Buckle up: Security threats to connected cars get real

As our connected cars move from syncing our music to driving us home, drivers, passengers, and pedestrians are starting to wonder if they should trust these high-velocity death-mobiles with their lives.  It’s a good question. Tesla, one of the leaders in next-generation cars, in July faced an open challenge from security researchers in China to identify cyber vulnerabilities — which reportedly was successful in only two days.  While this open source approach is admirable, it’s also telling.  Add the new driverless trials in the U.K. and the fact that the FBI has just started talking about deliberate misuse of our connected cars – for crime, terrorism and more – and it’s clear these threats are real. In a recent cyber war game, players successfully disrupted a military supply chain for fuel and ammunition deliveries to a port by strategically placing a powerful roadside radio broadcasting messages that “all tires were flat” and to “shut down engines for safety.”  Many sensors currently transmit data in clear text, with little or no cryptographic verification of source.  Stopping cars dead can create traffic jams on command, cause dangerous accidents, lose critical transport conduits, or be part of a more coordinated attack.   Criminals can snoop on moving cars simply by driving nearby, attaching to the car’s Bluetooth network and injecting malware commands, such as “activate built-in microphone.”  When manufacturers connect more vital devices to the car’s network, even more will be exposed.   These new vital enhancements include sensors that manage a driver’s health (C2D), efficiency aspects of car-to-home, traffic patterns of car-to-car, (C2C) and communications between cars and passengers (C2P). As we increase these links between man and motor, the age-old risks will move along with us. Imagine getting a text as you’re driving down the road that demands you approve an immediate Bitcoin transfer of $300 or the hacker will send your car over a cliff.  While it sounds farfetched today, as these new features become commonplace, crooks will use the same ransomware scams they use today on your data, just updated with very real attack vectors driven by the connected car. Connected cars, as with most infrastructure, rely on both the availability and integrity of commercial global positioning satellite (GPS) systems — yet neither are guaranteed.  GPS jammers exist both in product and kit form today, and have already been used to disrupt driverless car testing.  This jamming is a low-tech, cheap and easy threat that can seriously degrade a car’s safety.  Sending false GPS signals to a car is much more complex, but already demonstrable, and likely to be commoditized on the Dark Web well before we start depending on our cars to drive us home.   Manufacturers also are starting to use a Controller Area Network (CAN) protocol to manage communications between and betwixt a car’s myriad sensors, computers, actuators and input/output ports. Unfortunately security researchers in Europe have already shown they can build a $20 CAN Hacking Tool that can take over a moving car’s steering and brakes.   Current “connected car” developments aim to have its hundreds of sensors communicate directly with each other without the need for a central computer. As phones and TVs are beginning to be directly connected in our homes, CANs will allow a variety of devices to connect into the car’s nervous system.  Much like the recent discovery that poorly designed security in digital light bulbs compromised an entire home’s Wi-Fi network, introducing new devices into your car can impact its security, ranging from causing something minimal, such as opening doors and stealing the car, to overriding critical driving operations to cause a dangerous situation. Besides crooks stealing cars and money, hostile organizations, including enemy states (every country has enemies) and hacktivists, pose a threat.  If one of these groups wanted to disrupt a major city, they could follow the proven path of using patch management systems to introduce malware into many cars, just as easily as criminals did to the tens of thousands of individual credit card processors at Target. From the driver’s perspective, the key to success is to ask informed questions now that focus on their privacy, safety and security.  Since we all know that it’s better and cheaper to build security in than add it to an existing product, these questions need to be asked today, not after the connected cars and related infrastructure have been built and it’s too late to design in true security.  Waiting on security is just an expensive way to fail. For automakers, success requires an urgent focus on creating secure ecosystems for their connected cars that provide both trusted operations of the vehicle and an open system for verifying the security and integrity of all the other systems that will be connecting to your car.  Simply adding ‘firewalls’ will fail, and only by investing in a proven cybersecurity framework should connected cars be trusted on our highways. Automakers that lead with security will engender the trust that is necessary to win over the hearts, minds and garages of the driving public.