Boston: A team of top hackers working for Intel Corp’s security division toil away in a West Coast garage searching for electronic bugs that could make automobiles vulnerable to lethal computer viruses.
Intel’s McAfee unit, which is best known for software that fights PC viruses, is one of a handful of firms that are looking to protect the dozens of tiny computers and electronic communications systems that are built into every modern car.
It’s scary business. Security experts say that automakers have so far failed to adequately protect these systems, leaving them vulnerable to hacks by attackers looking to steal cars, eavesdrop on conversations, or even harm passengers by causing vehicles to crash.
“You can definitely kill people,” John Bumgarner, chief technology officer of the US Cyber Consequences Unit, a non-profit organisation that helps companies analyse the potential for targeted computer attacks on their networks and products, said.
To date, there have been no reports of violent attacks on automobiles using a computer virus, according to SAE International, an association of more than 128,000 technical professionals working in the aerospace and the auto industries.
Resistant to attacks
Yet, Ford spokesman Alan Hall said his company had tasked its security engineers with making its Sync in-vehicle communications and entertainment system as resistant as possible to attack.
“Ford is taking the threat very seriously and investing in security solutions that are built into the product from the outset,” he said.
And a group of US computer scientists shook the industry in 2010 with a landmark study that showed viruses could damage cars when they were moving at high speeds. Their tests were done at a decommissioned airport.
SAE International charged a committee of more than 40 industry experts with advising manufacturers on preventing, detecting, and mitigating cyber attacks.
“Any cyber security breach carries certain risk,” Jack Pokrzywa, SAE’s manager of ground vehicle standards, said. “SAE Vehicle Electrical System Security Committee is working hard to develop specifications which will reduce that risk in the vehicle area.”
Delivering Trojans
The group of US computer scientists from California and Washington state issued a second report last year that identified ways in which computer worms and Trojans could be delivered to automobiles — via onboard diagnostics systems, wireless connections, and even tainted CDs played on radios systems.
They did not say which company manufactured the cars they examined, but did say they believed the issues affected the entire industry, noting that many automakers use common suppliers and development processes.
The three big US automakers declined to say if they knew of any instances in which their vehicles had been attacked with malicious software or if they had recalled cars to fix security vulnerabilities.
Toyota Motor Corp, the world’s biggest automaker, said it was not aware of any hacking incidents on its cars.
“They’re basically designed to change coding constantly. I won’t say it’s impossible to hack, but it’s pretty close,” Toyota spokesman John Hanson said.
A spokesman for Honda Motor Co said that the Japanese automaker was studying the security of on-vehicle computer systems.
Frightening repercussions
Bruce Snell, a McAfee executive who oversees his company’s research on car security at the Oregon garage, said automakers are fairly concerned about the potential cyber attacks because of the frightening repercussions.
“If your laptop crashes, you’ll have a bad day, but if your car crashes, that could be life threatening,” he said. “I don’t think people need to panic now. But the future is really scary.”
A McAfee spokeswoman said that among those hackers working on pulling apart cars was Barnaby Jack, a well-known researcher who has previously figured out ways that criminals could force ATMs to spit out cash and cause medical pumps to release lethal doses of insulin. Makers of those products responded by saying they would work to improve security.
White hats are increasingly looking beyond PCs and data centres for security vulnerabilities that have plagued the computer industry for decades and focusing on products like cars, medical devices, and electricity meters that run on tiny computers embedded in those products.
Automobiles are already considered “computers on wheels” by security experts. Vehicles are filled with dozens of tiny computers known as electronic control units, or ECUs, that require tens of millions of lines of computer code to manage interconnected systems, including engines, brakes, and navigation as well as lighting, ventilation, and entertainment.
Remote attacks
Cars also use the same wireless technologies that power cell phones and Bluetooth headsets, which makes them vulnerable to remote attacks that are widely known to criminal hackers.
“There is tons of opportunity for attack on car systems,” Stuart McClure, an expert on automobile security who recently stepped down as worldwide chief technology officer of McAfee to start his own firm, said.
Security analysts fear that criminals, terrorists, and spies are gradually turning their attention to embedded computers, many of which can be attacked using some of the same techniques as regular computers.
Automakers are rushing to make it easy to plug portable computers and phones to vehicles and connect them to the internet, but in many cases they are also exposing critical systems that run their vehicles to potential attackers because those networks are all linked within the car.
“The manufacturers, like those of any other hardware products, are implementing features and technology just because they can and don’t fully understand the potential risks of doing so,” Joe Grand, an independent hardware security expert, said.
Grand estimates that the average automaker is about 20 years behind software companies in understanding how to prevent cyber attacks.
Chrysler said it was addressing security issues with industry groups and outside organisations, including Battelle Corp, a non-profit company that recently established an auto security research center in Columbia, Maryland known as Cave (Centre for Advanced Vehicle Environments).
Cave has hired hacking expert Tiffany Strauchs Rad, a professor at the University of Southern Maine. Last year, she was part of a team that identified flaws in prison networks which could enable hackers to remotely open or lock cell doors.
Concerns about such possibilities emerged after a group of computer scientists from the University of California and the University of Washington published two landmark research papers.
