09:39 PM
George V. Hulme
George V. Hulme

Automobiles Growing Vulnerable To Hacks

Carmakers are rolling automobiles off the assembly line with plenty of fancy new high-tech features. Unfortunately, security is -- once again -- treated as an afterthought.

Carmakers are rolling automobiles off the assembly line with plenty of fancy new high-tech features. Unfortunately, security is -- once again -- treated as an afterthought.

Modern automobiles are no longer mere mechanical devices; they are pervasively monitored and controlled by dozens of digital computers coordinated via internal vehicular networks. While this transformation has driven major advancements in efficiency and safety, it has also introduced a range of new potential risks.

So starts the research report, Experimental Security Analysis of a Modern Automobile, published by a team of IT security researchers from the University of California, San Diego and the University of Washington.

Anyone who is interested in the security of information systems might want to give this paper a read. Although those who have been following the security of IT infrastructure and PCs during the past fifteen years may be struck with an eerie feeling of Déjà Vu.

Just as PCs became increasingly networked in the 1990s, and operating systems were crammed with new features, security risks also increased. And when PCs and LANs were connected to the Internet: those risks went parabolic. There wasn't much attention paid to how adversaries - virus writers, curiosity seeking hackers, and outright criminals would use systems to snoop, disrupt, and destroy.

It seems carmakers may be repeating the mistakes of the IT industry, according to the report:

The attack surface for modern automobiles is growing swiftly as more sophisticated services and communications features are incorporated intovehicles. In the United States, the federally-mandated On-Board Diagnostics (OBD-II) port, under the dash in virtuallyall modern vehicles, provides direct and standard access to internal automotive networks. User-upgradable subsystems such as audio players are routinely attached to these same internal networks, as are a variety of shortrange wireless devices (Bluetooth, wireless tire pressure sensors, etc.). Telematics systems, exemplified by General Motors' (GM's) OnStar, provide value-added features such as automatic crash response, remote diagnostics, and stolen vehicle recovery over a long-range wireless link. To do so, these telematics systems integrate internal automotive subsystems with a remote command center via a wide area cellular connection. Some have taken this concept even further-proposing a "car as a platform" model for third-party development.

The researchers found that attackers can grab control of a range of functions of the car, and override driver input, such as disabling breaks and even stopping the engine. Here's what one of the researchers had to say to The New York Times regarding their research:

"We noticed the extent to which automobiles were becoming computerized," said Stefan Savage, a computer scientist at U.C.S.D. who was a member of one of two groups that have been studying the electronic control units of two different cars to look for network vulnerabilities that could be exploited by a potential attacker. "We found ourselves thinking we should try to get in front of this before it suddenly becomes an issue."

Many of the vulnerabilities of automotive systems that make attacks possible will sound familiar to IT security professionals such: poor authentication, weak access control, and poor challenge-response mechanisms to protect against unauthorized system tampering.

Hopefully it's not too late for car manufacturers to (at least) bring the same level of engineering scrutiny to software aspects of their products as they do the mechanical. Because it's one thing to tolerate shoddy software engineering (now, that's an oxymoron isn't it) within PC and enterprise applications: it's a number of magnitudes greater to have to worry about attackers gaining control of any aspect of your vehicle while cruising down the highway.

For my security and technology observations throughout the day consider following me on Twitter.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Current Issue
Dark Reading Tech Digest September 7, 2015
Some security flaws go beyond simple app vulnerabilities. Have you checked for these?
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
Published: 2015-10-08
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.

Published: 2015-10-06
libstagefright in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 21335999.

Published: 2015-10-06
Bluetooth in Android before 5.1.1 LMY48T allows attackers to remove stored SMS messages via a crafted application, aka internal bug 22343270.

Published: 2015-10-06
mediaserver in Android before 5.1.1 LMY48T allows attackers to cause a denial of service (process crash) via unspecified vectors, aka internal bug 22954006.

Published: 2015-10-06
The Runtime subsystem in Android before 5.1.1 LMY48T allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 23050463.

Dark Reading Radio
Archived Dark Reading Radio
What can the information security industry do to solve the IoT security problem? Learn more and join the conversation on the next episode of Dark Reading Radio.