Statista projects that by 2021, connected vehicles will account for more than a third of all vehicles on the road. The McKinsey report, The race for cybersecurity: Protecting the connected car in the era of new regulation, paints a disturbing but almost undoubtedly real threat that automotive manufacturers and car owners must face eventually.
To be clear, its not an ‘if’ but ‘when’ situation.
Consider that in 2015, researchers remotely hacked the Harman International infotainment system of a Jeep Cherokee to slow it to a crawl in the middle of a U.S. highway.
Victor Schwartz of Shook, Hardy & Bacon, says cybersecurity (in automobiles) is a very substantial risk that we do not have now. “In a situation with millions of codes and not absolute certainty as to who can obtain access to those codes, potential problems could exist.
He goes to paint a hypothetical situation: “Your Bin Laden of 2040, on one day, could somehow break into the code of a thousand vehicles and they could create absolute mayhem.”
FutureIoT spoke to Dennis Kengo (Nilsson) Oka, principal automotive security strategist at Synopsys on how automotive security is evolving.
Can you explain the concept of “Software-defined vehicles” and what are the changes it will bring to the development of automobiles in the future?
Dennis Kengo Oka: Over the years, the automotive industry has gradually shifted from mechanical solutions to electrical solutions to now software-based solutions. Software-based solutions bring several benefits including allowing for faster and more efficient development of various vehicle functions and more flexible solutions.
For example, it is possible to reduce cost by using software to perform various vehicle functions rather than using dedicated hardware solutions. Additionally, commonly used functions, for example in drivers and libraries, that previously had to be developed individually for the target systems are becoming more consolidated in software platforms or open-source software components.
This allows for reuse of software modules which leads to lower costs and increased speed of development. However, with over 150 million lines of code in a vehicle, there are also inherent software-related risks in terms of quality, safety, security and privacy.
As the automotive industry is shifting from hiring mechanical and electrical engineers to hiring more software developers, the internal development processes also need to embrace this change. Automotive organizations need to employ various software development tools and procedures to help developers create safe, secure, high-quality software.
This includes using static code analysis tools and following secure coding guidelines to reduce quality and security issues in their own developed code, using software composition analysis tools to identify known vulnerabilities in open source software, and fuzz testing tools to detect unknown vulnerabilities in software.
Besides tools and procedures, the automotive organizations must also ensure that there is a cybersecurity culture and make sure security training is part of a continuing education program for developers and security team members.
Will the use of an open-source in automobiles open up a security risk to electronics vehicle system architecture?
Dennis Kengo Oka: Although software development for the automotive industry is rapidly changing, the automotive industry is a strictly regulated industry with various industry standards with clear definitions for development.
These standards include, for example, ISO 26262 for functional safety, A-SPICE as the process model for development, and ISO/SAE 21434 for cybersecurity.
As untraditional automotive companies enter the automotive industry, these organizations need to either adopt the automotive-specific standards in their development process for automotive products or focus their development on non-traditional automotive development areas such as solutions for backend services where these standards are not applicable.
How do traditional automobiles companies collaborate with technology companies?
In recent years we have seen increased collaboration between traditional automotive companies and technology companies.
Especially for use cases regarding the connected car which includes communication with traditional IT backends, we see collaborations of, for example, cloud service providers such as Google, Amazon and Microsoft working with traditional auto manufacturers.
We also see more solutions where some parts of the intelligence in the vehicle is offloaded and performed in the cloud. These solutions bypass computational limitations in in-vehicle systems and enable more advanced data processing and analytics to be performed in large-scale data centres.
There are also examples of solutions that are based on hardware and expanding into platforms such as autonomous driving platforms and over-the-air update platforms provided by technology companies.
Autonomous driving platforms provide intelligence in the hardware and sensors where automotive companies can build their own solutions on top of the platform. Over-the-air update platforms provide intelligence in the update process itself, communication protocols used for the updates as well as in-vehicle solutions for performing the update on the target system in the vehicle.
Automotive companies can integrate their existing software development release process with the over-the-air update platform to enable over-the-air updates for their vehicles.
Smart city pilots are happening in many parts of the world. Do you think securing automobiles are included in these pilots?
Dennis Kengo Oka: As part of the smart infrastructure in smart cities, smart vehicles are often also included in the pilots. While the main focus for smart vehicles is on communication and functionality, there has been an increased focus on cybersecurity more recently. There are some dedicated automotive test cities where security is also covered.
For example, as part of the UK CITE Project focusing on V2X communication, there is an assessment of cybersecurity for V2X communication in the infrastructure.
Another example is Singapore where cybersecurity is a top priority in their development of a smart city. As part of such activities, Singapore released a set of national standards to guide safe development and rollout of autonomous vehicles with specific guidelines regarding cybersecurity.
As smart infrastructures and autonomous driving are becoming essential parts of a smart city, more focus on cybersecurity for automotive systems in smart city pilots will be required.
We’ve seen movies that depict how cybercriminals able to hack automobiles. How far are we from seeing these hackings become a reality?
Dennis Kengo Oka: There are two sides to automotive security and hacking. On the one hand, we have white hat hackers, i.e., security researchers who spend time on reverse engineering, identifying vulnerabilities and hacking automotive systems.
The results are typically shared with the automotive manufacturers in advance, who can prepare security countermeasures and fix vulnerable systems before the hacking results are made public. Such hacking results are often shared at security conferences such as Black Hat, Defcon, etc.
On the other hand, we have black hat hackers who are typically known as cybercriminals. Cybercriminals are often driven by financial incentives. Examples include theft of vehicles and theft of data or IP (intellectual property).
There are already several known examples of real-world attacks over the past few years, where cybercriminals steal high-end vehicles by, for instance, abusing diagnostics functions to reprogram blank keys or performing relay attacks on key fobs.
As more automotive systems include larger software bases and more connectivity interfaces including Wi-Fi, Bluetooth and cellular network, the attack surfaces on modern vehicles naturally increase.
Therefore, it is crucial that automotive manufacturers employ a cybersecurity engineering process during development to reduce the number of vulnerabilities in a vehicle when it is released. It is also important for the automotive industry to collaborate with white hat hackers to learn about newly identified vulnerabilities in their vehicles before black hat hackers can abuse such vulnerabilities.
