Skip to main content

Are we driving into an insecure future?

(Image credit: Image Credit: Karsten Neglia / Shutterstock)

As technology has advanced, newer models of cars have presented more and more opportunities for hackers. We have seen these hacks take various forms; from accessing a Jeep’s on-board computer and taking control (opens in new tab) of the vehicle, to the security flaws that allowed anyone to unlock and drive Hyundai vehicles (opens in new tab) through a mobile app. The ‘smash and grab’ mentality of car thieves has developed into a more sophisticated ‘hack and grab’.   

Given that connected vehicles already present a range of security vulnerabilities, it is no surprise the next step for transport – autonomous vehicles – are a cause of concern (opens in new tab). With road tests for the likes of Google, Tesla and Uber moving in to production, the development of driverless cars has stepped up a gear recently. Because both the public and insurers worried about safety, manufacturers and their operators must ensure the cyber security of these vehicles is a priority, and not simply an afterthought. Whether it’s cars held for ransom or a fleet of vehicles targeted by terrorists, new threats will emerge. For example, a repeat of the Uber hack (opens in new tab) could next time be about the identities of thousands of vehicles and gaining control over them, rather than focusing on the identities of millions of customers. 

A blind spot in the making 

As global lawmakers prepare for autonomous vehicles to hit the roads, they need to acknowledge that cyber security standards must be set sooner rather than later. The government in the UK (opens in new tab) and the US (opens in new tab) have each developed their own respective guidelines for self-driving cars. The guidance covers a range of security issues for the vehicles; from having a back-up when sensors fail, to managing personally identifiable data, with a particular focus on cybersecurity. However, in their current form, these documents are only broad security guidelines for best practices.   

In the same way the government identifies a driver with a license number, or a car with a registration plate, both autonomous vehicles and their ‘drivers’ will need to be certified. It’s now up the transportation regulators like the DfT and DVLA in UK to become more agile, and intelligently regulate the entire ecosystem of autonomous vehicles, including the machine identities which enable a vehicle to know its components are safe, as well as knowing it can trust the cloud it is taking commands from. 

There is still much work to be done on how vehicles take instructions, receive updates, and communicate with applications, particularly in the cloud. The plans outlined by the UK government and US congress omit much of the nuance that is vital for cybersecurity – including validating and protecting the machine identities involved in autonomous cars,  from the vehicle’s components to the cloud which shares data to control the car. 

Used to authenticate communicate, create privacy with encryption data, and establish trust for executing code, machine identities are already vital today’s global economy, but are poorly understood and badly protected, if at all. Many companies do not comprehensively discover, monitor, revoke and replace these machine identities – yet these are a critical part of securing almost every connected device. The incredible power of machine identities makes them attractive to hackers, nation states, and terrorists.  So securing machine identities will be even more vital in a world of driverless cars where autonomous functions run in the cloud, send commands, and thousands of pieces of software must be trusted to safely operate a single vehicle at any given second. 

Where we’re going, we need security 

Autonomous vehicles, at their most basic, are essentially a collection of machines in constant communication with other machines. These ‘machines’ send and receive information from sensors and systems that control the vehicle’s internal operation and movements, and share data back and forth to the cloud for directions, diagnostics, software updates, and commands. Before a vehicle acts on any information it receives, it should validate the identity of the machine it is communicating with. Only then can the machine ensure the data being received is secure and has not been tampered with. If the identities machines sharing information – be they the sensors, the dashboard computer or a driverless car operator like Uber – are not validated then the communication could be hi-jacked and used to send false information, misdirect a vehicle or manipulate the controls.   

In the future, hacks could take over the machine identities of one or many vehicles or the identity the vehicle company’s cloud – sending instructions, software updates, and commands to create chaos, hold for ransom, or drive terror and destruction.  Researchers have already proved it possible (opens in new tab) to bypass a lack of machine identity and authenticate a software update remotely. The definition of ‘machines’ should therefore include not just the hardware and software in vehicles, but the algorithms that control the vehicle’s actions, and the connected systems that will ultimately drive the vehicle.   

Licence to kill 

In the same way we have come to expect our phones or laptops to have at least a minimal level of trust built in to identify us, such as the need to enter a password or approve a software update, we must apply the same logic to machines. The government and the public must insist on the security of every machine involved in controlling driverless vehicles, from the dashboard computer, to the sensors measuring weather conditions and the algorithms and software controlling the movements of the vehicle from the cloud. Only trusted applications, whose machine identity has been authenticated, should be allowed to share information with autonomous vehicles. This is vital to securing driverless cars and keeping future roads safe.   

Governments validate a person’s fitness to drive via a driving test and currently subsequently track their adherence to the ‘rules of the road’ through a driving test., Fitness to be on the roads will still be an issue with autonomous cars. We’ll need MOTs to measure the fitness of the algorithm ‘behind the wheel’, and constantly re-test new algorithms and the software updates which are deployed. To ensure driverless vehicles are safe for both passengers and pedestrians, we cannot neglect the process of identifying, safeguarding and even regulating the algorithms and other components of these vehicles.

Machine identities will be even more important in a world where an entire network of cars could be held for ransom or used as weapons. Giving a machine that can be manipulated, free reign over the brakes or steering column of a car, really could be a licence to kill.      

Kevin Bocek, Vice President Security Strategy and Threat Intelligence at Venafi (opens in new tab) 

Image Credit: Karsten Neglia / Shutterstock

Kevin Bocek is responsible for security strategy and threat intelligence at Venafi. He brings more than 16 years of experience in IT security with leading security and privacy leaders.