Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

10/25/2016
04:55 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

NHTSA Issues Cybersecurity Best Practices For Automakers

Focus is on limiting access to electronic components and what someone can do with that access.

The National Highway Traffic Safety Administration (NHTSA) has issued a set of cybersecurity best practices for connected cars.

Vehicle cybersecurity has captured the attention of safety experts in the wake of security researchers demonstrating how attackers can take advantage of vulnerable electronic components in modern connected cars to gain independent control of critical vehicle functions.

The most dramatic examples have been from security researchers Charlie Miller and Chris Valasek of Uber’s Advanced Technology Center, who as recently as this August demonstrated an attack in which they took over a 2014 Jeep Cherokee’s steering, accelerator, and braking system while the vehicle was moving.

Like the NHTSA's earlier research on the topic, the new recommendations contained in the 22-page report released this week are non-binding and meant to serve purely as guidance for automakers. 

But since the NHTSA’s recommendations are non-binding, it’s unclear how many automakers will implement them.

Many of the recommendations cover the things that automakers need to be focusing on during the manufacturing process like secure development practices, information sharing, vulnerability disclosure, and reporting, incident response, and self-auditing.

But a big section is focused on some of the fundamental cybersecurity precautions that automakers need to deploy in the vehicles themselves. The emphasis here is on restricting access to critical components in connected vehicles and on limiting what someone with access could do with it.

For example, the NHTSA wants manufacturers to consider limiting or even eliminating the access that developers have to the Electronic Control Units (ECUs) in their vehicles. Often such access is facilitated via a debugging port or serial console, the NHTSA said.  

"Any developer-level debugging interfaces should be appropriately protected to limit access to authorized privileged users," the NHTSA said. Merely hiding connectors, traces, or pins that enable debugging access does not provide security, the report noted.

Similarly, the NHTSA wants automakers to implement controls that limit the ability for anyone to modify firmware in a vehicle’s electronic components. For example, by using digital-signing technologies, manufacturers can make it much harder for attackers to make an unauthorized modification or to install rogue software.

Physical and logical segmentation and isolation of critical electronic components should be implemented to limit the damage from external threats, the NHTSA said.

Some of the proof-of-concept attacks against connected vehicles have involved researchers first exploiting a weakness in one component—like a vehicle’s entertainment system—and then using that entry point to try and access other components.

By separating processors, vehicle networks and external connections to the extent possible manufacturers can limit and control the pathways that an attacker might use to escalate privileges, the NHTSA said in its recommendations.

"Strong boundary controls, such as strict white list-based filtering of message flows between different segments, should be used to secure interfaces," it noted.

The NHTSA also wants automakers to consider include limiting access to vehicle maintenance diagnostics; controlling access to firmware via encryption, for example; and limiting the number of network ports, protocols, and services in vehicles.

Major automakers, cognizant of the concerns over cybersecurity at the government and regulatory levels, and anxious to stave off regulation, have already taken steps to address securing cars at the industry level.

For example, the 12-member Alliance of Automobile Manufacturers, comprised of companies like Ford, General Motors, Chrysler, and Toyota, is currently working on an industry-wide effort to identify emerging threats to connected vehicles and measures for mitigating them.

Related stories:

  

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-20001
PUBLISHED: 2020-08-04
An issue was discovered in RICOH Streamline NX Client Tool and RICOH Streamline NX PC Client that allows attackers to escalate local privileges.
CVE-2020-15467
PUBLISHED: 2020-08-04
The administrative interface of Cohesive Networks vns3:vpn appliances before version 4.11.1 is vulnerable to authenticated remote code execution leading to server compromise.
CVE-2020-5615
PUBLISHED: 2020-08-04
Cross-site request forgery (CSRF) vulnerability in [Calendar01] free edition ver1.0.0 and [Calendar02] free edition ver1.0.0 allows remote attackers to hijack the authentication of administrators via unspecified vectors.
CVE-2020-5616
PUBLISHED: 2020-08-04
[Calendar01], [Calendar02], [PKOBO-News01], [PKOBO-vote01], [Telop01], [Gallery01], [CalendarForm01], and [Link01] [Calendar01] free edition ver1.0.0, [Calendar02] free edition ver1.0.0, [PKOBO-News01] free edition ver1.0.3 and earlier, [PKOBO-vote01] free edition ver1.0.1 and earlier, [Telop01] fre...
CVE-2020-5617
PUBLISHED: 2020-08-04
Privilege escalation vulnerability in SKYSEA Client View Ver.12.200.12n to 15.210.05f allows an attacker to obtain unauthorized privileges and modify/obtain sensitive information or perform unintended operations via unspecified vectors.