Free Essay Example on Car Hacking

Keywords – car hacking, automotive security, vehicle computerization, CAN bus, electronic control unit

Is your time best spent reading someone else’s essay? Get a 100% original essay FROM A CERTIFIED WRITER!

Order now

S more cars become increasingly computerized, they become more susceptible to hackers. Researchers have shown that hackers can use a vulnerability in a car’s system to have control of the various aspects of the vehicle and cause all sorts of troubles. The vulnerabilities in the automobile securities range from ordinary attacks such as flashing the lights of the vehicle to terrifying stuff such as the attacker remotely gaining access to the whole vehicle. A hacker has the possibility of compromising some of the electronic components of a vehicle and cause it to behave erratically. Despite car makers stepping up their efforts to improve the security of their cars, more needs to be done. So far, there have been few cases of car hacking except for the demonstrations by researchers on certain vulnerabilities. However, in the coming days, car security would become an important issue for car users. This reaffirms the need for automobile manufacturers to improve the security on their system. In this paper, I will be educating you on the current state of automotive security and potential solutions to the problems.

II. SECURITY VULNERABILITIES IN AUTOMOBILES

The modern automotive consists of interconnected components managed by the onboard computer systems on the vehicle. The interconnected components in a vehicle include brake controller, the engine management system, door locks, sound systems, set controls, communication systems and much more. Because of the interconnectivity of the various components in the vehicle, an attacker could enter one system before turning to exploit another system [1]. A weakness in any component in a vehicle is a possible point that an attacker could use to get access to the other systems of the vehicle. At the core of the interconnected system of a modern vehicle, there is the controller area network bus (CAN bus). The CAN bus architecture was developed to be lightweight and robust and allow communication between various vehicular components [1]. However, the CAN design is a low-level protocol that is unable to implement any security features and hence contains numerous vulnerabilities. The architecture lacks segmentation and boundary defense, device authentication and encryption.

Network segmentation is important in preventing attackers from getting access to sensitive parts once they have gained access to a network. By using proper segmentation, designers can minimize the level of access to unauthorized people or applications while at the same time enabling access to the authorized ones [2]. While the CAN bus architecture uses various electronic control units to manage the different functions of the vehicle, all sections of the bus have a common connection at some point. This means that if attackers have access to one system, they can have control of the other system as a result of the common connection points [3]. Another vulnerability in the CAN bus architecture is the absence of device authentication on the system. The network consists of different controllers performing different functions. When a controller broadcasts data onto the bus, the data becomes to all other components of the vehicle regardless of whether they require the data or not [3]. Under normal circumstances, such a system works well. However, it does not prevent unauthorized devices from broadcasting or listening for information. Finally, lack of encryption can be a possible entry point for hackers. Unencrypted messages can result in the traffic being sniffed by appropriate hardware. Such hardware is available at low-cost prices and enables an attacker to snip CAN data in transit [3]. Also, lack of encryption implies that there is no way for the system to guarantee message authenticity. The vulnerabilities of the CAN bus architecture reaffirm the need for manufacturers to produce more secure products.

Fig. 1. Diagram of electronic components in a car, courtesy of the Mercedes-Benz Museum (as cited in Computer History Museum, 2011) [4]

III. MOTIVATIONS FOR AUTOMOTIVE SECURITY ATTACKS

A lot is being said about the vulnerabilities in modern vehicles and the need for manufacturers to design and build more secure systems. However, there is scarce information about what motivates people to hack vehicles. The truth is, before car manufacturers can effectively protect the systems on their vehicles, they first have to understand and think like the people who might exploit the systems. From there, they can figure out the components that are most vulnerable and then develop and design a system that offers little exposure to the hackers. If manufacturers can understand the people who would want to do harm to their products, then they will be in a better position to protect their vehicles as well as data stored on their systems. They will have relevant information needed to strengthen their systems and take necessary action to better control the access to various components of the vehicle.

