Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

5/16/2010
09:39 PM
George V. Hulme
George V. Hulme
Commentary
50%
50%

Automobiles Growing Vulnerable To Hacks

Carmakers are rolling automobiles off the assembly line with plenty of fancy new high-tech features. Unfortunately, security is -- once again -- treated as an afterthought.

Carmakers are rolling automobiles off the assembly line with plenty of fancy new high-tech features. Unfortunately, security is -- once again -- treated as an afterthought.

Modern automobiles are no longer mere mechanical devices; they are pervasively monitored and controlled by dozens of digital computers coordinated via internal vehicular networks. While this transformation has driven major advancements in efficiency and safety, it has also introduced a range of new potential risks.

So starts the research report, Experimental Security Analysis of a Modern Automobile, published by a team of IT security researchers from the University of California, San Diego and the University of Washington.

Anyone who is interested in the security of information systems might want to give this paper a read. Although those who have been following the security of IT infrastructure and PCs during the past fifteen years may be struck with an eerie feeling of Déjà Vu.

Just as PCs became increasingly networked in the 1990s, and operating systems were crammed with new features, security risks also increased. And when PCs and LANs were connected to the Internet: those risks went parabolic. There wasn't much attention paid to how adversaries - virus writers, curiosity seeking hackers, and outright criminals would use systems to snoop, disrupt, and destroy.

It seems carmakers may be repeating the mistakes of the IT industry, according to the report:

The attack surface for modern automobiles is growing swiftly as more sophisticated services and communications features are incorporated intovehicles. In the United States, the federally-mandated On-Board Diagnostics (OBD-II) port, under the dash in virtuallyall modern vehicles, provides direct and standard access to internal automotive networks. User-upgradable subsystems such as audio players are routinely attached to these same internal networks, as are a variety of shortrange wireless devices (Bluetooth, wireless tire pressure sensors, etc.). Telematics systems, exemplified by General Motors' (GM's) OnStar, provide value-added features such as automatic crash response, remote diagnostics, and stolen vehicle recovery over a long-range wireless link. To do so, these telematics systems integrate internal automotive subsystems with a remote command center via a wide area cellular connection. Some have taken this concept even further-proposing a "car as a platform" model for third-party development.

The researchers found that attackers can grab control of a range of functions of the car, and override driver input, such as disabling breaks and even stopping the engine. Here's what one of the researchers had to say to The New York Times regarding their research:

"We noticed the extent to which automobiles were becoming computerized," said Stefan Savage, a computer scientist at U.C.S.D. who was a member of one of two groups that have been studying the electronic control units of two different cars to look for network vulnerabilities that could be exploited by a potential attacker. "We found ourselves thinking we should try to get in front of this before it suddenly becomes an issue."

Many of the vulnerabilities of automotive systems that make attacks possible will sound familiar to IT security professionals such: poor authentication, weak access control, and poor challenge-response mechanisms to protect against unauthorized system tampering.

Hopefully it's not too late for car manufacturers to (at least) bring the same level of engineering scrutiny to software aspects of their products as they do the mechanical. Because it's one thing to tolerate shoddy software engineering (now, that's an oxymoron isn't it) within PC and enterprise applications: it's a number of magnitudes greater to have to worry about attackers gaining control of any aspect of your vehicle while cruising down the highway.

For my security and technology observations throughout the day consider following me on Twitter.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
DevSecOps: The Answer to the Cloud Security Skills Gap
Lamont Orange, Chief Information Security Officer at Netskope,  11/15/2019
Attackers' Costs Increasing as Businesses Focus on Security
Robert Lemos, Contributing Writer,  11/15/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-16860
PUBLISHED: 2019-11-19
Code42 app through version 7.0.2 for Windows has an Untrusted Search Path. In certain situations, a non-administrative attacker on the local machine could create or modify a dynamic-link library (DLL). The Code42 service could then load it at runtime, and potentially execute arbitrary code at an ele...
CVE-2019-16861
PUBLISHED: 2019-11-19
Code42 server through 7.0.2 for Windows has an Untrusted Search Path. In certain situations, a non-administrative attacker on the local server could create or modify a dynamic-link library (DLL). The Code42 service could then load it at runtime, and potentially execute arbitrary code at an elevated ...
CVE-2014-5118
PUBLISHED: 2019-11-18
A Security Bypass Vulnerability exists in TBOOT before 1.8.2 in the boot loader module when measuring commandline parameters.
CVE-2019-12422
PUBLISHED: 2019-11-18
Apache Shiro before 1.4.2, when using the default "remember me" configuration, cookies could be susceptible to a padding attack.
CVE-2012-4441
PUBLISHED: 2019-11-18
Cross-site Scripting (XSS) in Jenkins main before 1.482 and LTS before 1.466.2 allows remote attackers to inject arbitrary web script or HTML in the CI game plugin.