Blogs

Safeguarding the connected car

The Internet of Things is one of the most interesting technological advancements we have today. And within this spectrum, the connected car is perhaps the most exciting and advanced ‘thing’ in that ecosystem, writes Mark Hughes, the chief executive of BT Security. Connected cars have a range of wildly clever features; from intelligent driver assistance and predictive systems that help bypass traffic jams, to sensors that help track driver behaviour and reduce emissions. 

A report from McKinsey puts the computing power of the connected car at 20 times the power of personal computers, featuring about 100 million lines of programming code, and processing up to 25 gigabytes of data an hour. The power of this technology and the possibilities that it creates will change the way we drive, but it’s important that we ensure that we are fully prepared to identify and address any potential threats. Only with a complete peace of mind will we be able to enjoy the full advantages of connected cars.

There are a number of conversations about the potential of connected cars and what the future will bring. The connected car has the ability to not only revolutionise travel, but to change the way humans perceive distance and destinations. It’s an exciting vision for the not too distant future, but this version of reality comes with a number of risks. Remotely connected vehicles are at greater risk of being compromised with malicious software and could even be vulnerable to hijacking. Just last year, researchers from the US proved that they could hack into a Jeep Cherokee from a laptop ten miles away. While the connected car has been heralded as one of the most exciting pieces of innovative technology in our grasp, without the right safeguards, it presents a serious threat to the privacy, security and safety of everyone it shares the road with.

The rolling risks

But surely a connected car can be protected in the same way that we protect our devices at home, or at work? While addressing the challenges of securing the connected car might sound straightforward, securing connected vehicles pose a unique set of cyber security challenges for car manufacturers. On the whole, they have limited experience addressing these kinds of technological issues. The physical computing hardware in connected cars, for example, are fixed for the lifetime of the vehicle. This means they are at greater risk of malfunction because hardware lifecycles aren’t aligned with that of vehicles.

Some manufacturers have considered using traditional software such as VPNs to secure data transmissions between vehicles, the internet and other machine-to-machine (M2M) devices that may be at use in the connected car. However this presents its own challenge; these VPNs were never designed to protect against the millions of entities living outside of the firewall. Sub-systems in connected vehicles need to talk freely with each other and presents a potential loophole opportunity for hackers.

When mechanical and digital systems are integrated, new threats must be addressed and accounted for – especially when human life is at stake. Manufacturers need to consider the asset being protected, the known attack surface and the capabilities of potential attackers. It is rare that these loopholes can be known during the design phases of a product and so manufacturers must consider the long-term implications for using a particular piece of hardware or software. Manufacturers must keep product longevity, security, privacy and consistency in mind when designing connected vehicles – and still be flexible and forward thinking in their approach.

Defending the networks

One question on many cyber security specialists’ minds is how manufacturers can securely defend the network that keeps the cars and their environment connected. Indeed, how to secure the network without hindering the openness that the connected car thrives on? In order to address this, car manufacturers must consider the relevant theoretical vulnerabilities and analyse the huge spectrum of potential threats. It is vital that automotive manufacturers are aware of the entire unique threat landscape that connected cars inhabit, with the likes of tyre pressure monitoring system (TMPS) attacks and hacking of navigation and infotainment systems among the greatest dangers.

In the example of TMPS, a network of sensors in each tyre wirelessly transmits information about tyre pressure to the vehicles’ core computer system. If the signal is hijacked, the location of a particular car at any given time can be obtained.

Hackers are also able to hijack connected cars via the Controller Area Network Bus (CAN bus) systems. The CAN bus system uses a simple protocol which allows devices to communicate with each other without a host computer. CAN lines run throughout the vehicle and are typically connected to around 150 sensors. If a hacker can tap into any of these lines, they have access to the car’s other connected systems.

Navigation systems are also often connected to the CAN bus network, which makes them especially susceptible to attacks.

Collaborating across industries

Automotive manufacturers and security professionals must work together to mitigate the threat posed by potential cyber-attacker. Merging the disciplines of car safety and cyber security is no easy task and the complexity of the technology needed to make connected cars viable compounds this.

The industry must consider cyber security in the same way that it considers other safety standards. On top of normal crash tests automotive bodies need to impose comprehensive cyber security analysis within safety tests so that manufactures know when vehicles are vulnerable to hackers. Only this kind of fully comprehensive, planning and testing will provide the reassurances buyers crave– and will provide the evolving regulatory framework that manufacturers require to continue to innovate and build a future with the connected car that we all want to see.