A new paper by a group of academic researchers has exposed a set of serious weaknesses in the software systems that control many modern cars, giving them the ability to lock passengers inside the car, cut the car’s brakes and perform other interesting tricks.
The work, done by researchers at the University of Washington and the University of California at San Diego, is interesting on several levels, perhaps most of all because it applies not just to one make or model, or even just to cars in general. The research points up the deep reliance many of today’s vehicles and other complex systems have on relatively simple software.
“Over a range of experiments, both in the lab and in road tests, we demonstrate the ability to adversarially control a wide range of automotive functions and completely ignore driver input —
including disabling the brakes, selectively braking individual wheels on demand, stopping the engine, and so on. We find that it is possible to bypass rudimentary network security
protections within the car, such as maliciously bridging between our car’s two internal subnets. We also present composite attacks that leverage individual weaknesses, including an attack
that embeds malicious code in a car’s telematics unit and that will completely erase any evidence of its presence after a crash,” the researchers wrote.
Their paper, “Experimental Security Analysis of a Modern Automobile,” will be presented at the IEEE Symposium on Security and Privacy next week.
The researchers worked on two identical cars–whose make and model they don’t disclose–in an effort to see how the vehicles’ internal network operated and whether it was susceptible to any external attacks. The did some extensive fuzzing on the software, and, as it turned out, they were able to use the network to execute quite a number of clever attacks.
They were able to turn the brakes on and off, take over control of the radio and climate control system and lock the driver inside the vehicle remotely. However, the researchers don’t think there’s much of a threat to current drivers, IDG’s Robert McMillan reports.
“We think this is an industry issue,” said Stefan Savage, an
associate professor with the University of California, San Diego.
He and co-researcher Tadayoshi Kohno of the University of Washington,
describe the real-world risk of any of the attacks they’ve
worked out as extremely low. An attacker would have to have
sophisticated programming abilities and also be able to physically
mount some sort of computer on the victim’s car to gain access to the
embedded systems. But as they look at all of the wireless
and Internet-enabled systems the auto industry is dreaming up for
tomorrow’s cars, they see some serious areas for concern.
“If there’s no action taken on the part of all the relevant
stakeholders, then I think there might be a reason to be concerned,”
Kohno said.
The researchers conclude that as there is a broad range of potential threats to vehicles that are software-dependent, there likely is no single security mechanism that can address all of these threats.
“Thus, we argue that the future research agenda for securing cyber-physical vehicles is not merely to consider the necessary technical mechanisms, but to also inform these designs by what is feasible practically and compatible with the interests of a broader set of stakeholders,” they write.
