The new technology that could make car theft easier

[ad_1]

There is currently a lot of discussion in the automotive industry about the ‘Internet of Vehicles’. But how can it benefit thieves? How can we reconcile convenience and security on the internet in vehicles? GETTY IMAGES There is currently a lot of discussion in the automotive industry about the “Internet of Vehicles” (IoV). IoV is a network of cars and other vehicles that can exchange data over the internet, to try to make transport more autonomous, safe and efficient. IoV can help vehicles identify roadblocks, congestion, and pedestrians. It could help position the car on the road, possibly enable driverless driving and provide simpler fault diagnosis. To some extent, it already exists on smart roads, where technology is employed to manage traffic as efficiently as possible. A more sophisticated IoV will require more sensors, software and other technologies to be installed in vehicles, as well as more infrastructure on the roads. Cars now include more electronic systems than ever before, from cameras and cell phone connections to infotainment systems. But some of these systems could also expose our vehicles to theft and malicious attacks, as criminals identify and exploit vulnerabilities in new technology. And indeed, this is already happening. Bypassing security Smart keys theoretically protect modern vehicles from theft. In order to drive the car, its owner presses a button on the key that turns off the vehicle’s immobilizer system (an electronic device that prevents the car from being started without the key). But a known way to circumvent this system includes a manual relay tool that makes the vehicle “think” that the smart key is closer to what it actually is. You need two people working together, one standing by the vehicle and the other near the actual location of the key, such as next to the car owner’s house. The person near the house uses the tool, which can pick up the key signal and relay it to the vehicle. The relay device needed to carry out this type of theft can be found on the internet for less than £100 ($200) and attempts are often made at night. To prevent their occurrence, car keys can be placed in Faraday bags or boxes that block all signals emitted by the keys. But there is now a more advanced method of cyberattacking vehicles that is becoming more and more common. It is known as a “CAN injection attack” (Controller Area Network) and works by establishing a direct connection with the vehicle’s internal communication system, the CAN bus. The main path to the CAN bus is under the vehicle. Therefore, criminals try to gain access through the car’s headlights. You have to remove the bumper to insert a CAN injector into the engine system. Thieves can then send false messages to trick the vehicle into believing these signals are from the smart key and turn off the immobilizer system. And once they gain access to the vehicle, they can start the car and drive away. The car’s infotainment system can be a point of great vulnerability. GETTY IMAGES ‘Zero Trust’ Approach With the prospect of a potential car theft epidemic, manufacturers are testing new ways to eliminate this new vulnerability as quickly as possible. One strategy is to not trust any messages received by the car. It is called the “zero trust approach”. In this system, all messages need to be sent and verified. One way is to install a hardware security module in the vehicle, which works by generating cryptographic keys, which allow data to be encrypted and decrypted, creating and verifying digital signatures on messages. The automotive industry is increasingly installing this mechanism in new cars. But incorporating it into existing vehicles is impractical for time and cost reasons, so many of the cars that are on the road remain vulnerable to attack by CAN injection. Attacks on Infotainment Systems Another security concern among modern vehicles is the on-board computer system, also called the “infotainment system”. The possible vulnerabilities of this system are often overlooked, although its repercussions can be catastrophic for the driver. One example is the possibility that attackers could execute “remote code” to deliver malicious code to the vehicle’s computer system. In a reported case in the United States, the infotainment system served as an entry point for attackers, who introduced their own code through it, to send commands to the physical components of the car, such as the engine and wheels. An attack like this clearly has the potential to impair vehicle operation, causing accidents. This is not a simple matter of protecting personal data contained in the infotainment system. Attacks of this nature can exploit many vulnerabilities, such as the vehicle’s internet browser, USB sticks and programs that need to be updated to protect the system against known attacks, in addition to weak passwords. Therefore, all drivers of vehicles with infotainment systems should have a good understanding of the basic security mechanisms that can protect them against hacker attacks. The possibility of an epidemic of vehicle thefts and insurance claims due to CAN attacks is a frightening prospect. There needs to be a balance between the benefits of the Internet of Vehicles, such as safer driving and greater ability to recover stolen cars, and its potential risks. *Rachael Medhurst is Lecturer and Director of Cybersecurity Courses at the National Academy of Cybersecurity (NCSA) at the University of South Wales in the United Kingdom. This article originally appeared on The Conversation academic news site and is republished under a Creative Commons license. Read the original English version here.

[ad_2]

Source link