IoT
11/10/2017
02:50 PM
Dark Reading
Dark Reading
Products and Releases
50%
50%

FASTR consortium announces release of 'Automotive Industry Guidelines for Secure Over-the-Air Updates'

Document provides evaluators with comprehensive, objective guidelines by which to analyze automotive software over-the-air (SOTA) update systems

WILMINGTON, Del. (Nov. 8, 2017) – FASTRSM, a nonprofit research consortium dedicated to automotive cybersecurity, today announced the availability of “Automotive Industry Guidelines for Secure Over-the-Air Updates.”

The guidelines are intended to assist automotive manufacturers and others involved in evaluating platforms for secure updates, describing the threat models, providing recommended cryptographic algorithms and detailing a step-by-step checklist for evaluating SOTA systems.The documentilluminates one area of opportunity for research and innovation in the automotive security ecosystem.

“Today’s modern automotive ecosystem requires a robust, adaptable approach to maintain the security and integrity of the growing intelligently connected vehicles on the roads. Provenance and operational verification of software components in a forensically sound manner is critical,” said Craig Hurst, FASTR executive director. “These guidelines will serve as a comprehensive, objective resource to help OEMs analyze SOTA systems and make wise design choices.”

Founded by Aeris, Intel and Uber in 2016, FASTR seeks to accelerate automotive security by marshaling industry-wide collaboration on crucially needed research. To become a member of FASTR, get involved and lend expertise to plans for 2018 activities, go to https://fastr.org/membership/.

 

About FASTR

FASTR—Future of Automotive Security Technology Research—is a neutral nonprofit automotive security research consortium working to drive systematic coordination of cybersecurity across the entire supply chain and ensure trust in the connected and autonomous vehicle of the future. For more information, please visit fastr.org

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Microsoft Word Vuln Went Unnoticed for 17 Years: Report
Kelly Sheridan, Associate Editor, Dark Reading,  11/14/2017
Companies Blindly Believe They've Locked Down Users' Mobile Use
Dawn Kawamoto, Associate Editor, Dark Reading,  11/14/2017
121 Pieces of Malware Flagged on NSA Employee's Home Computer
Kelly Jackson Higgins, Executive Editor at Dark Reading,  11/16/2017
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Managing Cyber-Risk
An online breach could have a huge impact on your organization. Here are some strategies for measuring and managing that risk.
Flash Poll
[Strategic Security Report] How Enterprises Are Attacking the IT Security Problem
[Strategic Security Report] How Enterprises Are Attacking the IT Security Problem
Enterprises are spending more of their IT budgets on cybersecurity technology. How do your organization's security plans and strategies compare to what others are doing? Here's an in-depth look.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.