Emerging Cyber Risk

Out of Control in the Driver’s Seat

Security researchers provide haunting proof of how vulnerable our high-tech vehicles really are.
By: | April 20, 2016 • 5 min read

You’re tooling down the highway when suddenly your car’s A/C turns on to full blast. Then the radio fires up and switches to a Hip-Hop station.

You’re startled when the wipers turn on, wiper fluid obscuring your view of the road for a moment.

Advertisement




You’re frantically trying to turn it all off when your car loses power completely, leaving you stranded on a busy stretch of road with no shoulder, a semi closing in fast from behind you.

That sounds a little a scene from a spy thriller or maybe even the “X-Files,” but it happened to the driver of a 2014 Jeep Cherokee as researchers Charlie Miller and Chris Valasek hacked into and took control of it.

The duo found a way to hack in wirelessly, exploiting a widely used onboard entertainment system to take over a vehicle’s dashboard functions, brakes, steering and transmission.

Miller and Valasek first made headlines in 2013, when they publicized their success hacking into Ford and Toyota models. At that time, they only managed to accomplish the attacks while their PC was plugged into the vehicles’ diagnostic ports.

Only two years later, the duo found a way to hack in wirelessly, exploiting a widely used onboard entertainment system to take over a vehicle’s dashboard functions, brakes, steering and transmission.

They found they could do it from absolutely anywhere, so long as they had an internet connection. Most disturbing of all, they identified a loophole that could be used to attack multiple cars at once — creating a wirelessly controlled automotive botnet encompassing hundreds of thousands of vehicles.

The team published part of the project online and later demonstrated their “progress” at the 2015 Black Hat conference.

Without question, the more technologically sophisticated and connected vehicles become, the more vulnerable they get.

After Miller and Valasek published their results, Fiat Chrysler issued a recall for 1.4 million vehicles affected by the vulnerability exploited by the team. The automotive industry has been on high alert ever since, even while they simultaneously boast about models equipped with more and better technology.

Without question, the more technologically sophisticated and connected vehicles become, the more vulnerable they get. The push toward autonomous vehicles will only increase those vulnerabilities.

“We are a long way from securing the non-autonomous vehicles, let alone the autonomous ones,” said Stefan Savage, a computer science professor at the University of California, San Diego, during an Enigma security conference early this year.

Autonomous isn’t necessarily synonymous with “connected,” however, even for early entrants to the commercial autonomous vehicle space.

Advertisement




Daimler’s Freightliner Inspiration, the world’s first road-ready self-driving truck, “doesn’t rely on ‘connectivity’ or wireless communication to/from the outside world to drive itself,” said Dan Holden, manager of corporate risk and insurance for Daimler Trucks North America.

“Rather, the system is self-contained, meaning it uses production cameras and radars as inputs to determine the vehicle position and keep it centered in its lane.  Therefore the Inspiration truck is as secure from a cyber perspective as production vehicles today.”

More Frightening Than Fiction

Until cyber vulnerabilities can be addressed, it doesn’t take a broad stretch of the imagination to see what the future implications could be for this type of attack. Consider a few scenarios:

  • The vehicle of a courier transporting sensitive documents is disabled in a remote location, where armed thieves are waiting to steal the documents.
  • A high-level executive receives a message alerting him that ransomers have control of his teen daughter’s car — with her in it — and will drive it off of a bridge if he doesn’t pay $10 million in Bitcoin.
  • A ring of thieves finds a way into the systems of a trucking fleet’s rigs through its onboard camera system, enabling it to stop the trucks remotely so teams can hijack the cargo.
  • An extreme hactivist group decides to “brick” every car in Los Angeles, disrupting businesses and lives until its demands are met.
  • An attacker hacking into a commercial truck’s system disables the brakes, sending the truck careening into a school bus in the middle of an intersection.

Keep in mind that even less extreme types of hacking could create vulnerabilities for both individuals and businesses.

Miller and Valasek proved their ability to wirelessly hack a vehicle for surveillance, tracking GPS coordinates, measuring speed, and tracing routes. When a vehicle’s onboard systems are connected to the driver’s smartphone, the smartphone is also at risk for attack, and any data stored in it is fair game, including passwords and credit card information.

Government and Industry Respond

Miller and Valasek’s work is part of what inspired the drafting of an automotive security bill introduced last year. The Security and Privacy In Your Car Act (the SPY Car Act) would require cars sold in the U.S. to meet certain standards of protection against digital attacks and privacy.

The bill’s creators surveyed 20 carmakers and discovered that only seven used independent security testing to check their vehicles’ security, and only two had tools in place to stop a hacker intrusion.

