The Automotive Industry: Stepping up on Defense

We are midway through 2019, and automotive hacks continue to rise. The global market for connected cars is expected to grow by 270% by 2022, with more than 125 million passenger cars with embedded connectivity forecast to ship worldwide by 2022.

The amount and quality of data is only destined to grow as manufacturers add more technology into the driver and the passenger experience, especially as we approach a time when cars will be capable of autonomously taking passengers from point A to point B.

Cyberattacks on automotive players were not very common until recently, likely due to the fact that not too long ago, there was simply nothing to hack in an automobile. In recent years our dashboards have grown from basic entertainment systems to computers. As the incentive for hackers is growing we should assume as are the efforts to breach the data in automobiles. There has been astounding progress with car technology in recent years, particularly in the connectivity channels, WiFi, GPS systems, Bluetooth and now cellular SIM cards embedded in the vehicle. The significant increase in mobility endpoints and the sheer amount of code that runs the modern car means that there is a great opportunity for hackers.

A Great Infotainment System means Great Vulnerability

Car dashboards today are a full computers, with a multitude of different functions, such as in-vehicle entertainment, mobile phone integration, navigation systems, and soon, payment systems. While advancements in technology have improved the user experience, there is also increased  vulnerability.

In addition, infotainment and telematics systems have become a gateway to the car’s advanced driver assistance systems, by linking to data that can affect a car’s safety features, such as sensors, anti-lock brakes, lane departure warnings, adaptive cruise control, and automatic stopping the car.

Black Hat Attacks

Recently a black hat attack was carried out that was far from simplistic. A hacker named L&M has gained access into two prominent applications companies [mention their names] use to monitor and manage fleets through GPS tracking devices. This hacker boldly called the companies requesting money for the information he or she stole from over 27,000 accounts. This was not a white hat attack nor was it a bug bounty – this was ransom.

What is unique about this situation is the hacker was also able to kill the engine of the vehicle of the account holder. L&M could have caused much more destruction and harm with this hack.

These situations should act as a light bulb for automakers to understand the vulnerabilities their vehicles face. Securing a modern car against a cybersecurity attack is about preventing them from the earliest stages of development. Original Equipment Manufacturers (OEMs) should consider incorporating defensive measures during the development phase.

As the in-vehicle technology continues to innovate, hackers are continuing to learn and find vulnerabilities to exploit the physical car as well as the personal, financial and driver data. Through a vehicle’s infotainment and telematics system, we see these vulnerabilities more clearly and can understand just how white hat hackers are gaining access. Through these discoveries, security companies are helping car manufacturers outfit their vehicles with embedded cybersecurity software that protects vehicles from all endpoints as to not allow access to the vehicle’s data or alter the settings from factory settings. As we approach the second half of 2019, we anticipate automotive and other connected device manufacturers to recognize their vulnerabilities and step up their defensive strategy. 

About the author: David Barzilai is co-founder and chairman at Karamba Security.

Copyright 2010 Respective Author at Infosec Island via Infosec Island Latest Articles "https://ift.tt/2XP5W5C"