The vehicles we drive are becoming increasingly connected through a variety of technologies. Features such as keyless entry and self-diagnostics are becoming commonplace. Unfortunately, they can also introduce IT security issues.
When Chris Valasek and Charlie Miller demonstrated at Black Hat USA 2015 how they can remotely exploit vulnerabilities in Chrysler’s 2014 Jeep Cherokee, many thought it was interesting, but not a widespread problem. Turns out it was just the tip of the iceberg.
Time to patch your car?
This year we’ve learned that several automakers are plagued by a plethora of security issues:
A group of researchers from ADAC, the largest automobile club in Germany and Europe, have demonstrated how the keyless “comfort locking” system used by most automakers on most modern cars provides no security against vehicle theft.
The Mitsubishi Outlander hybrid SUV can be easily broken into by attackers exploiting security weaknesses in the setup that allows the car to be remotely controlled via an app.
Security researchers have come up with a way to unlock hundreds of millions of cars from the Volkswagen Group, Alfa Romeo, Chevrolet, Peugeot, Lancia, Opel, Renault and Ford. The hardware tools required to pull off the attacks is cheap and accessible to practically everyone.
Think premium brands are not at risk? Think again. Back in July we learned that BMW ConnectedDrive flaws could be misused to tamper with car settings.
Houston, we have a problem
Government institutions are taking notice. With a public service announcement compiled jointly with the Department of Transportation and the National Highway Traffic and Safety Administration, the FBI has announced that it finally considers car hacking a real and present danger, and so should the general public and vehicle manufacturers.
The automobile industry is beginning to realize they are unable to tackle mounting security issues on their own. Last month Fiat Chrysler Automobiles launched a bug bounty program. The biggest reward payout is still small, and amounts to only $1500, but I’m sure we’ll see an increase as potentially more damaging vulnerabilities are uncovered in all types of modern vehicles.
Members of the Automotive Information Sharing and Analysis Center (Auto-ISAC) released an overview of comprehensive Automotive Cybersecurity Best Practices developed as a proactive measure to further enhance vehicle cybersecurity throughout the industry.
more.
https://www.helpnetsecurity.com/2016/08/25/automotive-security/
