Cyber-Hijackers
Nowadays, modern vehicles contain a lot of onboard circuits and computers. Those computer and circuit systems do very simple and complicated processes in a vehicle. Because of that, they become the most valuable and well-developed parts in modern automobiles. Those computer-aided systems, process everything from engine controls to the sound and video entertainment systems. These computers, called electronic control units (ECU), are paired with each other via multiple networks and communication protocols including the Controller Area Network (CAN). The controller area network is a component that builds connections between engine and brake control. Similarly, there are a lot of circuits in a modern vehicle. We called those vehicles Connected auto-mobiles. That complexity creates more advancements and as well as more malfunctions on vehicles. These new connected vehicles can become an easy target to an attacker (Hacker). It can happen via various mediums and methods.
All above in-car computer systems are open to risky cyber-space. There are so many people looking to get advantages from the newest technologies. But it can be in a good or bad way. If there is any vulnerability in that technology, it will be a victim of a hacker. The automobile field has also become a victim of the cyber world. A lot of security breaches have been reported concerning automobiles in the past few years. Solutions were found for most of them. But still, cyber activists find more new vulnerabilities in the newest vehicles with every passing day.
Who is attacking?
To identify and avoid attacks, organizations must first consider the people behind them. Hackers are commonly classified into two types: White Hat and Black Hat. White Hat hackers, who mostly do research, do not typically have malicious intent. According to Upstream’s study, black hat hackers were responsible for 49.3 percent of public events from 2010 to 2020. (For more info: GLOBAL AUTOMOTIVE CYBERSECURITY REPORT 2021)
Rules and Regulations
Automotive cybersecurity is still a developing area. Traditional automotive safety and security legislation and guidelines do not adequately address cyber risks associated with modern-day connected vehicles. The number of cyber-related automotive vulnerabilities is predicted to increase when connected cars grow. To mitigate the anticipated increase in cyber-attacks on connected vehicles, governmental agencies and an effort has been made by independent standardization bodies to require increased entrenched cybersecurity measures from OEMs, component and software manufacturers, and mobility service providers.
Most common attack vectors
Attack vectors are the methods used by attackers to get control of vehicles. One attack incident may contain several attack vectors. This is a graph from the Upstream security 2021 report which displays the most popular attack vectors analyzing incidents since 2010.
·Server attacks
Server attacks can be directed at a variety of servers, including telematics command-and-control servers, database servers, web servers, and others. These attacks are remote and long-distance, meaning that hackers do not need to physically connect with the vehicle.
· Keyless entry
Most keyless entry vehicles also have keyless start technology, which allows you to start your car’s engine and drive away wirelessly. ‘Thatcham research’ examined the safety features of 13 new cars in March 2020 and discovered that seven of them already had bugs in their entry scheme. Security holes or glitches in software may be exploited by hackers. 4 of the vehicles failed the Thatcham relay theft tests.
· Mobile applications
In the automotive industry, smartphone devices are commonly used. In August 2020, Google announced that their service, Android Auto, would be available in more than 100 million cars “in the coming months.” Any vulnerabilities or bugs in the operation of a mobile app can lead to malicious manipulation and serious damage. Google and Apple, as well as other firms, are attempting to force their inventions through the door.
Remote vs Physical
Most automotive cyber-attacks are categorized as either remote or physical. Physical attacks need an attacker to make physical contact with the vehicle to hack it. Remote attacks are often short-range and can be performed from a few steps away or from anywhere in the world. For example, in July 2020, Tesla’s battery management system was retrofitted by a hacker and improved hardware, which might boost the capacity of the vehicle. In January 2020, hackers created a desktop adaption connected with the Tesla servers and carried out activities remotely using Tesla’s Mobile API.
This is the basic interface for Automobile Hacking. Huge to discuss. Stay tuned for more related articles. Thank you! Keeping updated with new technology and technology news can be a real help to avoid being attacked by a bad hacker. Any technology gives us lots of benefits, but all of them embed with high — risky vulnerabilities which open the gate to dangerous cyber-space. Always, the Risk is yours !!!
Written by Shehan Fransciscu — 2nd Year 2nd Semester -Cyber Security Student-SLIIT
Originally published at https://sliitcs2.medium.com on July 30, 2021.
