Industry Overview

The cyber security of connected vehicles is one of the biggest issues facing manufacturers today. Three significant trends have led to this position:

Complexity. “Complexity is the worst enemy of security”, and yet the past few years have seen a rapid increase in the cyber complexity of vehicles, evidenced by: (i) a massive increase in lines of code in a vehicle - approximately 100 million currently, compared to around 8 million for an F-35 joint strike fighter; (ii) an increase in Electronic Computing Units to something around 100 currently in high-end vehicles, communicating on a multiplicity of networks; and (iii) a rise in heterogeneity of in-vehicle systems - these are now responsible for a massive range of critical and luxury features within vehicles.

Connectivity. This complexity has been exposed to wireless networks through the development of wireless communication interfaces. These interfaces are a double-edged sword - by connecting the vehicle to the Internet of Things, they have led to dramatically extended functionality, but they have opened up the traditionally closed vehicular system, making vehicles a more accessible and more attractive target to adversaries.

Content. Theft of personal information, leading to identity theft, is an attractive goal for cyber-criminals. Personal data is increasingly available in car networks as the cars themselves are more sophisticated, and smartphones and other devices are connected to them. 

The report looks into the vital role of effective and robust cyber security practices and systems in connected vehicles and the future of the automotive industry. Through looking at the vast array of recent precedent, available market solutions and the attack surface in the vehicle, the report will provide automotive players with the most comprehensive analytical paper on cyber security in the connected vehicle available today. With interviews with experts from automakers, government, security service providers and lessons taken from other industries to provide new and critical analysis to the evolving problem of cyber security in the vehicle.

Download the brand new report brochure here with full contents and list of figures

 

Key Areas Covered

  • Mapping the Attack surface in the Vehicle: Assessing vulnerabilities and precedent in connected vehicles today as well as tomorrows technologies
  • The Types of Hacks and the Threats They pose: Why hack a vehicle? What form do they take? How best to protect against them?
  • The Available Market solutions: What products and services are on the market and how best can they be used to protect specific areas of the vehicle
  • Standards: What standards exist? What standards are being worked on? How might the auto industry evolve best with the introduction of certain standards?
  • Lessons from Other Industries: What lessons and practiced can be applied to the automotive sectors? What can the aviation, defence and financial industries teach the automotive industry

Download the brand new report brochure here with full contents and list of figures


Your Key Questions Answered On:

  • What does the cyber security landscape look like today?

  • How rapidly is this landscape changing and in what ways?

  • How are current vehicles at risk and how are vulnerabilities being exploited?

  • Why hack a vehicle? What are a hacker's motivations?

  • What are the real risks and potential consequences? How does this differ from the ‘media hype’?

  • How do you build holistic security strategies and systems and implement them successfully?

  • What are the available market solutions and who are the key players?

  • How can these solutions be effectively implemented to guarantee maximum security and ensure consumer trust?

Download the brand new report brochure here with full contents and list of figures

 

Key Reasons To Buy The Report

  • A vital resources in assessing the global cyber threat in order to develop holistic security approaches

  • Analyse the real risks and threats in the auto industry

  • Assess the current solutions on offer and the experts providing them

  • Develop and implement robust security architectures


Who Is The Report For?

  • OEMs
  • Software companies
  • Hardware companies

Download the brand new report brochure here with full contents and list of figures

 

Methodology

The field of cyber-security is a fast-moving one, and the sub-field of automotive cyber-security moves faster still. This report  (Cyber Security in the Connected Vehicle Report 2015-2016) was constructed by drawing on:

Academic or openly available commercial literature. We made substantial use of the academic literature on automotive cyber security as well as commercial literature, and the report contains around 80 references. Confidential information was ruled out.

Interviews with experts. The report would not have been possible without the in-depth interviews that we conducted with automotive cyber-security experts. Their influence and expertise is scattered throughout this report, as well as direct quotes from many of them.

Authors

Author, Jeremy Bryans is a Research Fellow in cyber security at the Centre for Mobility and Transport in Coventry University. He has substantial experience in developing and applying formal methods and techniques to problems of security, dependability and resilience within large systems including socio-technical systems, systems of systems and cyber-physical systems. His research interests include the modelling and analysis of collaborating systems and in the development of trustworthy policies for their secure interaction. Prior to working at Coventry he worked in Newcastle University, where he was a Senior Research Associate in the Centre for Software Reliability. His work there included the development of semantic foundations for a modelling language for systems of systems, and he was a co-investigator on a project that developed methods and tools to articulate the interplay between privacy and openness in provenance-enhanced communication. He received a PhD in Computer Science from Reading University in 1997, and he is a member of the BCS and a guest member of Newcastle University.

