Risk
5/16/2010
09:39 PM
George V. Hulme
George V. Hulme
Commentary
50%
50%

Automobiles Growing Vulnerable To Hacks

Carmakers are rolling automobiles off the assembly line with plenty of fancy new high-tech features. Unfortunately, security is -- once again -- treated as an afterthought.

Carmakers are rolling automobiles off the assembly line with plenty of fancy new high-tech features. Unfortunately, security is -- once again -- treated as an afterthought.

Modern automobiles are no longer mere mechanical devices; they are pervasively monitored and controlled by dozens of digital computers coordinated via internal vehicular networks. While this transformation has driven major advancements in efficiency and safety, it has also introduced a range of new potential risks.

So starts the research report, Experimental Security Analysis of a Modern Automobile, published by a team of IT security researchers from the University of California, San Diego and the University of Washington.

Anyone who is interested in the security of information systems might want to give this paper a read. Although those who have been following the security of IT infrastructure and PCs during the past fifteen years may be struck with an eerie feeling of Déjà Vu.

Just as PCs became increasingly networked in the 1990s, and operating systems were crammed with new features, security risks also increased. And when PCs and LANs were connected to the Internet: those risks went parabolic. There wasn't much attention paid to how adversaries - virus writers, curiosity seeking hackers, and outright criminals would use systems to snoop, disrupt, and destroy.

It seems carmakers may be repeating the mistakes of the IT industry, according to the report:

The attack surface for modern automobiles is growing swiftly as more sophisticated services and communications features are incorporated intovehicles. In the United States, the federally-mandated On-Board Diagnostics (OBD-II) port, under the dash in virtuallyall modern vehicles, provides direct and standard access to internal automotive networks. User-upgradable subsystems such as audio players are routinely attached to these same internal networks, as are a variety of shortrange wireless devices (Bluetooth, wireless tire pressure sensors, etc.). Telematics systems, exemplified by General Motors' (GM's) OnStar, provide value-added features such as automatic crash response, remote diagnostics, and stolen vehicle recovery over a long-range wireless link. To do so, these telematics systems integrate internal automotive subsystems with a remote command center via a wide area cellular connection. Some have taken this concept even further-proposing a "car as a platform" model for third-party development.

The researchers found that attackers can grab control of a range of functions of the car, and override driver input, such as disabling breaks and even stopping the engine. Here's what one of the researchers had to say to The New York Times regarding their research:

"We noticed the extent to which automobiles were becoming computerized," said Stefan Savage, a computer scientist at U.C.S.D. who was a member of one of two groups that have been studying the electronic control units of two different cars to look for network vulnerabilities that could be exploited by a potential attacker. "We found ourselves thinking we should try to get in front of this before it suddenly becomes an issue."

Many of the vulnerabilities of automotive systems that make attacks possible will sound familiar to IT security professionals such: poor authentication, weak access control, and poor challenge-response mechanisms to protect against unauthorized system tampering.

Hopefully it's not too late for car manufacturers to (at least) bring the same level of engineering scrutiny to software aspects of their products as they do the mechanical. Because it's one thing to tolerate shoddy software engineering (now, that's an oxymoron isn't it) within PC and enterprise applications: it's a number of magnitudes greater to have to worry about attackers gaining control of any aspect of your vehicle while cruising down the highway.

For my security and technology observations throughout the day consider following me on Twitter.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: just wondering...Thanx
Current Issue
Security Operations and IT Operations: Finding the Path to Collaboration
A wide gulf has emerged between SOC and NOC teams that's keeping both of them from assuring the confidentiality, integrity, and availability of IT systems. Here's how experts think it should be bridged.
Flash Poll
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.

Dark Reading Radio
Archived Dark Reading Radio
In past years, security researchers have discovered ways to hack cars, medical devices, automated teller machines, and many other targets. Dark Reading Executive Editor Kelly Jackson Higgins hosts researcher Samy Kamkar and Levi Gundert, vice president of threat intelligence at Recorded Future, to discuss some of 2016's most unusual and creative hacks by white hats, and what these new vulnerabilities might mean for the coming year.