- connected cars are great, until they're not. a recent detroit free press article shows that vehicle hacks are more common and more dangerous that most people realize.
- there were at least 150 automotive cybersecurity incidents in 2019, part of a 94 percent year-over-year increase since 2016, according to a report from upstream security.
- oh, and here's a phrase we're loath to see, even though we're likely to come across it plenty more in the future: ransomware for cars.
it is impossible to remotely hack into an unconnected car. but if you're not driving the latest vehicle from tautology motors, your vehicle is likely at risk from some sort of digital intrusion. in fact, almost every car on the road today, if it can connect, can be hacked to some degree.
that's the opinion of moshe shlisel, the ceo and cofounder of guardknox cyber technologies, a company that focuses on protecting vehicles from just these kinds of attacks.
"the more sophisticated the system is, the more connected your vehicle is, the more exposed you are," shlisel told the detroit free press. "we have taken whatever model [car] you think of and we hack them through various places. i can control your steering, i can shut down and [start] your engine, control your brakes, your doors, your wipers, open and close your trunk."
shlisel isn't the only one trying to predict and prevent hacking threats. upstream security put out its annual global automotive cybersecurity report that lists the top cyber incidents of 2020. these included a hacker gaining control over "tesla's entire connected vehicle fleet by exploiting a vulnerability in the oem's server-side mechanism" and hackers taking "full control of an oem's corporate network by reverse-engineering a vehicle's [telematics control unit] and using the telematics connection to infiltrate the network."
the free press cited upstream's report, which said there was a 99 percent increase in cybersecurity incidents (to 150) in 2019 and a 94 percent year-over-year increase since 2016. with more communication methods being built into new vehicles, including massive over-the-air update technologies, this trend is unlikely to reverse any time soon.
ransomware for cars is coming
all of these attacks mean automakers have to take a proactive stance in this fight. part of the automakers' defense strategy is to ask "white hat" ethical hackers to show them where the cars are vulnerable in exchange for monetary rewards or, in some cases, jobs. the famous hacker duo who took control of a jeep cherokee back in 2015 now work for cruise, the autonomous-vehicle subsidiary of general motors.
michael dick, ceo of c2a security, an israel-based automotive cybersecurity company, told the free press he expects the current trend of hackers holding digital data on computers for ransom to move to cars at some point. when this happens, driver will not be able to start their vehicle until they pay off the hacker or suffer the consequences. "there's no way around it," he said. "you'll have to get it towed and get all new software to start it."
for some transportation companies, ransomware attacks have already happened. upstream security's report mentions a ransomware attack on the australian transportation company toll group, which affected 1000 servers and 40,000 employees. and honda was forced to stop production in june 2020 due to ransomware attacks on plants in europe and japan.
upstream security recommends three ways automakers can build secure vehicles, and they're all complicated. first, security has to be part of the design of every component. second, there needs to be a multi-layered cybersecurity solution that involves in-vehicle, it network, and cloud security defenses. third, automakers need to develop vehicle security operations centers "to monitor, detect, and quickly respond to cyber incidents to protect vehicles, services, fleets, and road users." how well the auto industry builds up these defenses will define how much drivers love their connected cars as the risks are better understood.