{"id":17334,"date":"2020-09-04T21:52:33","date_gmt":"2020-09-04T17:52:33","guid":{"rendered":"https:\/\/me-en.kaspersky.com\/blog\/cybersecurity-automotive\/17334\/"},"modified":"2020-09-04T21:53:19","modified_gmt":"2020-09-04T17:53:19","slug":"cybersecurity-automotive","status":"publish","type":"post","link":"https:\/\/me-en.kaspersky.com\/blog\/cybersecurity-automotive\/17334\/","title":{"rendered":"Cybersecurity \u2013 the new dimension of automotive quality"},"content":{"rendered":"

Quite a lot of folks seem to think that the automobile of the 21st century is a mechanical device. Sure, it has added electronics for this and that, some more than others, but still, at the end of the day \u2013 it\u2019s a work of mechanical engineering: chassis, engine, wheels, steering wheel, pedals\u2026 The electronics \u2013 \u2018computers\u2019 even \u2013 merely help all the mechanical stuff out. They must do \u2013 after all, dashboards these days are a sea of digital displays, with hardly any analog dials to be seen.<\/p>\n

Well, let me tell you straight: it ain\u2019t so!<\/p>\n

A car today is basically a specialized computer \u2013 a \u2018cyber-brain\u2019, controlling the mechanics-and-electrics we traditionally associate with the word \u2018car\u2019 \u2013 the engine, the brakes, the turn indicators, the windscreen wipers, the air conditioner, and in fact everything else.<\/p>\n

For example: in the past the handbrake was 100% mechanical. You\u2019d wrench it up \u2013 with your \u2018hand\u2019 (imagine?!), and it would make a kind of grating noise as you did. Today you press a button. 0% mechanics. 100% computer controlled. And it\u2019s like that with almost everything.<\/p>\n

Now, most folks think that a driver-less car is a computer that drives the car. But if there\u2019s a human behind the wheel of a new car today, then it\u2019s the human doing the driving (not a computer), \u2018of course, silly!\u2019<\/p>\n

Here I go again\u2026: that ain\u2019t so either!<\/p>\n

With most modern cars today, the only difference between those that drive themselves and those which are driven by a human, is that in the latter case the human controls the onboard computers. While in the former \u2013 the computers all over the car are controlled by another, main, central, very smart computer, developed by companies like\u00a0Google<\/a>,\u00a0Yandex<\/a>,\u00a0Baidu<\/a>\u00a0and\u00a0Cognitive<\/a>\u00a0Technologies<\/a>. This computer is given the destination, it observes everything going on around it and then decides how to navigate its way to the destination, at what speed, by which route, and so on based on mega-smart algorithms, updated by the nano-second.<\/p>\n

A short history of the digitalization of motor vehicles<\/h2>\n

So when did this move from mechanics to digital start?<\/p>\n

Some experts in the field reckon the computerization of the auto industry began in 1955 \u2013 when Chrysler started offering a transistor radio as an optional extra on\u00a0one<\/a>\u00a0of its models. Others, perhaps thinking that a radio isn\u2019t really an automotive feature, reckon it was the introduction of electronic ignition, ABS, or electronic engine-control systems that ushered in automobile-computerization (by Pontiac, Chrysler and GM in 1963, 1971 and 1979,\u00a0respectively<\/a>).<\/p>\n

No matter when it started, what followed was for sure more of the same: more electronics; then things started becoming more digital \u2013 and the line between the two blured. But I consider the start of the digital revolution in automotive technologies as February 1986, when, at the\u00a0Society of Automotive Engineers<\/a>\u00a0convention, the company Robert Bosch GmbH presented to the world its digital network protocol for communication among the electronic components of a car \u2013\u00a0CAN<\/a>\u00a0(controller area network<\/a>). And you have to give those Bosch guys their due: still today this protocol is fully relevant \u2013 used in practically every vehicle the world over!<\/p>\n

\n

Quick nerdy post-CAN-introduction digi-automoto backgrounder<\/h3>\n

The Bosch boys gave us various types of CAN buses (low-speed, high-speed, FD-CAN), while today there\u2019s\u00a0FlexRay<\/a>\u00a0(transmission), LIN (low-speed bus), optical MOST (multimedia), and finally, on-board Ethernet (today \u2013 100mbps; in the future \u2013 up to 1gbps). When cars are designed these days, various communications protocols are applied. There\u2019s\u00a0drive by wire<\/a>\u00a0(electrical systems instead of mechanical linkages), which has brought us:\u00a0electronic gas pedals<\/a>,\u00a0electronic brake pedals<\/a>\u00a0(used<\/a>\u00a0by Toyota, Ford and GM in their hybrid and electro-mobiles since 1998),\u00a0electronic handbrakes<\/a>,\u00a0electronic gearboxes<\/a>, and\u00a0electronic steering<\/a>\u00a0(first<\/a>\u00a0used by Infinity in its\u00a0Q50<\/a>\u00a0in 2014).<\/p>\n

\"BMW<\/a>

BMW buses and interfaces<\/p><\/div>\n

In the year 2000, Honda introduced\u00a0electric power steering<\/em><\/a>\u00a0(on its S2000), which, given certain conditions, can turn the wheel itself.\u00a0Keyless ignition systems<\/em><\/a>\u00a0appeared around the same time, permitting control of the engine without a driver. Since 2010 some dashboard displays are completely digital, and can give you readings on just about anything. Since 2015 the electronics of the body (doors, windows, locks, etc.) of practically all new cars are connected to the central computer, which can make decisions for them itself. And all information about the world outside a car (via cameras, assistants, radars, microphones\u2026) is accessible to the internal bus \u2013 read: in the cloud.<\/p>\n

