Car Hacking: How Automakers Are Racing to Beat the Threat
As anyone who has shopped for a car lately can attest, modern vehicles are increasingly becoming rolling computers. Remote start, voice commands, adaptive cruise control, collision avoidance systems and automated parking are just a few of the hundreds of computer-based features offered in today’s cars. As many as 100 individual computers can now be found in some models. Because these systems are interconnected via a controller area network (called a CAN Bus) and offer Bluetooth or internet connectivity in some form, that makes them a potential target for hackers.
In just the last two years, a string of prominent, non-malicious attacks conducted by white-hat security researchers have revealed vulnerabilities in vehicles produced by General Motors, Chrysler and Tesla.
Last February, a researcher at the Defense Advanced Research Projects Agency (DARPA) showed 60 Minutes how he was able to gain control of GM’s OnStar emergency communications system and use it to spread malicious code in other computers in the vehicle. Using this access, he was able to remotely steer, apply the vehicle’s brakes and even cut them off completely.
Later that year, a separate team of researchers from the University of California San Diego hacked a 2013 Chevy Corvette by exploiting a weakness in a telematics dongle produced by a company called Metromile. That product’s cellular connectivity—which isn’t designed to control the vehicle in any way—was used to distribute code to the CAN Bus, which in turn gave the researchers access to critical systems simply by sending text messages.
Last summer, a pair of hackers demonstrated a remote hack of a Jeep Cherokee to a reporter as he drove the vehicle on a highway. They were able to control everything from the SUV’s climate control system to its transmission and brakes, at one point forcing it to slow to a crawl as traffic piled up behind. The hackers had previously demonstrated similar capabilities with a Ford Escape and a Toyota Prius.
Chrysler’s Uconnect system, which delivers connectivity, infotainment, navigation and voice commands to all of its vehicle lines, allowed remote access to anyone with a smartphone and knowledge of the vehicle’s IP address. Gaining access to a wireless connectivity module was just the first in a series of separate hacks needed to gain control of a car’s brakes. But it’s also just one of dozens of methods hackers can use to make that crucial initial breach.
Chrysler patched its software to prevent similar attacks before the research was released to the public, recalling 1.4 million vehicles.
Last month, Tesla made unwelcome headlines by falling victim to a severe hack performed by Tencent, a Chinese security firm. Because the Tesla Model S is a fully-electric vehicle controlled entirely by computers, the team was able to commandeer pretty much any functionality it wanted to. What’s more, the hack required no physical access or special knowledge about the vehicle. All the researchers needed to do was spoof a wireless hotspot and trick the car into thinking it was connecting to the internet at a Tesla dealership, causing it to automatically connect to the network and download malicious code.
Tesla responded by immediately pushing updated firmware out to all of its vehicles to fix the specific flaws. Unlike previous targets though, the carmaker also had a broader plan of action that went beyond the typical software patch, rushing to implement a “code-signing” technology it had been working on for years.
As demonstrated by Apple’s recent battles with the FBI, hacking a smartphone has become very difficult in recent years. Usually, a hacker will need to use social engineering to gain a victim’s trust—or at least temporary access to their unlocked phone. That’s because any updates to the phone’s software include a sophisticated cryptographic key that only the manufacturer itself can generate. When code attempts to install itself without a matching encryption key, it triggers the phone to recognize it as an attack.
Before Tesla’s most recent firmware update, no car offered that protection across its entire network of onboard computers. According to Tesla CTO JB Straubel, this prevents small security vulnerabilities from spreading beyond the initial point of attack.
Code signing is just one of a number of technologies being developed to make connected cars more secure. Another approach is based on monitoring commands sent through the CAN Bus for irregularities that would be unlikely to occur during natural operation of the vehicle.
More and more vehicles are also capable of receiving software updates from the manufacturer remotely, rather than relying on owners to bring their cars in as part of a recall. In non-updated older vehicles, hackers have years to string together chains of vulnerabilities in different systems. In a vehicle receiving regular remote updates, those flaws can be recognized and fixed before becoming part of a larger attack.
Carmakers Are Adapting Quickly
As digital control systems become more widespread and interconnected, carmarkers have become increasingly serious about developing comprehensive solutions to the threat of hacking. Thus far, there have been no reports of malicious remote hacks that compromised a driver safety by taking control of a vehicle.
The industry has a lot invested in gaining the public’s trust in robust high-tech features. On average, more than a quarter of a new vehicle’s cost is now attributed to computers and electronics, and that number is expected to increase significantly in just the next five years. Fully autonomous cars are also expected to break into the market soon, but in order to clear regulatory hurdles, manufacturers will have to demonstrate unprecedented levels of digital security.
While no networked computer can ever be truly hack-proof, the specific flaws exposed by researchers in the last few years are unlikely to be remain threats for long. Remote access via wireless networks and smartphone apps can be made more secure. Increasingly, hacking will depend on social engineering and gaining physical access to a vehicle, meaning that the impetus in securing vehicles will be on the owners and operators themselves.
Next week, we’ll look at how individuals and fleets can make their vehicles more secure now—and position themselves to defend against the threats of the future.
*featured image by