Today, attackers go for systems that have weaknesses that they can exploit. It is the systems that are weakly secured that attackers can use to manipulate and compromise functionality and at times cause massive damage. For the manufacturers to strengthen the systems, it is crucial for them to understand the objectives, motivations, and actions of the attackers. There are many motivations for hacking a vehicle. They include theft, espionage, research and owner needs. Among these motivations, theft ranks the highest. Thieves have long targeted vehicles due to them being high valued assets. With the recent increase in automobile computerization and the inclusion of features such as keyless entry, stealing has become less physical and inconspicuous [5]. Other than stealing the vehicle and commodities inside it, thieves may start targeting the increasing volume of sensitive and private information stored in vehicles. Another motivation for automotive security attack is espionage. The infotainment system in modern vehicles tracks and record confidential information such as call history, contacts, and location history. With the increasing popularity of such systems, attackers can exploit them to track and eavesdrop on people [5]. Apart from attackers with ill motives, car owners may hack their vehicles with the aim of improving performance, carrying out maintenance and repairs or remove certain restrictions imposed by car manufacturers. Finally, researchers may hack automobiles to highlight vulnerabilities before the bad guys can use them to carry out attacks for selfish gains [3]. Regardless of the motivation of a hacker, car manufacturers should know that information at the wrong hands is always dangerous. A Proper understanding of the motivations for hacking automobiles allows security designers to improve and strengthen the systems in a vehicle as well as ensure that sensitive information does not fall in the wrong hands.

IV. SECURING THE AUTOMOBILE

The potential threats and vulnerabilities call for designing secure automotive systems. Though automotive security is relatively recent, strong technologies and expertise in other industries can be adapted to improve security. Developers can incorporate secure development processes as used in other fields to ensure the security of their new vehicles by design [2]. The principles that lead to safe cars also apply to security. In general, reliability, safety, privacy, and security must all begin at the groundworks during the design phase. To ensure that the design of the systems is secure, the vehicle’s threat model should anticipate different types of threats and strive to alleviate them. The security designer should develop layers of protection that can isolate threats before they can affect the operations of the vehicle [6]. There are a set of security tools – ranging from data encryption to isolation of software elements by function – available to the vehicle security architect. Also, a combination of software and hardware functions based on specific requirements can assist in reducing costs while improving performance goals.

The security of the computerized systems in automotive is a collaborative approach that should aim to detect and correct threats that are identifiable and avoidable and protect from previously unknown threats. There are four levels of security that designers need to consider. These are hardware security, software security, network security, and cloud-based security services. Hardware security systems protect the operational vehicular components from deliberate and accidental damage [6]. The various hardware security building blocks include secure boot, trusted execution technology, tamper protection, cryptographic acceleration, active memory protection and device identity on every device. Software security, on the other hand, protects the components from non-physical attacks. Software technologies that can be used to protect the vehicle include secure boot, partitioned operating systems, authentication and enforcement of appropriate behavior [1]. Apart from hardware and software securities, designers also have to ensure network security. With the modern vehicle carrying operational and personal identifiable information, message and data protection over the communication bus are crucial for privacy, security, and consumer trust [7]. Hardware assisted technologies that can assist in securing networks without affecting performance include message and device authentication and access controls. Finally, the vehicle would require cloud-based security services to protect against real-time security threats. Real-time protection involves using secure authenticated channels when connecting to the cloud, remote monitoring of activities, credential management, and over-the-air updates [1]. Other than the security levels, users must also be educated about the various security aspects of the vehicle as well as potential threats so as to minimize or eliminate the vulnerabilities.

V. CONCLUSION

Computerization of vehicles has resulted in increased safety, functionality and value for vehicles. The modern car is a complex system that consists of numerous electronic control units that control various functions of the vehicles. The components communicate with each other via the controller area network bus which is inherently vulnerable to attacks. With recent security research revealing these vulnerabilities, it has become important for car manufacturers to ensure protection and safety of their vehicles by employing strict security measures. Some of the methods that can ensure the security of vehicular components include secure boot, trusted execution technology, tamper protection, cryptographic acceleration, active memory protection, device identity and authentication, access controls, using partitioned operating systems, remote monitoring of activities, credential management, and over-the-air updates. The time has come for vehicle manufacturers to stop simply fixing security flaws, but start designing and building systems that are secure from the ground up.

References

[1] T. Ring, “Connected cars – the next target for hackers,” Network Security, no. 11, pp.11-16, Nov. 2015.

[2] P. Borrows, “Car hacking,” New Scientist, vol. 217, no. 2901, p. 33, 2013.

[3] “Car Hacking: You Cannot Have Safety without Security”, Resources.infosecinstitute.com, 2016. [Online]. Available:

[4] “Diagram of electronic components in a car – CHM Revolution’, Computerhistory.org, 2016. [Online]. Available: [Accessed: 06- Oct- 2016].

[5] C. Baraniuk, “Forget carjacking, car hacking is the future”, New Scientist, vol. 227, no. 3033, p. 19, 2015.

[6] M. Schellekens, “Car hacking: Navigating the regulatory landscape,” Computer Law & Security Review, vol. 32, no. 2, pp. 307-315, Apr. 2016.

[7] “Car Hacking | Argus Cyber Security”, Argus-sec.com, 2016. [Online]. Available: [Accessed: 06- Oct- 2016]