A couple of years ago, a website called 2025ad was set up as a repository for everything that would bring autonomous driving to the 2025 goal. That goal has been pushed back to make room to create solutions for the challenges that have reared their ugly head. The snake in the room is cybersecurity.
How can I protect my connected car from hackers?
The beauty of autonomous vehicles is less congestion, reduce emissions, fewer accidents, fewer deaths. It is a noble idea for the future of mobility.
The engineering challenge of cybersecurity is safety. Safety is the key to any mobility and the reason that many want to progress to autonomous vehicles. Today, most car accidents are operator error. A person gets distracted or drunk and runs off the road. Or worse yet, they run into another car, costing lives, fuel, and time. There is an economic and societal impact on the Nation from Motor Vehicle Crashes.
In effect, autonomous vehicles would make us safer. But would they? Not if they are all going to be connected car-2-car, car-to-grid, and vehicle to infrastructure, and if any of those entities can be hacked. Without complete safety in cars, you can’t remove human drivers. Even though humans create almost 100% of the accidents, those accidents can be attributed to one person being reckless. Even though, in total, that attributes to more than 1.25 million people killed every year in cars.
Upstream gave some interesting statistics:
● 55% of trucks in North America and 43% of trucks in Europe will be connected by 2025
●Three top-selling manufacturers in the US will sell only connected vehicles by 2020
●775 million vehicles will be connected by 2023, rising from 330 million in 2018
They told us about the time that Chicago’s Car2go had 100 cars hacked and stolen in one night. In fact, there has been a rapid growth of cybersecurity attacks increasing 605% from 2016 to 2019 to 160 known attacks in 2019, with 57% of them being blackhat.
An accident versus hacking
The difference is cybersecurity. Cybersecurity doesn’t attack one person; it attacks millions. It is different when a thief knocks down a person and takes their credit card than when a hacker hacks into a bank and achieves 100,000 names and numbers of bank accounts.
It is different when a car smacks into another car, and fire flares up from the gasoline leaking out of the fuel tank. It is different if a tanker full of gasoline in the heart of Boston is hacked into by a person overseas, and they ram that tanker into a hotel.
A solution by Upstream auto
The two-way communications between each connected vehicle and the server are precisely what makes connected fleets vulnerable to cyber attacks. The only effective way to ensure the protection of the data in these communications is by applying security at the data center – the demarcation point between the operational network (OT) and information network (IT).
Upstream says they have a C4 Platform that sits in this demarcation point, offering a powerful combination of IPS/IDS (Intrusion Prevention System/Intrusion Detection System) for automotive protocols coupled with machine learning algorithms tuned for fleet and driver behaviors. The result is the first purpose-built security solution capable of detecting, interpreting, and alerting any threats to connected vehicles.
Upstream Security, a leading provider of cloud-based automotive cybersecurity solutions, today released its 2020 Automotive Cybersecurity Report.
The report shares in-depth insights and statistics gleaned from analyzing 367 publicly reported automotive cyber incidents spanning the past decade, highlighting vulnerabilities and insights identified during 2019. The company also announced the general availability of AutoThreat Intelligence; it’s an automotive threat intelligence subscription service providing comprehensive and actionable insights to threats on automotive and smart mobility services. The new service will be an integral part of the Upstream Automotive Cybersecurity, enabling analysts to leverage the feed directly within Upstream’s C4 platform, providing domain expertise specific to automotive manufacturers, smart mobility, and connected vehicle service providers. AutoThreat Intelligence can be enabled with any Upstream Security deployment or as a standalone service, adding no overhead to the customer operations with periodic updates and a rich set of reports, trends, and critical insights on the connected vehicle environment.
“With the rapid rise of attacks on the automotive industry, OEMs and smart mobility providers need extensive visibility and clarity into the threat landscape, helping them design the proper security architecture spanning their vehicles and cloud environments,” said Oded Yarkoni,
Upstream Security’s VP of Marketing. “Our annual automotive cybersecurity report shows that the threats faced by the entire industry are real and increasingly more prevalent. The launch of our AutoThreat Intelligence service provides OEMs, connected fleets, smart mobility service providers, and MSSPs targeted insights so that they can take needed measures to protect themselves, their assets, and their customers.”
Upstream’s 2020 Automotive Cybersecurity Report introduces some of the key findings of the AutoThreat Intelligence research team for 2019 as well as solutions used by the industry going forward:
● Connected vehicles are already taking over: 330 million vehicles are already connected, and top car brands in the US market have stated that only connected vehicles will be sold by 2020. This fact alone exponentially increases the potential damage of each attack. A wide-scale attack could potentially disrupt an entire city and even lead to catastrophic loss of lives.
● The number of automotive cybersecurity incidents has increased dramatically: Since 2016, the number of annual incidents has increased by 605%, with incidents more than doubling in the last year alone.
● Most incidents are carried out by criminals: 57% of incidents in 2019 were carried out by cybercriminals (black hat) to disrupt businesses, steal property, and demanding ransom. Only 38% were the result of researchers (white hat) with the goal of warning companies and consumers of discovered vulnerabilities.
● A third of all incidents involved keyless entry attacks: The top three attack vectors over the past ten years were keyless entry systems (30%), backend servers (27%), and mobile apps (13%).
● Everyone is affected, from automotive companies to consumers: over the past ten years, every type of company in the smart mobility system was affected. This includes OEMs, fleets, telematics, and after-market service providers, and ride-sharing services along with consumers who have had their property and private information were stolen.
● A third of incidents resulted in car theft and break-ins: The top three impacts of incidents over the past ten years were car thefts/break-ins (31%), control over car systems (27%), and data/privacy breaches (23%).
● The vast majority of incidents in 2019 involved remote attacks: 82% of incidents in 2019 involved short and long-range remote attacks, which do not require physical access to the vehicle and can be carried out from anywhere in the world.
● Awareness is increasing: More automotive vulnerabilities are being listed, with 66 CVEs (common vulnerabilities and exposures) listed to date. The use of bug bounty programs, which has been popular in enterprise infosec, is on the rise as more automotive companies adopt it as a way to discover vulnerabilities.
These programs offer compensation to researchers (white hat hackers) who discover and report vulnerabilities to the owner company. Additionally, government officials and consumers are demanding regulations and laws to protect them against cybercrime in the automotive space.
● The industry is adopting a multilayered security approach: This involves new regulations and standards, security by design, in-vehicle and cloud-based automotive cybersecurity solutions, and expanding SOCs to VSOCs (Vehicle Security Operations Centers) for early detection and rapid remediation.