Your car is not a mechanical device.
Nope.
Your car is “probably the most complex distributed system that you personally own,” Professor Stefan Savage explained earlier this month in a talk at USENIX Enigma 2016 entitled “Modern Automotive Security: History, Disclosure, and Consequences“.
This is why:
This are the basic computing features of most any car purchased in the last 5 years. But the computerization of cars began 45-years ago with the advent of the airbag. A typical automobile network is now vastly most complex than what most of us have in our homes.
And there’s a good chance that your “off-the-shelf, unmodified sedan” could be compromised by a third party. “Compromised” as in your brakes could remotely be made useless, as Professor Savage did for this episode of 60 Minutes.
The answer to these problems isn’t simply “hire better people and it will all be better,” Savage explained.
Cars are vulnerable for a lot of reasons — including the security problems emerging in much of the Internet of Things. Savage calls it “a huge amount of pressure on feature creation.” Often, in the rush to add functionality, security is often not considered or actively ignored.
Additionally, there are underlying issues with code ownership and laws that deny even security researchers access to internal workings of car software.
“The thing that parents need to know about smart toys is that they’re new terrain for parents and children, but also manufacturers,” our security advisor Sean Sullivan told Newsweek.
And his critique of the connected toys industry is certainly true of the computing revolution that’s been going on inside our cars over the past decade. From OnStar to keyless entry to electric car charging station, two-way digital communication makes vulnerabilities likely if not inevitable.
Car companies seem to have changed their approach and heightened their concern for security after the Jeep hack last summer, which led to the recall of more than a million Chrysler automobiles.
But recalls aren’t a very effective way to update cars, given the large percentage of owners who just won’t bring their cars in unless they stop working.
Savage told the story of a vulnerability his team discovered in Generation 8 OnStar units that they decided not to disclose based on the low rediscovery risk. Five years later it came out that GM had updated all of the units even though Generation 8 OnStar “has no ability to do remote updates.”
So what happened?
“I’m not saying that GM hacked millions of its own cars…” Savage mused. “But something happened.”
(Hat tip to Antti Tikkanen.)
[Image by Day Donaldson | Flickr]
Categories