Connected cars vulnerable to cyber attacks, says study
The report reveals the scope of the cybersecurity risks examined. Researchers evaluated 29 real-world attack scenarios according to the DREAD1 threat model for qualitative risk analysis. These attacks, says the company, could be launched remotely against and/or from victim vehicles.
Examples and highlights include:
- DDoS attacks on Intelligent Transportation Systems (ITS) could overwhelm connected car communications and represent a high risk.
- Exposed and vulnerable connected car systems are easily discovered, making them at higher risk of abuse.
- Over 17% of all attack vectors examined were high risk. These require only a limited understanding of connected car technology and could be accomplished by a low-skilled attacker.
“Our research shows that there are ample opportunities for attackers looking to abuse connected car technology,” says Rainer Vosseler, threat research manager for Trend Micro. “Fortunately, there are currently limited opportunities for attacks, and criminals have not found reliable ways to monetize such attacks. With the U.N.’s recent regulations requiring all connected cars to include cybersecurity, as well as a new ISO standard underway, now is the time for stakeholders across the industry to better identify and address cyber risk as we accelerate towards a connected and autonomous vehicle future.”
More than 125 million passenger cars with embedded connectivity are forecast to ship worldwide between 2018 and 2022, and progress continues to advance towards fully autonomous vehicles, creating a complex ecosystem comprising cloud, IoT, 5G and other key technologies. It also features an enormous attack surface comprising potentially millions of endpoints and end users.
As the industry develops, the report warns, there will be multiple opportunities for monetization and sabotage for cybercriminals, hacktivists, terrorists, nation states, insiders and even unscrupulous operators. Of all 29 attack vectors studied in the report, the overall risk of successful cyber attacks was assessed as Medium. However, says the company, as SaaS applications become embedded in the electrical/electronics (E/E) architecture of vehicles and cybercriminals create new monetization strategies, an evolution in attacks will lead to higher risk threats.
To mitigate the risks outlined in the study, the company says connected car security must be designed with an integrated view of all critical areas to secure the end-to-end data supply chain. The company offers the following high-level guidance for protecting connected cars:
- Assume compromise and have effective alert, containment, and mitigation processes.
- Protect the end-to-end data supply chain across the car’s E/E network, the network infrastructure, backend servers, and VSOC (Vehicle Security Operations Center).
- Apply lessons learned to further strengthen defenses and prevent repeat incidents.
- Relevant security technologies include firewall, encryption, device control, app security, vulnerability scanner, code signing, IDS for CAN, AV for head unit, and much more.
For more, see the full report: “Cyber Security for Connected Cars: Exploring Risks in 5G, Cloud and Other Connected Technologies.”
Related articles:
Top ten security challenges for connected cars
Hacking of Internet connected cars a national security threat
UL invests in self-healing software for connected cars
Connected car market forecast sees over 14% CAGR to 2027
If you enjoyed this article, you will like the following ones: don't miss them by subscribing to :
