Are computers leaving cars vulnerable to hacking?

We have become so used to the rise and rise of electronic gadgets in our cars that being blasé about such things has become the norm. Where
once upon a time a push-
button AM radio was considered the bleeding edge of technology, now most buyers won't even consider a model without a touch-screen, Bluetooth and full smartphone integration.

The current apogee is Apple’s newly-launched CarPlay system which seamlessly integrates the use of everyone’s favourite high-end phone into the dashboard of tour car. Such items are now even becoming de rigeur on the second-hand market, something of a turnabout when it comes to relaibility-centric used buyers. As my own father would (and does) always say, “It’s just more stuff to break”.

Is there something more sinister than mere breakage that should concern us though? Is the proliferation of in-car electronics, and more so, electronics which can talk and communicate with the outside world, leaving car owners open to cyber-mischief?

Certainly, many of the world's leading experts on cyber-crime believe this to be the case. Recently, it has been demonstrated that some Ford and Toyota vehicles can have their electronic "brains" fooled sufficiently for an outside agent to take over such critical functions as steering and braking. Tesla, that automotive wünderkind, has proven fallible to such attacks in the recent past.

Security researcher Nitesh Dhanjani recently bought himself a Tesla Model S saloon, but was alarmed to find that the car could be accessed and controlled through a smartphone app. That app requires owners only to enter a six-digit password, which is nowadays regarded as the bottom rung of cyber-security.

Worse again, that same password allows access to the app’s website, and when Dhanjani started to explore it from a security point of view, he found that multiple wrong password entries did not lock out the account.

Innovation
"Given that the only control around the iPhone app is a password, the situation is ripe for potential attackers to steal credentials using phishing attacks. Once credentials are gathered, phishers can easily check the location of the cars for the accounts they have compromised by using the Tesla REST API," said Dhanjani on his blog.

“Tesla has demonstrated innovation leaps and beyond other car manufacturers. It is hoped that this document will encourage owners to think deeply about doing their part as well as for Tesla to have an open dialogue with its owners on what they are doing to take security seriously.”

Since Dhanjani’s revelation, Tesla has now introduced a lockout function on its website to prevent repeated password attacks, but clearly in a world where our cars can so easily communicate with the world wide web, there are openings for hackers to exploit. Where once we worried about leaving a window open or a door unlocked, now perhaps we should be more concerned about Bluetooth passwords or USB ports.

As the cyber-attack options become ever more open, Harman, one of the car industry’s leading infotainment providers, has begun to incorporate more robust security measures. At the recent Geneva Motor Show, Harman showed off its new Connected Car Application Platform, which allows for and encourages the development and use of third-party apps to compliment a vehicle’s existing infotainment system. But underlying the message of increasing connectivity and innovation was a stern warning about security.

“As cars become more connected, car hacking is becoming a serious threat that is forcing the industry to consider how to protect vehicles against cyber-attacks,” a Harman spokesperson told us. “The infotainment domain is securely firewalled from the vehicle domain, preventing any impact on safety-relevant features in the car. In addition, Harman has implemented advanced security techniques such as secure boot and data encryption. The combination creates a Trusted Infotainment Architecture that offers unmatched security.”

Security
It does raise the question though of exactly how vulnerable we are at the moment. Alex Balan of security firm BullGuard told us that "while it's theoretically possible to hack a car, in practical terms its enormously difficult, expensive and time-consuming and other than offering some thrills for a hacker it's certainly not worth their while.

That said, car manufacturers are taking the potential threats seriously and many are beginning to adopt what are standard practices in IT security. For example, some manufacturers are introducing systems in which data that is sent between car computers is verified. If it’s malware and doesn’t match the expected code it’s stopped. Others are ensuring that only approved software can be downloaded by a driver onto the car’s system while others are re-routing downloaded software to their own servers so it can be checked for malware before its makes it onto the car system.”

The Toyota and Ford cars mentioned above were only able to be hacked by computers physically connected to the car, and then only by a dedicated team of researchers working with an estimated $80,000 budget. Clearly, such efforts are currently beyond the scope of an average hacker, but the devil is in the detail of the word “currently”.

After all, while hackers are generally out for mere mischief and misanthropy, it’s not beyond the bounds of possibility that hacking cars could become a lucrative sideline. Car makers currently spend millions, even billions, on vehicle recalls and if one car can be hacked, then many can be. Can it be long before the boardrooms of Stuttgart, Detroit and Tokyo are receiving letters saying that certain systems will be disabled or corrupted unless payments are forthcoming?

It’s a brave new automotive world out there, but also a dangerous one.