National

Amidst legislative stalling, a consortium of twelve manufacturers has developed a framework for automotive cybersecurity best practices. 

The big picture: At first glance, their guidelines hit the right points — incorporating security into design, developing risk assessment and incident response strategies — but current security solutions are not sufficient against increasingly sophisticated threats.

Background: The Self-Drive Act, a bill that didn't make it through Congress, required “manufacturers of highly automated vehicles to develop written cybersecurity and privacy plans for such vehicles prior to offering them for sale.”

However, it fell short of prescribing specific guidelines for how security systems will ensure those objectives.

In developing their own safety and cybersecurity guidelines, automakers were trying to keep drivers and passengers safe — and also aiming to satisfy regulators who, in the absence of industry action or input, could impose rules that may be less favorable to companies.

What's happening: Today, most security solutions rely on rules, logic and signatures to detect threats, but this means they can only detect known threats. Contemporary security systems essentially do the bare minimum to comply with security guidances. 

This is one reason current security measures are not the best place to start in designing a framework. Any time hackers develop new viruses or malware, cybersecurity programs play catch-up.

What's needed: To go beyond compliance and prevent hackers before they compromise security measures, manufacturers need to develop systems that will enable them to meet these still-unknown threats.

Examination of vehicle system behavior anomalies could be a solution. If a hacker tries to install malware into a vehicle's ECU, the system would detect activity in the ECU that should not be taking place.

In another scenario, if a vehicle's ECU is acting in an irregular manner, that could mean that malware is present. The system could be programmed to block vehicle operations until the threat is addressed, preventing the malware from acting.

The bottom line: Cyber threats are increasing as more vehicles become connected, and as connected vehicles become more sophisticated. Current solutions are not advanced enough to satisfy the spirit of even the strictest security and privacy guidelines. Updating the solutions and frameworks should go hand in hand.

Yossi Vardi is the CEO of SafeRide Technologies, an automotive cybersecurity startup.

Where current cybersecurity guidelines fall short

Updating cybersecurity solutions and guidelines should go hand in hand.

Animated illustration of a futuristic car with electricity emanating from the center.

Transportation

Cybersecurity

Expert Voices

Technology

Amidst legislative stalling, a consortium of twelve manufacturers has <a class="gtmContentClick" data-vars-link-text="developed" data-vars-click-url="https://www.globalautomakers.org/OldSiteContentAssets/press-release/Automakers-Develop-Framework-for-Automotive-Cybersecurity-Best-Practices-assets/framework-autocyberbestpractices-14jan20161-pdf" data-vars-content-id="00664b30-437a-4b97-9b58-45f69b768b55" data-vars-headline="Where current cybersecurity guidelines fall short" data-vars-event-category="story" data-vars-sub-category="story" data-vars-item="in_content_link" href="https://www.globalautomakers.org/OldSiteContentAssets/press-release/Automakers-Develop-Framework-for-Automotive-Cybersecurity-Best-Practices-assets/framework-autocyberbestpractices-14jan20161-pdf" target="_blank">developed</a> a framework for automotive cybersecurity best practices. The big picture: At first glance, their guidelines hit the right points — incorporating security into design, developing risk assessment and incident response strategies — but current security solutions are not sufficient against increasingly sophisticated threats.

From the Valley to D.C., Big Tech players like Facebook, Google and Amazon are under more scrutiny than ever as new technology develops and privacy and antitrust concerns grow in lockstep with companies’ ambitions.

With cars further evolving from “just” hardware into software platforms, the wide range of IT systems in an autonomous vehicle present many opportunities for cyberattacks. Artificial intelligence, especially machine learning technologies, can detect anomalous vehicle behavior or attempted code interference in real time.

Why it matters: Compromised code in the systems that control acceleration, braking, directional guidance and other crucial safety functions can jeopardize lives on the road. 

After hackers breach an AV’s system, they can identify vulnerabilities, infect additional areas of the vehicle, and collect and extract data.

Their malicious goals could include anything from tracking the vehicle's movements (perhaps with an eye toward robbing passengers or burglarizing their homes when they are far enough away) to disabling its brakes, putting people both inside and around the vehicle in danger.

Embedded, stealth malware in the vehicle's network and in the units that control its IT and electronic subsystems could generate atypical activity, such as fluctuations in the number of bytes sent or the amount of memory being used. 

Example: Hackers could install malware in a truck that activates when it determines — via the vehicle's cameras and sensors — the truck is in an isolated section of highway. The truck could be forced to stop, allowing criminals in another vehicle to corner it and abscond with the loot. 