Finally, I close this brief historical digression with a\u00a0document<\/a>, adopted in 2019 by the UN, which introduced standards for full digitalization of brakes. Before, electronic control of brake pedals had to be duplicated by a physical cable. No more\u2026\n<\/p><\/blockquote>\n

Connect or die<\/h2>\n

So what operating systems do today\u2019s cars run on? No surprises here: Windows, Linux, Android \u2013 also one called QNX, which, together with Linux, is the most popular (but, as analysts point out, Android is fast catching them up). Btw \u2013 like any software, automobile-OSs need updating occasionally; but get this: some updates can be a few dozen gigabytes in size. Ouch!<\/p>\n

\"BMW<\/a>

BMW onboard-computer updates<\/p><\/div>\n

Now for another short stop before the main course\u2026<\/p>\n

So \u2013 if a modern car is a computer, and it is regularly updated, that must mean it\u2019s connected to the internet, right? Right. And these days it\u2019s not an option; it\u2019s mandatory on all new cars \u2013 in\u00a0Russia<\/a>\u00a0(since 2017), in\u00a0Europe<\/a>\u00a0(since 2018), and elsewhere. And today the percentage share of \u2018connected cars\u2019 (connected to the manufacturer\u2019s cloud) is\u00a0fast approaching 100%<\/a>\u00a0in the world. There are a few countries where there are restrictions on such cars, but that appears to only be due to outdated legislation, which will inevitably eventually be updated.<\/p>\n

Btw, the first connected vehicle appeared back in 1996, the result of\u00a0cooperation<\/a>\u00a0between General Motors and Motorola \u2013 the\u00a0OnStar<\/a>\u00a0telematic system. This can connect with an operator automatically in case of an accident \u2013 yes, kinda like the \u2018accident\u2019 in Die Hard 4<\/a>.<\/p>\n

Remote vehicle diagnostics\u00a0came along<\/a>\u00a0in 2001, and by 2003 connected cars had learned how to send the manufacturer reports on the condition of the car. Telematic data-only blocks\u00a0arrived<\/a>\u00a0in 2007.<\/p>\n

In 2014 Audi was the first to offer the option of installing\u00a04G-LTE-WiFi hotspots<\/a>\u00a0in a car. In 2015 GM didn\u2019t just provide the option, it started fitting all its new cars with hotspots \u2013 and received more than a billion telematic reports from car owners! Today, manufacturers have even started monetizing telemetry \u2013 with BMW\u00a0leading the way<\/a>, and also\u00a0converging<\/a>\u00a0smartphone and automobile tech.<\/p>\n

Now \u2013 a question: What is here in this screenshot below?<\/p>\n

\"Your<\/a><\/p>\n

That, dear readers, is your car; at least\u00a0\u2013 how it looks to the manufacturer (in real time, all the time, to folks working at the manufacturer maybe on the other side of the world). Software that can see and tinker with all control units, the network topology, routing rules, loaders, updates \u2013 all as if in the palm of their hand. But\u2026 also in there: bugs and vulnerabilities that can make you shudder\u2026 and want to return to the 80s when a\u00a0car was a car<\/a>\u00a0\u2013 not a computer ). And it\u2019s not just me scaremongering. The\u00a0threats<\/a>\u00a0are<\/a>\u00a0real<\/a>,\u00a0folks<\/a><\/p>\n

The light at the end of the tunnel<\/h2>\n

After the electro-digi-auto-build-up of the last 20-or-so years, it does feel like a revolution in the car industry is just around the corner. However!\u2026 A bright future of ultra-connected computerized cars is all very well dreaming about, but there\u2019s some harsh reality getting in the way \u2013 both legislative and technical. Here, I\u2019ll talk about the latter\u2026<\/p>\n

The new automotive paradigm simply cannot be superimposed onto even the very latest auto-electronics architecture. Why? Because under the hood of a new car these days there are around 150 electronic units developed by different manufacturers at different times and according to different standards \u2013 all without taking into account the full cyberthreat landscape of this new auto-paradigm.<\/p>\n

At least the car manufacturers seem to understand that building a utopian\u00a0V2X<\/a>-future upon the\u00a0mess<\/span>\u00a0hodge-podge of diverse electronics of a modern car is simply out of the question (and there are\u00a0plenty<\/a>\u00a0of\u00a0examples<\/a>\u00a0demonstrating<\/a>\u00a0this<\/a>, and\u00a0plenty<\/a>\u00a0more that never made it into the press). So, for now \u2013 the automobile manufacturing industry has come to a dead-end.<\/p>\n

Dead-ends like this one are common \u2013 you may recall the long dualism of the two architectures of\u00a0Windows (9x and NT)<\/a>\u00a0that existed in parallel. Still, channeling lessons learned in that case, for an opening to appear at the dead-end the auto-industry finds itself in now, I see two possible scenarios.<\/p>\n

The first: cheap, cheerful, quick, and\u00a0wrong<\/em>: to do what I\u2019ve just said really should not be done \u2013 applying the new paradigm onto today\u2019s motor vehicle as it is (with its digital soup of 150+ ingredients). It\u2019s wrong as it would delay the second scenario \u2013 but not before causing harm to life (these are cars remember, not a PC in the corner of your room), some serious reputation damage, financial losses, plus folks saying \u2018told you so\u2019.<\/p>\n

The second: not cheap, not quick, and\u00a0right<\/em>: to build up a new architecture from the ground up \u2013 based on three main principles:<\/p>\n