Risk

5/16/2010
09:39 PM
George V. Hulme
George V. Hulme
Commentary
50%
50%

Automobiles Growing Vulnerable To Hacks

Carmakers are rolling automobiles off the assembly line with plenty of fancy new high-tech features. Unfortunately, security is -- once again -- treated as an afterthought.

Carmakers are rolling automobiles off the assembly line with plenty of fancy new high-tech features. Unfortunately, security is -- once again -- treated as an afterthought.

Modern automobiles are no longer mere mechanical devices; they are pervasively monitored and controlled by dozens of digital computers coordinated via internal vehicular networks. While this transformation has driven major advancements in efficiency and safety, it has also introduced a range of new potential risks.

So starts the research report, Experimental Security Analysis of a Modern Automobile, published by a team of IT security researchers from the University of California, San Diego and the University of Washington.

Anyone who is interested in the security of information systems might want to give this paper a read. Although those who have been following the security of IT infrastructure and PCs during the past fifteen years may be struck with an eerie feeling of Déjà Vu.

Just as PCs became increasingly networked in the 1990s, and operating systems were crammed with new features, security risks also increased. And when PCs and LANs were connected to the Internet: those risks went parabolic. There wasn't much attention paid to how adversaries - virus writers, curiosity seeking hackers, and outright criminals would use systems to snoop, disrupt, and destroy.

It seems carmakers may be repeating the mistakes of the IT industry, according to the report:

The attack surface for modern automobiles is growing swiftly as more sophisticated services and communications features are incorporated intovehicles. In the United States, the federally-mandated On-Board Diagnostics (OBD-II) port, under the dash in virtuallyall modern vehicles, provides direct and standard access to internal automotive networks. User-upgradable subsystems such as audio players are routinely attached to these same internal networks, as are a variety of shortrange wireless devices (Bluetooth, wireless tire pressure sensors, etc.). Telematics systems, exemplified by General Motors' (GM's) OnStar, provide value-added features such as automatic crash response, remote diagnostics, and stolen vehicle recovery over a long-range wireless link. To do so, these telematics systems integrate internal automotive subsystems with a remote command center via a wide area cellular connection. Some have taken this concept even further-proposing a "car as a platform" model for third-party development.

The researchers found that attackers can grab control of a range of functions of the car, and override driver input, such as disabling breaks and even stopping the engine. Here's what one of the researchers had to say to The New York Times regarding their research:

"We noticed the extent to which automobiles were becoming computerized," said Stefan Savage, a computer scientist at U.C.S.D. who was a member of one of two groups that have been studying the electronic control units of two different cars to look for network vulnerabilities that could be exploited by a potential attacker. "We found ourselves thinking we should try to get in front of this before it suddenly becomes an issue."

Many of the vulnerabilities of automotive systems that make attacks possible will sound familiar to IT security professionals such: poor authentication, weak access control, and poor challenge-response mechanisms to protect against unauthorized system tampering.

Hopefully it's not too late for car manufacturers to (at least) bring the same level of engineering scrutiny to software aspects of their products as they do the mechanical. Because it's one thing to tolerate shoddy software engineering (now, that's an oxymoron isn't it) within PC and enterprise applications: it's a number of magnitudes greater to have to worry about attackers gaining control of any aspect of your vehicle while cruising down the highway.

For my security and technology observations throughout the day consider following me on Twitter.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
New Mexico Man Sentenced on DDoS, Gun Charges
Dark Reading Staff 5/18/2018
Cracking 2FA: How It's Done and How to Stay Safe
Kelly Sheridan, Staff Editor, Dark Reading,  5/17/2018
What Israel's Elite Defense Force Unit 8200 Can Teach Security about Diversity
Lital Asher-Dotan, Senior Director, Security Research and Content, Cybereason,  5/21/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Shhh!  They're watching... And you have a laptop?  
Current Issue
Flash Poll
[Strategic Security Report] Navigating the Threat Intelligence Maze
[Strategic Security Report] Navigating the Threat Intelligence Maze
Most enterprises are using threat intel services, but many are still figuring out how to use the data they're collecting. In this Dark Reading survey we give you a look at what they're doing today - and where they hope to go.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-10593
PUBLISHED: 2018-05-24
A vulnerability in DB Manager version 3.0.1.0 and previous and PerformA version 3.0.0.0 and previous allows an authorized user with access to a privileged account on a BD Kiestra system (Kiestra TLA, Kiestra WCA, and InoqulA+ specimen processor) to issue SQL commands, which may result in data corrup...
CVE-2018-10595
PUBLISHED: 2018-05-24
A vulnerability in ReadA version 1.1.0.2 and previous allows an authorized user with access to a privileged account on a BD Kiestra system (Kiestra TLA, Kiestra WCA, and InoqulA+ specimen processor) to issue SQL commands, which may result in loss or corruption of data.
CVE-2018-11332
PUBLISHED: 2018-05-24
Stored cross-site scripting (XSS) vulnerability in the "Site Name" field found in the "site" tab under configurations in ClipperCMS 1.3.3 allows remote attackers to inject arbitrary web script or HTML via a crafted site name to the manager/processors/save_settings.processor.php f...
CVE-2018-8013
PUBLISHED: 2018-05-24
In Apache Batik 1.x before 1.10, when deserializing subclass of `AbstractDocument`, the class takes a string from the inputStream as the class name which then use it to call the no-arg constructor of the class. Fix was to check the class type before calling newInstance in deserialization.
CVE-2017-17158
PUBLISHED: 2018-05-24
Some Huawei smart phones with the versions before Berlin-L21HNC185B381; the versions before Prague-AL00AC00B223; the versions before Prague-AL00BC00B223; the versions before Prague-AL00CC00B223; the versions before Prague-L31C432B208; the versions before Prague-TL00AC01B223; the versions before Prag...