Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

7/14/2015
03:55 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Automobile Industry Gears Up For Cyber-Threat Intel-Sharing

New auto industry ISAC is now official, with major automakers as the charter members.

A year in the making, the automobile industry's new intelligence sharing and analysis center (ISAC) is now official and revving up to begin disseminating and exchanging cyber threat information later this year.

Heightened concerns over the safety of a rapidly emerging generation of networked vehicles initially led the Alliance of Automobile Manufacturers and the Association of Global Automakers to first begin mulling an ISAC in July of 2014, when they announced plans to address security weaknesses and vulnerabilities in vehicle automation and networking features that could put cars at risk of being hacked for sabotage or other purposes.

More than 60% of all new vehicles by 2016 are expected to be connected to the Internet, so the official launch of an automobile ISAC comes at a crucial time. Meanwhile, security researchers have been hacking away at networked cars to find bugs before the bad guys do, as the auto industry has remained relatively mum publicly on the topic of cybersecurity threats to their vehicles.

Officials from the Alliance of Automobile Manufacturers -- of which 12 major carmakers, such as BMW Group, Fiat Chrysler, Ford, General Motors, Mazda, and Toyota are members -- and the Association of Global Automakers -- which includes Honda, Nissan, Subaru, and others -- Booz Allen Hamilton, and SAE International, today announced that the auto industry's ISAC is now officially close to going live. Word of the ISAC came in conjunction with the 2015 SAE Battelle Cyber Auto Challenge in Detroit, where students work with automakers and government agencies on secure system design via hands-on cybersecurity activities.

Rob Strassburger, vice president of vehicle safety and harmonization for the Alliance of Automobile Manufacturers, said the ISAC will provide a central hub for cyber threat information and analysis, as well as vulnerabilities found in vehicles and their associated networks. "Automakers around the world will receive this information from the ISAC," he said.

The ISAC initially will not include suppliers from the auto industry, but it will extend to them as well as telecommunications and other technology providers as the ISAC matures, he said.

Meanwhile, the auto industry has been working on other cybersecurity initiatives aimed at locking down vehicle security and safety, according to Paul Scullion, safety manager with Association of Global Automakers. "An ISAC will bring insights on the threat landscape. Sharing of threats is just one piece," he said. Carmakers also are conducting research and development in "secure by design" features and functions, he said.

Several industry efforts also are underway, he noted: hackathons, a cybersecurity task force, and research with the National Institute of Standards and Technology (NIST), among other efforts, Scullion said. "OEMs are engaged with third-party security vendors and academia" to develop vehicle-specific technologies, he said.

Among the security technologies on the horizon for vehicles: enhanced network firewalls, software monitoring, and the ability to deny malicious traffic from bad guys to the car. "Privacy is another issue automakers are taking steps to address," Scullion said.

So just what type of intel would automakers share via the ISAC? Vulnerabilities and threats hitting them, for example, which of course likely will get anonymized. "Threat data could be nation-state, it could be a code vulnerability," said Jon Allen, principal for commercial solutions at Booz Allen Hamilton, the contractor who helped the auto industry set up the ISAC.

[Working group of federal agencies and private industry launched by the state of Virginia is studying car vulnerabilities and building tools to detect and protect against vehicle hacking and tampering. Read Hacking Virginia State Trooper Cruisers.]

Interestingly, the organizers of the ISAC have not contacted renowned car hacking researchers Charlie Miller and Chris Valasek for their input, according to Miller. Miller says he's glad to see the automotive industry addressing security issues, but it's difficult to tell just what progress they have made.

"I think they'll see at Black Hat/DEF CON this year that security researchers still have a lot to give of information to provide manufacturers," Miller says. "I'd really like to see more transparency about how automotive systems are designed to resist attack as well as how they detect and react to attacks. Right now it is possible, although I think unlikely, that manufacturers are doing a great job in this area in securing vehicles, but at this point there is no way for anyone outside of the industry to tell.  

"In my personal experience, it seems the auto industry has a ways to go in making automotive systems secure, resilient, and reactive to attacks," Miller says.

The challenge for automakers with their new ISAC will be both the trust factor among fierce competitors--true for nearly all ISACs when they first get up and running--and the fact that a vulnerability or threat may only affect a very specific make, model and year of a vehicle. Even so, the auto industry OEM ecosystem is such that most automakers use a lot of the same suppliers, so if the OEM products have bugs, so will many of the cars.

"Currently, every OEM has its own unique architecture and that will probably continue going forward. But with greater interconnection, that means by definition some greater commonality in features and functions on these networks," Strassburger said. "We're acting now to collect and share this [threat] information" and make it actionable, he said.

The chair of the Industrial Control Systems ISAC (ICS-ISAC), Chris Blask, says the "elephant in the room" for all information-sharing groups and ISACs today is the need for accepted standards in processes and policy for intel-sharing. "There are massive gaps" in that piece of the puzzle for full intel-sharing, Blask says.

Booz-Allen Hamilton's Allen noted that unlike other ISACs, the automobile ISAC is getting a jump-start on real attacks. "Many ISACs come after" their industries are hit with attacks, he said.

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 10/23/2020
Modern Day Insider Threat: Network Bugs That Are Stealing Your Data
David Pearson, Principal Threat Researcher,  10/21/2020
Are You One COVID-19 Test Away From a Cybersecurity Disaster?
Alan Brill, Senior Managing Director, Cyber Risk Practice, Kroll,  10/21/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-7753
PUBLISHED: 2020-10-27
All versions of package trim are vulnerable to Regular Expression Denial of Service (ReDoS) [DNP] via trim().
CVE-2020-27182
PUBLISHED: 2020-10-27
Multiple cross-site scripting (XSS) vulnerabilities in konzept-ix publiXone before 2020.015 allow remote attackers to inject arbitrary JavaScript or HTML via appletError.jsp, job_jacket_detail.jsp, ixedit/editor_component.jsp, or the login form.
CVE-2020-27183
PUBLISHED: 2020-10-27
A RemoteFunctions endpoint with missing access control in konzept-ix publiXone before 2020.015 allows attackers to disclose sensitive user information, send arbitrary e-mails, escalate the privileges of arbitrary user accounts, and have unspecified other impact.
CVE-2020-8956
PUBLISHED: 2020-10-27
Pulse Secure Desktop Client 9.0Rx before 9.0R5 and 9.1Rx before 9.1R4 on Windows reveals users' passwords if Save Settings is enabled.
CVE-2020-15352
PUBLISHED: 2020-10-27
An XML external entity (XXE) vulnerability in Pulse Connect Secure (PCS) before 9.1R9 and Pulse Policy Secure (PPS) before 9.1R9 allows remote authenticated admins to conduct server-side request forgery (SSRF) attacks via a crafted DTD in an XML request.