► How Tesla is stopping the hackers
► Connected cars are open to attack
► Why in-car security is paramount
Cars are becoming intrinsically connected – tech consultants Gartner estimates there will be 250 million connected cars on the road by 2020. And with that, the threat of cyber attack mushrooms, creating the potential for nightmare scenarios.
‘Imagine the joy of the London Olympics souring if connected cars had driven into east London and ground to a halt,’ muses Will Rockall of KPMG cyber security. ‘Vehicles transporting high value goods could be hijacked remotely, or the fantastical notion of rich individuals being kidnapped or their vehicles caused to crash.’
They sound like plotlines from Hollywood movies, but as consumers demand more digital features – vehicle-to-infrastructure communication, on-board Wi-Fi, over-the-air servicing – and manufacturers layer on self-driving capabilities such as autonomous parking and highway piloting – the number of cyber attack vulnerabilities increases, with serious implications.
How Tesla Motors suffered an online attack
Go online and you can watch Chinese researchers, Keen Security Laboratory, remotely commandeer two Teslas, moving seats, operating brakes and opening the rear hatch, all via a hack.
And this is merely the latest high profile automotive attack: a few years back, US researchers Charlie Miller and Chris Valasek managed to overcome the brakes of a Ford Fusion and Toyota Prius via physical access to the cars’ on-board diagnostics sockets, while Fiat Chrysler had to recall 1.4 million cars to beef up infotainment system security.
‘The risk in automotive is huge: imagine the impact on other road users of uncontrolled sudden swerving or braking,’ says government advisor on cyber security Tony Dyhouse.
Why connected cars are vulnerable
The vulnerability is a car’s electronic network, where up to 100 electronic control units controlling individual functions such as steering wheel angle or the anti-lock brakes, can be linked together.
Hackers, driven by ego, mischief or backed by organised crime, could access a car’s network via Bluetooth, malware in connected smartphone apps, or the cellular/Wi-Fi system – dubbed the ‘Holy Grail’ because of its ability to transfer data into and around a car’s network.
‘Often, information flows from one ECU to another,’ continues Tony Dyhouse. ‘The car is a browser on wheels: you need to protect the network with firewalls and intruder detection systems.’
In the Tesla attack, the researchers accessed the car via fake Wi-Fi, then exploited the CAN Bus network to control driving systems. Tesla responded that the chain of events posed an unlikely risk, but issued a patch within 10 days.
Updates to the firmware code now needs a cryptographic key known only to Tesla, the firm told Wired, claiming a cyber security high-water mark in cars.
How the hackers attacked Tesla
1) Attack on Tesla
Chinese researchers set up a malignant Wi-Fi hotspot, to which the Model S’s web browser connected, giving the hackers access from up to 12 miles away. According to Wired magazine, the car’s operating system could then be penetrated, and in a critical third stage new code imported to fiddle with the car’s brakes, seat movements and hatch access.
2) The Achilles’ heels
A car’s CAN Bus ‘nervous system’ networks all the vehicle’s electronic control units (ECUs), which manage functions such as brakes and accelerator. Up to 100 ECUs per car provide multiple vulnerabilities, accessed via the web or Bluetooth. The onboard diagnostics port has proven the entry point for many documented hacks – malware could be unwittingly added during chipping, for example.
3) Tesla’s response
Tesla quickly issued software patches to fix the web browser and operating system weaknesses. To these braces, it also added a belt: no firmware updates can be installed without Tesla’s unique cryptographic key. Given Tesla’s vertical integration over its parts manufacture and service centres, this might prove easier for Elon Musk to roll out than other carmakers.
4) Designing in security
‘Luxury cars have more than 200 million lines of code – and even giants such as Google frequently issue patches to fix its security issues. So protecting cars requires a wholesale rethink of the supply chain’s internet and computer security to prevent malware infecting low level components that are then integrated into vehicles,’ says Asaf Atzmon of Harman. He says the public is becoming more aware and concerned – hardly surprising, if Russia can hack the US presidential election…
Click here for more car tech news