Are Modern Cars becoming a Cybersecurity Threat?



According to the National Highway Traffic Safety Administration (NHTSA), a modern car has approximately 100 million electronic control units.   

With the rapid advancements in technologies, today’s cars are, in a sense, behaving like personal computers, considering the amount of personal data stored on them. A simple act, such as selling your car to a new person, could result in your  personal data getting compromised. However, there has only been one instance of a cybersecurity-related recall in 2015, which affected about 1.4 million vehicles.

The following are some of the possible scenarios that could affect a car in terms of a cybersecurity-related breach, according to a report published by the European Union Agency for Cybersecurity (ENISA).

smart_car_cyber_security

  1. In the case of vulnerability exploitation in a communication stack of a vehicle network, it is even possible to reprogramme the ECU and also take control of the vehicle through the Controller Area Network. This is a high-level vulnerability as remote servers would be able to communicate with numerous vehicles at the same time, compromising the entire central ecosystem, including passenger safety. This vulnerability also opens up the possibility of a cascade effect risk. Moreover, such attacks are highly scalable as they can be executed remotely and could target a fleet of vehicles.
  2. By hacking a mobile application, a hacker can command a car to drive him to any given location even though he is not allowed to do so. This is another high-level vulnerability as it could result in illegitimate access to the smart car or even theft by compromising a V2X mobile application. This scenario also has a medium risk of cascade effects as an attack could target individuals and allow the compromise of many vehicles at once.
  3. In the scenario where remote servers are attacked to influence car behaviors, an attacker could compromise map data to manipulate plausibility checks. Another example is when an attacker alters the data on traffic conditions, intending to change the car itinerary, leading to inefficient service.
  4. Communication units such as Base Transceiver Stations and Wifi routers can be used to spread malware or to disrupt infrastructure communications.
  5. Once the OEM back-end is hacked, large scale deployment of rogue firmware can be used to initiate malicious firmware updates. This is a high-level vulnerability that is highly scalable. Such an attack could have a devastating effect on the safety and security of multiple vehicles.
  6. RSUs and V2V interfaces could be the target of hackers to create traffic jams and other disruptions by sending wrong information on traffic conditions and other functionalities.
  7. Sensor fooling by adversarial perturbation is an attack scenario where hackers disrupt the sensors’ like the camera, relay the light waves from the LiDAR. This is also considered a high-level threat as the vehicle might not recognize stop signs, which might lead to major accidents.
  8. Communication jamming could be used to disrupt wireless networks, preventing the car from emitting or receiving V2X messages.
  9. By replacing GNSS signals, a hacker can fool a third-party service or law enforcement agencies into thinking that the vehicle is at a different location. This opens up the possibility of accidents and vehicle theft.
  10. An attacker can block critical messages such as Denial-of-Service (DoS) to prevent a driver from reacting appropriately to a situation.

All the above cases can be broadly classified into three categories.

  • Large scale deployment of a rogue firmware after hacking OEM back-end servers.
  • Hacking/altering a V2X application that allows access to the car.
  • Sensor fooling by adversarial perturbation.

Although cyber insurance for cars may be unheard of, it certainly could be a possibility in the near future, considering the amount of personal information of an individual a car carries.