Dr. Siraj Ahmed Shaikh is currently a Reader in Cybersecurity at the Centre for Mobility and Transport at Coventry University, UK. As of February 2015, he is seconded to the Knowledge Transfer Network (KTN) as cybersecurity lead coordinating across academia, industry and policy. As of March 2015, he is also seconded to MIRA, as part of the Royal Academy of Engineering’s industrial secondment scheme. Siraj is currently involved in a research project investigating collusion attacks on smartphones. This project is in collaboration with City and Swansea Universities, and Intel. This is funded by EPSRC for three years (2014-2017). He is a Chartered Fellow of BCS and a Chartered Scientist (CSci).

Madeline Cheah is currently a PhD research student at Coventry University, investigating security testing processes for automotive cybersecurity, in collaboration with Horiba MIRA Ltd.  Madeline started her academic career teaching Ethical Hacking and Digital Forensics courses.  She has a Master’s in Forensic Computing from Coventry University and a Bachelor of Science (Hons) in Biochemistry from the University of Warwick, is a Fellow of the Higher Education Academy and is an accredited AccessData Certified Examiner.  When not researching, Madeline enjoys attending yoga and martial arts classes.

 

Industry Research

At the very beginning of the project 30 calls were conducted with experts representing a broad spectrum of the automotive telematics industry in order to identify:

  • Key industry trends
  • Challenges and opportunities facing executives
  • Significant information gaps

Download the brand new report brochure here with full contents and list of figures

 

List of Figures

Figure 1: The CIA triangle... 10

Figure 2: How eCall works. An EU Commission infographic... 18

Figure 3: The back infrastructure... 24

Figure 4: Attack tree depicting a safe-cracking... 30

Figure 5: Digital I/O channels appearing on a modern automobile... 32

Figure 6: Another example map... 33

Figure 7: An abstract heat map... 33

Figure 8: Composite Threat Model Outline... 46

Download the brand new report brochure here with full contents and list of figures

 

Contents

Executive Summary... 6

1 Introduction... 9

  • 1.1 Terms and definitions... 12
  • 1.2 Summary of report... 12

2 Mapping the attack surface within the vehicle... 13

  • 2.1 Types of connectivity... 13
  • 2.2 The Attack surface... 13
    • 2.2.1 Infotainment... 13
    • 2.2.2 DAB radio... 13
    • 2.2.3 USB... 14
    • 2.2.4 OBD-II... 14
    • 2.2.5 Bluetooth... 14
    • 2.2.6 Wi-Fi... 15
    • 2.2.7 JTAG ports... 15
    • 2.2.8 Dedicated smartphone interfaces... 15
    • 2.2.9 Tire Pressure Monitoring System (TPMS)... 16
    • 2.2.10 Immobilizer... 16
    • 2.2.11 Telematics control units... 16
    • 2.2.12 Passive Keyless Entry... 17
    • 2.2.13 Remote Key Entry... 17
    • 2.2.14 eCall... 17
    • 2.2.15 DSRC (Digital Short-Range Communication)... 18
    • 2.2.16 GM’s OnStar... 18
  • 2.3 The automotive ecosystem... 19

3 Types of hacks and threats they pose... 20

  • 3.1 Introduction... 20
  • 3.2 Why hack a vehicle? Hackers and their motivations... 21
    • 3.2.1 Tuners... 21
    • 3.2.2 Academic security researchers... 21
    • 3.2.3 White hat hackers.... 22
    • 3.2.4 Script kiddies... 22
    • 3.2.5   Black hat hackers.... 22
    • 3.2.6 Gray Hat Hackers... 23
    • 3.2.7 Vehicle theft... 23
    • 3.2.8 Financial theft and damage... 24
    • 3.2.9 Remote surveillance of individuals... 24
  • 3.3 Attack anatomy... 24
    • 3.3.1 Bridging attacks... 26
    • 3.3.2 Infotainment... 26
    • 3.3.3 OBD-II... 26
    • 3.3.4 Bluetooth... 27
    • 3.3.5 Wi-Fi... 27
    • 3.3.6 CAN bus... 27
    • 3.3.7 Dedicated smartphone interfaces... 28
    • 3.3.8 Tire Pressure Monitoring System (TPMS)... 28
    • 3.3.9 Immobilizer... 28
    • 3.3.10 Telematics: manufacturer and after-market telematics... 29
    • 3.3.11 Passive Keyless Entry and Start... 30
    • 3.3.12 eCall... 30
    • 3.3.13 Advanced Driver Assistance System (ADAS) features... 31
    • 3.3.14 Digital Short-Range Communication (DSRC)... 31
    • 3.3.15 Sensor networks... 31
  • 3.4 Attack trees... 31
  • 3.5 Hacker heat map... 32

