Cybersecurity issues pondered at Connected Car Expo

• 03-Dec-2014 02:40 EST

Traffic signal controls at risk range from the simple light to complex multi-lane speed limits, noted IOActive, a computer security firm.

Cybersecurity is the elephant in the room in every discussion on the connected car, including of course, at the Connected Car Expo of the 2014 Los Angeles Auto Show.

"There is no solution, just acceptable levels of risk because of communication with the outside world," was the comment by Chris Valasek, Research Director of IO Active, a computer security services company, at an expo session.

Valasek described himself as a hacker, who had demonstrated how to gain control of a car through its under-dash OBD II (onboard diagnostics, second generation). Although this was done with a physical connection, Valasek and other speakers pointed out that wireless technologies also were enablers. And there have been reports that General Motors, alerted to the dangers, had reworked its OnStarsystem to prevent access.

Valasek recommended use of "bug bounty hunters," whose skillsets include finding vulnerabilities in online systems. "I just point out the flaws. I don't have to figure out how to fix them," he said, adding the fixes are "the hard part."

Car connectivity systems that use web browsers are particularly vulnerable, he told the session.

The cloud often is seen as a safety zone, "However, it also has cybersecurity problems," said Gil Litchever, CEO of Arilou, an Israeli automotive communications security company.

Car itself less vulnerable

Although there are apparent dangers from hackers accessing the motor vehicle, it may be less vulnerable than it seems, Valasek said. "The cost of the hardware—the car—is a barrier to entry" for many, which does reduce the threat level somewhat.

Further, the car makers are not asleep. They all are working with security specialists, with Cisco Systems one of the major players.

Hyundai Motor America's Michael Deitz, who manages the company's connected-car program, told Automotive Engineering that Hyundai created its own cloud to provide an enhanced level of security for its Blue Link infotainment system. The details of the Hyundai cloud are kept tightly secret within Hyundai, he said, and all information from other clouds, such as Google for data, must get through Hyundai before it is transmitted to the car. Google, of course, has its own levels of security, including 256-bit encryption.

The security issue, Deitz said, is what has led Hyundai to move very conservatively outside the infotainment area. It had considered cyber-reflashing and pre-delivery inspections, for example, but that will have to wait until Hyundai is more comfortable with its protective layers.

There was informal discussion at the expo of encrypting the vehicle's CAN (Controller Area Network) bus to enhance security. But a fear was raised that the ever-so-slight slowdown that resulted could compromise operation of vehicle safety systems, unless the CAN bus were upgraded. This move, like other aspects of the connected car, would add to its cost.

Public infrastructure threats

Vehicle-to-infrastructure (V2I) connectivity will be a major area of concern, according to Jim Christy, CEO of The Christy Group, now a consultant but formerly an investigator with the U.S. Department of Defense Cyber Crime Center. He told the story of a teen cyberthug who was asked what he would do in a major city, if he could. The answer, "Suddenly turn all traffic lights green." Obviously this would pose a greater risk of accidents than turning them all red, but even all-red could create massive congestion.

That raised the issue of what public infrastructure is under control of governing bodies. Peter Marx, Chief of Innovation Technology for Los Angeles, said the city's Automated Traffic Surveillance and Control (ATSAC) system has been in use since 1984, when basic coverage was introduced. Today it includes close to 5000 traffic light-controlled intersections, LED street lights, and over 50,000 parking meters (including 7500 meters that can report their status (in use or not) via a smartphone app. The system has more than 20,000 detectors at traffic light equipped intersections. It is these devices that report to a central computer facility, which can estimate traffic speeds on streets within the city (highway traffic is analyzed by the California Department of Transportation).

The ATSAC computers automatically operate traffic signals to optimize vehicular flow, but for special situations an ATSAC operator can issue a command to a specific traffic light. The city claims the system reduces in-city travel time by 12%. ATSAC data are aggregated, so no privacy concerns arise, although the information is disbursed online for traffic reports and updated every 30 s.

This system is unique to Los Angeles; it was developed for the LA Coliseum area to assist traffic flow during the Olympic Games of 1984, then gradually expanded citywide. However, many other cities have some degree of automatic control of traffic lights in high-density areas, and Valasek's IOActive "hackers" have identified ways to gain access to a number of the computer systems. The vulnerabilities they discovered have been reported and software fixes reportedly were released, but whether or not they were implemented everywhere was an open question.

Some of these systems are totally unprotected—no passwords, no encryption, according to a team at the University of Michigan. The team said it easily got access into the computers of a supplier of controls to a number of cities, and could override the commands for traffic lights.

Some 85% of America's critical infrastructure, however, is in the private sector, Christy Group's CEO Christy observed, such as power generation and distribution, gas and oil pipelines, and water treatment plants. "And cybercrime does not respect geographical boundaries," he said.

Source: http://articles.sae.org/13725/