As we’ve noted before, Ars readers are extremely skeptical about the whole “connected car” thing.
That’s not because Ars is a technology site for luddites—the sad truth is that the car industry’s approach to security lags far behind its desire to expose the inner thoughts of our cars to us via the cloud.
As the tech and auto industries collide, the tech crowd is hoping that its more farsighted approach to ensuring secure hardware and code will start to rub off on its new bedfellow. On Wednesday and Thursday this week, the two have come together in Michigan for TU-Automotive Detroit, a conference that’s focusing in part on this very topic.
And tech firms—from established players like Symantec to startups like Karamba Security—want to help the automakers find their way.
The glaring lack of connected security for our cars got mainstream attention last year when Fiat Chrysler had to recall 1.4 million vehicles, but despite the FBI’s plea to motorists to remain aware of security issues in cars, the driving public doesn’t seem too concerned.
Earlier this week, research firm Forrester announced that more than one in three Americans wants their next car to have better Internet connectivity. Meanwhile, the hacks keep happening. Nissan’s API for its Leaf electric vehicle allowed completely anonymous requests to cars. Mitsubishi might have decided to enable connected car services for its Outlander via the vehicle’s Wi-Fi in part to safeguard against attacks in the cloud, but it forgot that Wi-Fi needs some common sense security protections, too.It’s a problem that’s common across the Internet of Things, but it’s particularly troublesome for our cars, according to Dirk Gates, founder of Wi-Fi network firm Xirrus. “This is a growing problem with IoT devices: vendors trying to take short cuts to make their lives easier, and in the process compromising security and making their user’s lives tougher,” Gates said. “We’ve seen this in the past with printers and projectors, even toy drones, but this sort of massive shortcut on a car is unprecedented, and it shows that all IoT manufacturers, even the big guys, need to wake up and take security seriously.”
“There are no shortcuts when it comes to making an IoT device a proper network endpoint supporting all the appropriate forms of security,” he continued. “And to make customers’ lives easier, these devices should all communicate through a cloud interface to not only allow ubiquitous access but also to provide another layer of authentication and security.”
Part of the issue, according to Brian Witten, Symantec’s senior director for IT, is the way that car companies integrate new and existing electronic systems into the vehicles they build. With the exception of a few young upstarts like Tesla, no one starts with a completely clean sheet of paper. Rather, modules and components and code are brought in from tiers of suppliers; the OEM’s job is to integrate that all together.
“There’s such little reuse of software within the car [industry] because each supplier has their own codebase.
Everyone is running different operating systems,” Witten told Ars. “Most systems-heavy industries have moved to simplifying codebases.
The auto industry’s dependence on supplies in such a tiered structure (with autonomy and inadequate security) hasn’t worked in their favor.
Aviation doesn’t work in the same way.
Train systems are more integrated.
Established OEMs have challenges that a lot of new players don’t have, and other industries don’t have either.”
“We crash test cars, but we don’t crash test software.
There needs to be more security testing before these vehicles hit the road,” Witten said. “There’s an opportunity with software to deliver functionality in much shorter time cycles [than the industry norm]. Of course, it still needs to go through security and safety testing before the build is wrapped.
But I’m optimistic it can be done safely in much shorter time frames than hardware.
A problem is that a lot of security engineers haven’t worked on extremely constrained devices [like the various modules in our cars], and a lot of embedded engineers haven’t had to think seriously about security.”
Symantec moved into the automotive security field in 2015 and has just released the third of its products for the industry, an anomaly detection system that constantly monitors the CANbus (the Controller Area Network bus is the car’s internal electronic network) for signs of malicious behavior.
The code isn’t processor-intensive (Witten says it uses about six percent of a CPU), and it runs on hardware already in our cars, from security gateways to infotainment systems. “We need to be able to find footprints in the sand,” Witten said in reference to fighting the hacking threat. “We’ve been in machine learning since 2004 and have tracked over a trillion security events in the cloud.
So we wanted to use that ability and those tools to build something for the car industry.”
Witten told us that Symantec has already signed on several of the largest OEMs and expects the company’s tech will shortly be going into about 10 million new cars a year, although it declined to name them due to industry confidentiality agreements. He was cautious to point out, though, that there won’t be a single fix—or even a single company—that OEMs can turn to in order to solve their security woes.
Symantec’s Anomaly Detection starts off learning what “normal” is for a particular model of car during the development process, building up a picture of automotive information homeostasis by observing CANbus traffic during production testing. Out in the wild, it uses this profile of activity to compare that to the car it’s running on, alerting the Symantec and the OEM in the event of something untoward happening. Other companies are working on other code solutions for the car companies, like Karamba’s Carwall code, for example.
Carwall’s code can also be embedded into ECUs within our cars, where it performs real-time threat detection, preventing any unsigned code from running.
It’s still early days for the car industry’s connected car reckoning, so expect to hear plenty more about hacked vehicles in the coming years.