Carmakers strive to stay ahead of hackers

And last year, Consumer Watchdog, a nonprofit group in Santa Monica, California, sent a “!Hacked!” message to the screen of a Tesla.

The problem goes beyond demonstration intrusions. Karamba has been working with a South American trucking company whose fleet was hacked to hide it from its tracking system, allowing thieves to steal its cargo unnoticed. And a quick internet search will reveal scores of successful but so far benign hacks against many of the world’s major automotive brands.

“To take control of a vehicle’s direction and speed: This is what everyone in the industry is worried about,” said Ami Dotan, Karamba’s chief executive. “And everyone is aware this could happen.”
The challenge may be even greater than securing the world’s airlines. According to a McKinsey & Co. report on automotive cybersecurity, modern vehicles employ around 150 electronic control units and about 100 million lines of code; by 2030, with the advent of autonomous driving features and so-called vehicle-to-vehicle communication, the number of lines of code may triple.

Compare that with a modern passenger jet with just 15 million lines of code or a mass-market PC operating system with around 40 million lines of code, and the complexities become clear.
Vehicle manufacturers understand that a successful hack that caused death or destruction could be a major blow. “The incentive to prevent a giant malicious attack is huge,” said Gundbert Scherf, a McKinsey partner and an author of the report.

And with drivers believing that their vehicles are the ultimate private cocoon, even a benign attack, such as an unexpected message on a car’s infotainment screen, could easily cause a major public relations problem.

Cybersecurity companies must protect a vehicle in multiple ways. Threats include SIM cards carrying malicious code, faked over-the-air software updates, code sent from a smartphone to the vehicle, and vehicle sensors and cameras being tricked with wrong information.

In addition, malicious code can be introduced through dongles connected to a vehicle’s computer port, commonly called the OBD-II port, typically under the steering wheel and used for vehicle diagnostics and tracking.

Trucking fleets are even more at risk, said Moshe Shlisel, chief executive of GuardKnox Cyber Technologies. An entire fleet could be shut down or otherwise compromised for a ransom, he said.

“Our biggest worry is the hacking of a fleet,” said Ronen Smoly, chief of Argus Cyber Security, a division of the auto supplier Continental. “Most serious hackers come from well-funded groups working for long periods of time.”

Shlisel said, “It’s just a matter of time before a major hack happens. The most secure vehicle is a Model T Ford, because it’s not connected to anything.”

Over-the-air updates can patch software vulnerabilities in modern cars, but the industry aims to protect electronic systems before that happens — including systems most exposed to the outside world, such as audio, navigation and phone systems. To protect them and more sensitive systems, safety measures are being taken along every step of the manufacturing chain, from software to hardware design.

Major software and hardware suppliers to the world’s manufacturers build in firewalls to ensure that such elements as infotainment systems are prevented from passing code to systems that regulate speed, steering and other critical functions.

Vehicle electronic control units are being designed to send an alert if one system that normally never communicates with another suddenly tries to do so. And they are also locked down so that an attempt to inject new code will be thwarted.

“Human life is involved, so cybersecurity is our top priority,” said Kevin Tierney, General Motors’ vice president for global cybersecurity. The company, which has 90 engineers working full time on cybersecurity, practices what it calls “defense in depth,” removing unneeded software and creating rules that allow vehicle systems to communicate with one another only when necessary.

It is a practice also followed by Volkswagen, said Maj-Britt Peters, a spokesperson for the company’s software and technology group. She noted that Volkswagen’s sensitive vehicle control systems are kept in separate domains.

Continental, a major supplier of electronic parts to automakers, employs an intrusion detection and prevention system to thwart attacks. “If the throttle position sensor is talking to the air bag, that is not planned,” Smoly said. “We can stop this, but we wouldn’t do so while the vehicle was moving.”

Still, determined hackers will eventually find a way in. To date, vehicle cybersecurity has been a patchwork effort, with no international standards or regulations. But that is about to change.

This year, a United Nations regulation on vehicle cybersecurity came into force, obligating manufacturers to perform various risk assessments and report on intrusion attempts to certify cybersecurity readiness.

The regulation will take effect for all vehicles sold in Europe from July 2024 and in Japan and South Korea in 2022.

While the United States is not among the 54 signatories, vehicles sold in America are not likely to be built to meet different cybersecurity standards from those in cars sold elsewhere, and vice versa.

“The U.N. regulation is a global standard, and we have to meet global standards,” Tierney of GM said.
And last month, the National Highway Traffic Safety Administration issued a request for comment on a proposed new draft of a cybersecurity best-practices recommendation, an update of a 2016 report.

It is even possible that future window stickers on new cars may point out that a vehicle meets cybersecurity standards. “We should rate vehicles for cybersecurity the same way we rate them for crash protection,” said Jason Levine, executive director of the Center for Auto Safety.

All of which raises a question: If the U.S. government could not prevent Russia from hacking into its computers, can vehicle manufacturers do a better job?

“I’m very used to the doom-and-gloom narrative, and I would caution against it,” Scherf of McKinsey said. “We still have enough time to shape the narrative.”