Connected cars: a vehicle for cybercrime?

happygeek 2 326 Views

The average car is increasingly becoming a vehicle for the Internet; but does this also make it a vehicle for cybercrime? Security vendor Kaspersky Lab, in cahoots with Spanish digital media outfit IAB, reckons that software updates, in-car mobile apps and privacy are all areas which have ripe potential for the car crook to launch an attack.

Announcing the first 'Annual Connected Cars Study' which aims to provide an overview of the Internet car market, Kaspersky Lab and IAB hope that some unity can be provided to the pretty fragmented software ecosystem offered by car manufacturers currently.

In developing a proof of concept to analyse how safe it is to connect a car to the Internet, principal security researcher for Kaspersky Lab, Vicente Diaz, identified several likely attack vectors. The proof of concept, which was based on an analysis of the BMW ConnectedDrive system, revealed the following danger zones:

Stolen Credentials

Data needed to access BMW’s website could be stolen using traditional methods such as social engineering or keyloggers and could result in unauthorised third-party access to user information and, possibly, the vehicle itself by installing a mobile app to enable remote services before opening the car and driving off.

Mobile Applications

By activating mobile remote opening services on your phone a new set of virtual keys for your car are created which could give anyone who steals your smartphone instant access to your car. With the stolen smartphone it might then be possible to change database applications and bypass PIN authentication (if used) to make remote service activation a doddle.

Software Updates

A file download from the BMW website provides Bluetooth driver updates via USB. The research showed this file to be unencrypted, and unsigned. It also contained plenty of data regarding the internal systems of the car. The opportunity to run malicious code should not be underestimated, Kaspersky Lab says.

Communications

With some functions communicating with the SIM inside the vehicle using SMS,there is an opportunity to break into the channel and send fake instructions. A worst-case scenario, according to the report, could involve a criminal replacing BMW’s communications with their own instructions and services.

"Connected cars can open the door to threats that have long existed in the PC and smartphone world" Vicente Diaz warns, continuing "owners of connected cars could find their passwords are stolen. This would identify the location of the vehicle, and enable the doors to be unlocked remotely." Privacy issues are crucial and today’s motorists need to be aware of new risks that simply never existed before, Diaz concludes.

Do you have a connected car, and if so have you thought about the security implications?

Dani AI

Generated

As observed in 2014, connecting cars to the Internet increased the attack surface. The theoretical risks became concrete when security researchers showed a remote compromise of a production Jeep Cherokee in 2015 — an event that forced patches, recalls and wider industry attention. (wired.com)

Regulation and industry practice have reacted. An automotive cybersecurity engineering standard (ISO/SAE 21434) was published to govern risk‑based security through the vehicle lifecycle, and UN WP.29 rules (R155 for a Cyber Security Management System and R156 for Software Update Management Systems) now require manufacturers to show they manage cyber risk and secure updates. U.S. guidance was also updated in 2022 to reflect these changes and emerging best practices. (iso.org)

Practical mitigations for vehicle owners and fleet operators include treating phones and connected accounts as keys (protect with device lock, unique credentials and multi‑factor auth where possible), limiting installed remote apps and permissions, opting out of unnecessary telemetry, applying vendor updates promptly, and insisting on documented, signed OTA/update processes when buying or servicing vehicles. Before transfer or resale, factory reset any connected services and remove linked accounts so access tokens and personal data are not left behind.

For engineers and suppliers the path is secure‑by‑design: perform structured threat analysis (TARA), use secure boot and HSMs, sign and anti‑rollback OTA images, segment critical networks behind verified gateways, log and monitor for anomalies, manage supply‑chain risk, and run coordinated vulnerability disclosure and patch programs. Industry information‑sharing (for example via Auto‑ISAC) now plays a central role in spotting and neutralizing emerging threats. (automotiveisac.com)

These steps do not eliminate risk, but they move connected vehicles from ad‑hoc exposure toward an auditable, lifecycle approach that regulators, vendors and operators can evaluate and improve.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.

Edit Preview