
The growing number of Internet-connected devices and accessories in the connected car opens it up to new potential points of attack for cybercriminals.
The hack: it’s not a matter of if, but how often and how severely
The growing number of Internet-connected devices and accessories in the connected car opens it up to new potential points of attack for cybercriminals. Connected vehicles are tied into a variety of outside networks for communications, navigation, maintenance, and even the ability to be directed by apps on smart phones, providing an ever-growing attack surface with an increasing number of points (or vectors) where an attacker could try to gain access into the environment. For the connected car network, it will not be a matter of if you are impacted by a vulnerability exploit or breach, it will be a matter of when – and how often and the impact of each breach.
Failing to properly secure the connected car means more than just putting your personal information at risk; it can take key components of the car offline, rendering it undriveable or something even more catastrophic. For example, it’s been made public via Wikileaks that CIA employees have worked to infect vehicle controllers with malware, under the code word “Vault 7.” Hacker groups like the Shadow Brokers have already exploited these NSA tools, including the notorious WannaCry ransomware exploit that temporarily knocked key business offline, and show no signs of stopping. It is just a matter of time when an exploit kit aimed at the connected car hits the dark web.
The threats to connected cars have been made clear, but the Herculean task now at hand is implementing top-level security practices under time-sensitive and high-pressure conditions. Car makers are in an arms race to develop these vehicles, hoping to gain a competitive edge and become the go-to name in the market. Complications rise to the surface as the hours spent developing the exciting, futuristic features of the connected car far outweigh time spent examining the security issues abound in integrated IT systems. More to the point, manufacturers are still adapting to the processes and structures that are standard to the traditional production of IT.
As Car Becomes Computer, There’s No Need to Start from Scratch
As the automotive industry realizes security must be at the core of the connected car, it faces the challenge of integrating proven IT and security solutions that reliably secure both networked production sites and the vehicles themselves. Consumers are clearly excited, but expectations are high – they want advanced connected cars and expect manufacturers to thoroughly secure their vehicle, as well as provide ongoing security updates. Since manufacturers are just dipping their toes into the business of cybersecurity and are under pressure to deliver quickly, it’s imperative they take note from highly regulated industries with deep security experience like technology and finance.
The current state of the automotive market tells us that the transformation to connected/networked vehicles can only succeed cross-company as industry standards – protocols and processes – must be implemented across the board. Legislators may be reluctant to force them upon the industry, leaving car makers to define best practices and de facto industry standards. As part of this process, they should consider current standards from other highly-regulated sectors such as banking, and adapt to their specific needs. Car makers may find themselves navigating financial regulations, for example, to ensure that connected vehicles can safely and securely execute transactions and simple payment processes when refueling/recharging at the (electrical) station, automatically billing parking tickets and purchasing new parts and gear as needed, among other scenarios.
Building the Connected Car Starts with the Box
As auto manufacturers attempt to ingrain themselves in the practices of IT and security to get their connected cars on the road, they have the advantage of learning from other industries.
Security standards have already been established in the technology and finance sectors, and they can be adapted by the automotive industry to protect the data and systems in networked vehicles. At the center of consistent security is end-to-end encryption, in which hardware security modules (HSMs) constantly establish protection via authentication. They are used, for example, in the following methods:
- Key Injection: As a component of the HSM, you can insert individual digital keys into semiconductors using a real random generator. With the unique key of the components, the connected car is given a “digital identity” that authenticates the vehicle throughout its entire lifecycle. Authentication is used, for example, when the vehicle arrives at the workshop for maintenance, or eventually as cars communicate data and information among themselves (V2V).
- Authentication as the base layer for access control: Only those who have the digital key can make changes to the system in the vehicle – for example, downloading GPS updates or music would require authentication. In terms of any maintenance work on the vehicle, dealers and services can securely access the system using a Public Key Infrastructure (PKI).
- Code Signing: Software in the connected car will have already received an individual key during the development phase. This ensures that the code is both genuine and correct, and the integrity and authenticity of the software and its updates are safeguarded.
- Protecting the exchange of user data: Personal information should only be stored in an encrypted database. The cryptographic key material is managed and stored on premise, yet separated from the database in an HSM. Data is then protected against any unauthorized access, even if the database contents fall into the wrong hands – like the media and cybercriminals.
- Protecting monetary transactions: Ensure processes like tokenization and Host Card Emulation (HCE) are standard to securing the vehicle, as they are currently used in smartphone payments and transactions.
Security will Make or Break the Connected Car
As the automotive industry scrambles to develop vehicles with an impressive suite of IT features that stand out from the crowd, it is essential security is not seen as an added feature, but a prerequisite. The connected car will only reach its full potential if security is made a top priority – safety risks within the vehicle as well as threats to greater networks like the electric grid have the potential to create serious safety issues and unwanted disruptions to service.
Facing this new phase in the industry, auto manufacturers that have traditionally been tasked with providing safe, sturdy and well-built vehicles are switching gears to build hyper-connected and equally secure next-generation cars with the sleekest, coolest tech that can play the field with smartphones and other devices. But when cars become computers, the everyday traffic jam is a hacker’s paradise. To ensure security is fundamental to the development of the connected car, auto makers and OEMs must implement practices that quickly resolve any detected safety gaps during the process of production and systems development. Similarly, big industry players will be encouraged to join forces to develop cross-company/industry standards and adopt and adapt established ones.
This blog has first been published on July 19, 2017
