Why the connected car is one of this generation's biggest security risks

The risk with most cyberattacks is data loss. That's no laughing matter, but when you consider the rise of connected cars, the risks include serious injury or even death.

Internet connectivity is an increasingly common feature of today's cars, and as a result there has been much discussion about the potential security risks. The subject hit the headlines in the summer of 2015 when hackers were able to successfully shut down a Jeep driving at 70 mph, and again when a device was uncovered that could hack GM's OnStar service. More recently, the Nissan Leaf was shown to be hackable due to insecure APIs.

All connected devices are at risk of some kind of attack, but automobiles are far more ingrained in most societies than, say, a connected light bulb, which would likely be of interest only to the more techie-minded section of the population.

The risk presented by connected cars is apparent. But how big is the risk, and what's being done about it?

The threats

The term 'connected car' refers to any automobile with internet access; such vehicles generally also include a wireless LAN connection as well. Some cars offer in-car wi-fi for passengers, but the connection is typically used to power the car's information and entertainment system -- known in the industry as an 'infotainment' system.

Many cars also collect specific data on the vehicle itself -- GPS coordinates, speed, and other key information. This data can be used to help determine things like how fast you were going before a crash, but is quickly becoming a controversial aspect of the modern automotive industry due to the sheer volume of data being collected and the fact that almost all members of the vehicle's supply chain could benefit from accessing it.

Steve Hoffenberg, director of IoT and embedded technology for VDC Research, says that major threats against connected cars fall into two categories: Safety and data privacy. As the Jeep hack shows, the main security concern is that a hacker could remotely access your vehicle and cause a crash. In terms of data, through, privacy and financial risks both come into play.

"For connected cars, an attacker able to penetrate either the car or manufacturer end of the system will be able to go after personally identifiable information for identity theft, or directly go after financial information on subscription car services," said John Pescatore, director of emerging security trends at SANS.

One of the major issues with connected cars is the sheer number of automobiles on the road. Of course, only a small percentage of those are connected now, but that will change over time. As Hoffenberg points out, most connected products that pose a risk to human life are industrial or commercial devices that exist in much smaller numbers than cars.

Another problem is the sheer complexity of the supply chain in the automotive industry. This tiered system, says Hoffenberg, makes it difficult for the companies making the electronic subsystems to understand how their products will interact with others in the vehicle, and also for automakers to be able to understand and test these interactions.

What's next?

How many cars have been affected? As it happens, outside of intentional hacking tests such as the Jeep case, the answer is almost none.

"Part of the reason is the difficulty of the hacking, which typically requires extended periods of time (months or possibly years) experimenting with a specific vehicle," notes Hoffenberg. "Financially-motivated hackers won't see payback for their investment, but terrorists or social malcontents are likely to pursue such hacks, and some are eventually bound to succeed."

We know that these attacks can happen, even if we haven't seen many public-facing attacks yet. So, what's being done to prevent them?

Pescatore points out the advent of new industry groups such as SWRI's Automotive Consortium for Embedded Security, the SAE Vehicle Electrical System Security Committee, the US Council for Automotive Research's (USCAR) Cyber/Physical Systems Task Force, and the Automotive Industry Information Sharing and Analysis Capability (ISAC). However, he said, they're "much more talk than action."

A Ford spokesperson listed some of the precautions the company takes regarding connected cars, including separating the vehicle control systems network from the infotainment system, using cryptography to prevent updates to the modem software or access to private data, and requiring that software updates be "code-signed" and certified as coming from Ford in order to update the system.

Craig Smith, author of The Car Hacker's Handbook and founder of OpenGarages, believes that one of the major requirements for the connected car industry is an easy way to update systems over the air.

"Being able to regularly push out fixes will go a long way in maintaining secure IoT systems," says Smith.

Still, even if that system is delivered, there will be other hurdles to clear in order to lower the risk associated with connected cars. John Pironti, president of IP Architects, notes that the ability to build these systems securely has existed for years in military models, but the expense of it has kept automakers from utilizing it.

"We know how to build resistant hardware and software -- on the chip level and software level, it just adds cost to the development activity and to the actual product," says Pironti. "That cost is what a lot of manufacturers aren't willing to absorb right now. So, unless they're forced to do so, they're not going to do so. They'll claim best effort, but they'll always take that risk."

Also see

• Photos: A list of the world's self-driving cars racing toward 2020 (TechRepublic)
• IBM boosts connected car data analysis with service launch (ZDNet)
• CES 2016: Carmakers kick off the year with big moves in autonomous vehicles (TechRepublic)
• Fiat Chrysler recalls 8,000 extra Jeeps over remote control hacking worries (ZDNet)
• Ford taps IBM for data analytics to win the connected car race (TechRepublic)