Two researchers have launched a petition to change how car companies and technology companies work together - with a new villain: in-car web browsers.
“We request that you unite with us in a joint commitment to safety between the automotive and cyber security industries,” the researchers say via Change.org.
A paper presented at Black Hat, shows a danger crossing the line from “proof of concept” to reality. The researchers point out that while hacking a car to give total control is extremely hard, it’s easier to, for instance, attack individual systems, such as commuications or navigation, both of which could be lethal.
Car code is complex, and often bespoke - which means attacks tend towards the level of disabling locks, or affecting electric windows, rather than outright destruction. Even Bluetooth - often hyped as the Achilles’ Heel.
Internet of Things: Car crash ahead?
“Bluetooth has become ubiquitous within the automotive spectrum, giving attackers a reliable entry point to test,” they write. But hacks would be of the level of adding an unauthorized device - not outright control.
When CNN Money devotes a section to the year’s “most hackable cars”, automotive security is clearly a real issue - a prize won by the Cadillac Escalade and 2014 Toyota Prius incidentally.
Charlie Miller and Chris Valasek in their paper A Survey of Remote Automotive Attack Surfaces conclude that the danger of “hackable” cars is expanding - but is about to grow rapidly, as web browsers are added to cars.
"Once you add a web browser to a car, it's open. I may not be able to write a Bluetooth exploit, but I know I can exploit web browsers." The recent reported hack against the Tesla Model S relied on its connected control panel.
A SlashDot user claims to have found a hidden port on the Tesla Model S, and used it to prove the car ran a modified version of Firefox.
Nick Bagot, Motoring Editor of the Mail on Sunday says, “Web browser obviously considerable safety issues - and it’s questionable why they’re needed. The inclusion of browsers in cars may well be to do with the convenience of advertising, and lucrative tie-ups with car brands and particular browsers, than it is for delivering value to the consumer.”
“Google is, primarily, an advertising company. Google products are built to feed into Adwords. Self-driving cars are an incredible technology - but what is it for?”
Safety first?
Car technology ignites passions from many sides. Last year a U.S senator urged auto manufacturers to change - and his open letter ignited a spate of commentary, with Market Oracle describing the crime as “cyberjacking”, and pointing out that the average family car contains 100 million lines of computer code, and that software can account for up to 40% of the cost of the vehicle, according to researchers at the University of Wisconsin-Madison.
Most in-car innovations have a clear point - car cameras are part of the technology revolution, but increase safety. Which Magazine writes "The importance of having these in-car cameras is becoming more obvious each day, with the devices not only providing UK drivers with an independent witness - but also as we see awareness of the product increase, we hope to see the road safety standards improve and fraudulent crashes and claims decline.
The importance of having these in-car cameras is becoming more obvious each day, with the devices not only providing UK drivers with an independent witness- but also as we see awareness of the product increase, we hope to see the road safety standards improve and fraudulent crashes and claims decline.”
Other innovations bring less clear benefits, reports The Register. “The problem is that cars are becoming more heavily computerized and that leads to more networking so the driver and passengers can get access to up-to-date information while on the move: most newish cars have a Bluetooth system hidden inside, a connection to the cellular data network, and so on,” the site said.
On the researchers’ page, I am the Cavalry, they say, Modern cars are computers on wheels and are increasingly connected and controlled by software. Dependence on technology in vehicles has grown faster than effective means to secure it.
