Connected car security: connected and secure.

Average reading time 10 minutes

For a century, motorists had one main security concern: that a thief would smash the window and steal the car.

Now, they have other concerns.

In the emerging connected car era, thieves don’t need to pick locks to take control of the vehicle. They don’t even need to be physically present. And they can do more than steal the car.

Think about it for a minute.

In theory, they can disable key functions like steering or brakes or even use the microphone to listen to conversations.

Let's dig in.

The connected car hack

The connected car hack is the regrettable flipside of the motor industry's digitization: if your car is becoming another IoT device, it can be hacked like any other IoT device. 

Indeed, the connected car cybersecurity threat is real enough for even the FBI to make a statement about it.

Though terrorism and sabotage are possible, experts believe financial crime is far more likely.

Andy Davis, Transport Cyber Security Practice Director at NCC Group, says: “Media reports tend to focus on the physical attacks, but most cyberattacks come from organized crime groups – and they want to make money, not kill the general public.”

Car hackers can be expected to use the same methods they use on PC users.

Ransomware, for example.

Here, criminals will hack into a vehicle, disable it, and demand money from drivers or manufacturers to relinquish control. Davis says: “You get in the car, and a message on the infotainment system says: ‘Send money if you want your car to start.’ I can also see hackers stealing ID and card details from cars to sell on the black market.”

Why is this?

What compounds the car's cybersecurity threat is the sheer number of entry points into the vehicle. Criminals can sneak in via telematics systems or even the radio.

They can also hack into the many external devices – phones, key cards – that drivers link to the car’s electronic control unit (ECU).

Regrettably, car cybersecurity crimes are now rising.

According to Upstream’s Automotive Cybersecurity Report, annual incidents went up 605% from 2016 to 2019.

The top three attack vectors were :

• keyless entry systems (30%),
• backend servers (27%),
• mobile apps (13%).
   

Re-thinking connected car security

So without question, the connected car hack is a huge challenge for the motor industry.

It demands a mental re-think from companies that have traditionally been unaffected by cybercrime.

Indeed, a 2019 study of industry security practitioners by the Ponemon Institute found just 10% of companies currently have an established cybersecurity team.

So how can the industry fight back?

According to Deloitte, specialists agree the starting point should be ‘security by design.’

Car manufacturers need to build in security from the start, rather than patch ‘holes’ as they arise. This will require multi-party collaboration, given the hundreds of suppliers producing parts for today’s cars.

The process will start with securing the connected car’s firmware and software applications (using public key infrastructure, or PKI, and other tools).

But it’s also critical to encrypt the data transmitted to and from the car, both at rest and in motion.

There's more.

Of course, this security must extend across the life of the vehicle.

Manufacturers should be able to disable connected services during shipping, for example, and can deliver over-the-air software updates to prevent data breaches. 

Connected car cybersecurity and the future

The good news is that carmakers are working hard to address the growing threat against connected car security.

They are teaming up with security experts and investing in new technology. Last year, for example, a consortium of car manufacturers invested US$30 million in-car cybersecurity startup Upstream.

Of course, it's not just manufacturers that need to wise up. Motorists must take responsibility too. After all, no end of technical protection will help if hackers can just use social engineering to dupe the connected car driver.

In 2016, security firm Promon proved this when it created a free WiFi hotspot and asked drivers to install an app on their phones. The app was infected with malware and gave hackers the ability to take control of the car.

And what persuaded the drivers to install such a dangerous app?

A free burger.
 

Related contents to vehicle cybersecurity

• The 7 Benefits of autonomous cars
• I can´t get lost - I´m driving a four-wheeled computer.
• Discover our End-to-End Cybersecurity for Connected Vehicles brochure
• Discover our whitepaper: Securing Connected Cars for your Safety