AI uses data from the vehicle's network and central computers to learn its normal behavior, typically before the vehicle is mass-produced. Algorithms can then process operating data to identify and flag any abnormal behavior as a potential cyberattack, triggering safety systems that can intervene.

These algorithms need to distinguish between real attacks and false positives, such as when a vehicle owner has modified the software for speed or other safety precautions.

What to watch: Attacks on AVs could spur a “horse race” between developers trying to continually improve traditional security measures and hackers developing more sophisticated attacks to upend these security systems. 

Machine learning could protect AV systems from cyberattacks

Machine learning can continually refine its ability to detect anomalies.

Illustration of car surrounded by artificial intelligence dome

With cars further evolving from “just” hardware into <a class="gtmContentClick" data-vars-link-text="software platforms" data-vars-click-url="http://felixonline.co.uk/articles/2018-10-29-your-filename/" data-vars-content-id="79d0060d-f453-4ffe-9a24-283a68852c59" data-vars-headline="Machine learning could protect AV systems from cyberattacks" data-vars-event-category="story" data-vars-sub-category="story" data-vars-item="in_content_link" href="http://felixonline.co.uk/articles/2018-10-29-your-filename/" target="_blank">software platforms</a>, <a class="gtmContentClick" data-vars-link-text="the wide range of IT systems" data-vars-click-url="https://www.rand.org/content/dam/rand/pubs/research_reports/RR400/RR443-2/RAND_RR443-2.pdf" data-vars-content-id="79d0060d-f453-4ffe-9a24-283a68852c59" data-vars-headline="Machine learning could protect AV systems from cyberattacks" data-vars-event-category="story" data-vars-sub-category="story" data-vars-item="in_content_link" href="https://www.rand.org/content/dam/rand/pubs/research_reports/RR400/RR443-2/RAND_RR443-2.pdf" target="_blank">the wide range of IT systems</a> in an autonomous vehicle present many opportunities for cyberattacks. Artificial intelligence, especially machine learning technologies, can detect anomalous vehicle behavior or attempted code interference in real time.Why it matters: Compromised code in the systems that control acceleration, braking, directional guidance and other crucial safety functions can jeopardize lives on the road.

Recent hacks of connected vehicles can teach AV developers how to design cybersecurity measures that are cued by anomalies in vehicle behavior.

Why it matters: Today's connected vehicles lack adequate security systems, and autonomous vehicles will have far more vulnerabilities, raising the stakes even higher.

Background: Some current vehicles have anti-malware systems adapted from the IT world, but those are not in wide use and are not robust enough to fully protect connected vehicles, let alone AVs.

Hackers have compromised a vehicle's onboard computer using its tire pressure monitor sensor and via SMS messages sent over 4G networks.

They have assumed varying degrees of control over connected vehicles using Wi-Fi connections as well, including steering and braking systems, and via over-the-air updates and onboard diagnostic ports.

AV systems are more multifaceted, creating new vulnerabilities, particularly with vehicle-to-everything connectivity in place. They also have more sensors; when sensor data is uploaded to servers, that creates another point of vulnerability.

What's needed: So far, manufacturers have responded by issuing security updates for vehicles — but a proactive system that can anticipate and prevent attacks will be imperative for AV safety. One strategy — being explored by companies like SafeRide Technologies, Vectra, PerimeterX, and ExtraHop — is to examine malware behavior.

A behavior-based security system could be triggered by behavior anomalies, rather than detecting a malware's signature. Triggers could include an upload to a sensor server with fewer or more bytes than typically expected or superfluous computer activity registered by the engine control unit.

This system could work regardless of the attack type or vulnerability targeted, which is critical given that hackers can mutate code endlessly. 

What to watch: Behavior-based security systems must have the capability to learn vehicle behavior independently, without dependency on every software or hardware vendor, and regardless of data formats. Since that would require computing power that only advanced, high-end vehicles have onboard, most cars would need to rely on network bandwidth to run the detection program on the cloud.

Detecting unexpected behavior could be key to securing AV systems

Their varied vulnerabilities require a new approach.

Animated illustration of an AI finding the differences between two cars. 

Recent hacks of connected vehicles can teach AV developers how to design cybersecurity measures that are cued by anomalies in vehicle behavior.Why it matters: Today&#x27;s connected vehicles lack adequate security systems, and autonomous vehicles will have far more vulnerabilities, raising the stakes even higher.

Yossi Vardi

Stories

Where current cybersecurity guidelines fall short

Detecting unexpected behavior could be key to securing AV systems

Machine learning could protect AV systems from cyberattacks