IoT
11/10/2017
02:50 PM
Dark Reading
Dark Reading
Products and Releases
50%
50%

FASTR consortium announces release of 'Automotive Industry Guidelines for Secure Over-the-Air Updates'

Document provides evaluators with comprehensive, objective guidelines by which to analyze automotive software over-the-air (SOTA) update systems

WILMINGTON, Del. (Nov. 8, 2017) – FASTRSM, a nonprofit research consortium dedicated to automotive cybersecurity, today announced the availability of “Automotive Industry Guidelines for Secure Over-the-Air Updates.”

The guidelines are intended to assist automotive manufacturers and others involved in evaluating platforms for secure updates, describing the threat models, providing recommended cryptographic algorithms and detailing a step-by-step checklist for evaluating SOTA systems.The documentilluminates one area of opportunity for research and innovation in the automotive security ecosystem.

“Today’s modern automotive ecosystem requires a robust, adaptable approach to maintain the security and integrity of the growing intelligently connected vehicles on the roads. Provenance and operational verification of software components in a forensically sound manner is critical,” said Craig Hurst, FASTR executive director. “These guidelines will serve as a comprehensive, objective resource to help OEMs analyze SOTA systems and make wise design choices.”

Founded by Aeris, Intel and Uber in 2016, FASTR seeks to accelerate automotive security by marshaling industry-wide collaboration on crucially needed research. To become a member of FASTR, get involved and lend expertise to plans for 2018 activities, go to https://fastr.org/membership/.

 

About FASTR

FASTR—Future of Automotive Security Technology Research—is a neutral nonprofit automotive security research consortium working to drive systematic coordination of cybersecurity across the entire supply chain and ensure trust in the connected and autonomous vehicle of the future. For more information, please visit fastr.org

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
'Shift Left' & the Connected Car
Rohit Sethi, COO of Security Compass,  6/12/2018
Why CISOs Need a Security Reality Check
Joel Fulton, Chief Information Security Officer for Splunk,  6/13/2018
Microsoft Fixes 11 Critical, 39 Important Vulns
Kelly Sheridan, Staff Editor, Dark Reading,  6/12/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-1061
PUBLISHED: 2018-06-19
python before versions 2.7.15, 3.4.9, 3.5.6 and 3.7.0 is vulnerable to catastrophic backtracking in the difflib.IS_LINE_JUNK method. An attacker could use this flaw to cause denial of service.
CVE-2018-1073
PUBLISHED: 2018-06-19
The web console login form in ovirt-engine before version 4.2.3 returned different errors for non-existent users and invalid passwords, allowing an attacker to discover the names of valid user accounts.
CVE-2018-12557
PUBLISHED: 2018-06-19
An issue was discovered in Zuul 3.x before 3.1.0. If nodes become offline during the build, the no_log attribute of a task is ignored. If the unreachable error occurred in a task used with a loop variable (e.g., with_items), the contents of the loop items would be printed in the console. This could ...
CVE-2018-12559
PUBLISHED: 2018-06-19
An issue was discovered in the cantata-mounter D-Bus service in Cantata through 2.3.1. The mount target path check in mounter.cpp `mpOk()` is insufficient. A regular user can consequently mount a CIFS filesystem anywhere (e.g., outside of the /home directory tree) by passing directory traversal sequ...
CVE-2018-12560
PUBLISHED: 2018-06-19
An issue was discovered in the cantata-mounter D-Bus service in Cantata through 2.3.1. Arbitrary unmounts can be performed by regular users via directory traversal sequences such as a home/../sys/kernel substring.