4 Available market solutions... 35

  • 4.1 Technical approaches... 35
    • 4.1.1 Identifying dependencies... 35
    • 4.1.2 Testing for unanticipated user input... 35
    • 4.1.3 Techniques that expose vulnerabilities... 35
  • 4.2 Penetration testing... 36
  • 4.3 The holistic approach... 37
  • 4.4 Plugging the gaps... 37
  • 4.5 Market initiatives and key players.... 38
    • 4.5.1 Cyber Security Consortium for Connected Vehicles (CCV)... 38
    • 4.5.2 UK Department for Transport initiatives... 38
    • 4.5.3 BT Assure... 38
    • 4.5.4 NCC Group assurance and testing services... 39
    • 4.5.5 SBD technical consultancy... 39
    • 4.5.6 SBD and NCC Group strategic partnership... 39
    • 4.5.7 Automotive Secure Development Lifecycle (ASDL)... 40
    • 4.5.8 I Am The Cavalry’s Five Star Automotive Cyber Safety Framework... 40
    • 4.5.9 Plextek... 40
    • 4.5.10 Intel and the Automotive Security Review Board... 41
    • 4.5.11 The Markey Report and the SPY Car Act... 41
    • 4.5.12 The Transport Research Laboratory.... 41
    • 4.5.13 HORIBA-MIRA... 42
    • 4.5.14 Scarecrow Consultants... 42
    • 4.5.15 Thatcham, UK... 42
    • 4.5.16 TowerSec automotive cyber security... 42
    • 4.5.17 Telefónica’s M2M connectivity offering... 42
    • 4.5.18 Elektrobit embedded solutions... 42
    • 4.5.19 Covisint’s secure platform... 42
    • 4.5.20 HARMAN.... 43
    • 4.5.21 Visteon’s OASIS cockpit... 43
    • 4.5.22 NXP Semiconductors... 43
    • 4.5.23 Mocana... 43
    • 4.5.24 AIRMIKA’s CYBLOK... 43
    • 4.5.25 Sierra Wireless’s Legato platform... 43
    • 4.5.26 CAR 2 CAR Communication Consortium (C2C-CC)... 43
    • 4.5.27 Security Innovation’s high speed communications security... 43

5 Cyber security-related standards and initiatives... 44

  • 5.1 ISO 26262... 44
    • 5.1.1 Limitations and extensions... 44
  • 5.2 SAE J2980... 44
  • 5.3 SAE J3061... 45
  • 5.4 US initiatives... 45
    • 5.4.1 SPY Car Act.... 45
    • 5.4.2 NHTSA work... 45
    • 5.4.3 NIST... 47
  • 5.5 Threat modeling.... 47
    • 5.5.1 Checkoway’s threat modeling framework... 47
    • 5.5.2 IBM Global’s security model... 47
  • 5.6 Other industry initiatives... 47
    • 5.6.1 E-safety Vehicle Intrusion Protected Applications (EVITA)... 47
    • 5.6.2 Trusted Platform Module (TPM)... 47
    • 5.6.3 Secure Hardware Extensions (SHE)... 47

6 Lessons and conclusions... 49

  • 6.1 Lessons from aviation... 49
  • 6.2 Conclusions... 50

Abbreviations... 51

References... 53

Download the brand new report brochure here with full contents and list of figures

 

Please contact me on the details below if you have any questions.

Emilie Leblanc
Emilie Leblanc
Marketing Manager
TU-Automotive
+1 877 331 2547 (US)
+44 (0) 203 869 6720 (Global)
emilie@tu-auto.com