Several Japanese companies are working on automotive cyber security technology.

In March, the FBI, along with the Department of Transportation and the National Highway Traffic and Safety Administration, published an advisory on the realities of hackable vehicles and making recommendations to increase security.

Several Japanese companies are working on automotive cyber security technology. Panasonic is developing a device that can detect unauthorized network signals and cancel them out. Fujitsu Laboratories and a researcher from Yokohama National University are developing technology that detect an attack, notify the driver, and encrypt signals to allow the vehicle to be stopped safely.

However these technologies are still five years away from commercial availability, as are fully encrypted next-generation automotive networks.

Advertisement




Transportation companies, their clients and every organization with a fleet of its own should be asking questions about the security of the vehicles that are used in the course of their daily operations — and whether they have cover that will respond if their vehicles fall prey to cyber tampering.

“Having insurance coverage in place that would address bodily injury and property damage is something companies should seriously consider as this risk matures,” said William A. Boeck, senior vice president. and insurance and claims counsel for Lockton’s cyber risk practice.

Michelle Kerr is associate editor of Risk & Insurance. She can be reached at [email protected]

More from Risk & Insurance

More from Risk & Insurance

2017 Risk All Stars

Immeasurable Value

The 2017 Risk All Stars strengthened their organizations by taking ownership of improved risk management processes and not quitting until they were in place.
By: | September 12, 2017 • 3 min read

Being the only person to hold a particular opinion or point of view within an organization cannot be easy. Do the following sound like familiar stories? Can you picture yourself or one of your risk management colleagues as the hero or heroine? Or better yet, as a Risk & Insurance® Risk All Star?

Advertisement




One risk manager took a job with a company that was being spun off, and the risk management program, which was built for a much larger company, was not a good fit for the spun-off company.
Rather than sink into inertia, this risk manager took the bull by the horns and began an aggressive company intranet campaign to instill better safety and other risk management practices throughout the organization.

The risk manager, 2017 Risk All Star Michelle Bennett of Cable One, also changed some long-standing brokerage relationships that weren’t a good fit for the risk management and insurance program. In her first year on the job she produced premium savings and in her second year is in the process of introducing ERM company-wide.

Or perhaps this one rings a bell. The news is trickling out that a company is poised to dramatically expand, increasing the workforce three- or four-fold. Having this knowledge with certainty would be a great benefit to a risk manager, who could begin girding safety, workers’ comp and related programs accordingly. But things sometimes don’t work that way, do they? Sometimes the risk manager is one of the last people to know.

The Risk All Star Award recognizes at its core, creativity, perseverance and passion. The 13 winners of this year’s award all displayed those traits in abundance.

In the case of 2017 Risk All Star winner Steve Richards of the Coca-Cola Bottling Company, the news of an expansion spurred him to action. He completely overhauled the company’s workers’ compensation program and streamlined its claim management system. The results, even with a much higher headcount, were reduced legal costs, better return-to-work experiences for injured workers and a host of other improvements and savings.

The Risk All Star Award recognizes at its core, creativity, perseverance and passion. The 13 winners of this year’s award all displayed those traits in abundance. Sometimes it took years for a particular risk solution, as promoted by a risk manager, to find acceptance.

In other cases a risk manager got so excited about a solution, they never even considered getting turned down. They just kept pushing until they carried the day.

Advertisement




Butler University’s Zach Finn became obsessive about what he felt was a lackluster effort on the part of the insurance industry to bring in new talent. The former risk manager for the J.M. Smucker Co. settled on the creation of a student-run captive to give his risk management students the experience they would need to get hired right out of college.

The result was a better risk management program for the university’s College of Liberal Arts and Sciences, and immediate traction in the job market for Finn’s students.

A few of our Risk All Stars told us that the results they are achieving were decades in the making. Only by year-in, year-out dedication to gaining transparency about her co-op’s risks and learning more and more about her various insurance carriers, did Growmark Inc.’s Faith Cring create a stalwart risk management and insurance program that is the envy of the agricultural sector. Now she’s been with some of her insurance carriers more than 20 years — some more than 30 years.

Having the right idea and not having a home for it can be a lonely, frustrating experience. Having the creativity, the passion and perhaps, most importantly, the perseverance to see it through and get great results makes you a Risk All Star. &

_____________________________________________

Risk All Stars stand out from their peers by overcoming challenges through exceptional problem solving, creativity, perseverance and passion.

See the complete list of 2017 Risk All Stars.

Dan Reynolds is editor-in-chief of Risk & Insurance. He can be reached at [email protected]