Emerging Cyber Risk

Out of Control in the Driver’s Seat

Security researchers provide haunting proof of how vulnerable our high-tech vehicles really are.
By: | April 20, 2016 • 5 min read

You’re tooling down the highway when suddenly your car’s A/C turns on to full blast. Then the radio fires up and switches to a Hip-Hop station.

You’re startled when the wipers turn on, wiper fluid obscuring your view of the road for a moment.

Advertisement




You’re frantically trying to turn it all off when your car loses power completely, leaving you stranded on a busy stretch of road with no shoulder, a semi closing in fast from behind you.

That sounds a little a scene from a spy thriller or maybe even the “X-Files,” but it happened to the driver of a 2014 Jeep Cherokee as researchers Charlie Miller and Chris Valasek hacked into and took control of it.

The duo found a way to hack in wirelessly, exploiting a widely used onboard entertainment system to take over a vehicle’s dashboard functions, brakes, steering and transmission.

Miller and Valasek first made headlines in 2013, when they publicized their success hacking into Ford and Toyota models. At that time, they only managed to accomplish the attacks while their PC was plugged into the vehicles’ diagnostic ports.

Only two years later, the duo found a way to hack in wirelessly, exploiting a widely used onboard entertainment system to take over a vehicle’s dashboard functions, brakes, steering and transmission.

They found they could do it from absolutely anywhere, so long as they had an internet connection. Most disturbing of all, they identified a loophole that could be used to attack multiple cars at once — creating a wirelessly controlled automotive botnet encompassing hundreds of thousands of vehicles.

The team published part of the project online and later demonstrated their “progress” at the 2015 Black Hat conference.

Without question, the more technologically sophisticated and connected vehicles become, the more vulnerable they get.

After Miller and Valasek published their results, Fiat Chrysler issued a recall for 1.4 million vehicles affected by the vulnerability exploited by the team. The automotive industry has been on high alert ever since, even while they simultaneously boast about models equipped with more and better technology.

Without question, the more technologically sophisticated and connected vehicles become, the more vulnerable they get. The push toward autonomous vehicles will only increase those vulnerabilities.

“We are a long way from securing the non-autonomous vehicles, let alone the autonomous ones,” said Stefan Savage, a computer science professor at the University of California, San Diego, during an Enigma security conference early this year.

Autonomous isn’t necessarily synonymous with “connected,” however, even for early entrants to the commercial autonomous vehicle space.

Advertisement




Daimler’s Freightliner Inspiration, the world’s first road-ready self-driving truck, “doesn’t rely on ‘connectivity’ or wireless communication to/from the outside world to drive itself,” said Dan Holden, manager of corporate risk and insurance for Daimler Trucks North America.

“Rather, the system is self-contained, meaning it uses production cameras and radars as inputs to determine the vehicle position and keep it centered in its lane.  Therefore the Inspiration truck is as secure from a cyber perspective as production vehicles today.”

More Frightening Than Fiction

Until cyber vulnerabilities can be addressed, it doesn’t take a broad stretch of the imagination to see what the future implications could be for this type of attack. Consider a few scenarios:

  • The vehicle of a courier transporting sensitive documents is disabled in a remote location, where armed thieves are waiting to steal the documents.
  • A high-level executive receives a message alerting him that ransomers have control of his teen daughter’s car — with her in it — and will drive it off of a bridge if he doesn’t pay $10 million in Bitcoin.
  • A ring of thieves finds a way into the systems of a trucking fleet’s rigs through its onboard camera system, enabling it to stop the trucks remotely so teams can hijack the cargo.
  • An extreme hactivist group decides to “brick” every car in Los Angeles, disrupting businesses and lives until its demands are met.
  • An attacker hacking into a commercial truck’s system disables the brakes, sending the truck careening into a school bus in the middle of an intersection.

Keep in mind that even less extreme types of hacking could create vulnerabilities for both individuals and businesses.

Miller and Valasek proved their ability to wirelessly hack a vehicle for surveillance, tracking GPS coordinates, measuring speed, and tracing routes. When a vehicle’s onboard systems are connected to the driver’s smartphone, the smartphone is also at risk for attack, and any data stored in it is fair game, including passwords and credit card information.

Government and Industry Respond

Miller and Valasek’s work is part of what inspired the drafting of an automotive security bill introduced last year. The Security and Privacy In Your Car Act (the SPY Car Act) would require cars sold in the U.S. to meet certain standards of protection against digital attacks and privacy.

The bill’s creators surveyed 20 carmakers and discovered that only seven used independent security testing to check their vehicles’ security, and only two had tools in place to stop a hacker intrusion.

Several Japanese companies are working on automotive cyber security technology.

In March, the FBI, along with the Department of Transportation and the National Highway Traffic and Safety Administration, published an advisory on the realities of hackable vehicles and making recommendations to increase security.

Several Japanese companies are working on automotive cyber security technology. Panasonic is developing a device that can detect unauthorized network signals and cancel them out. Fujitsu Laboratories and a researcher from Yokohama National University are developing technology that detect an attack, notify the driver, and encrypt signals to allow the vehicle to be stopped safely.

However these technologies are still five years away from commercial availability, as are fully encrypted next-generation automotive networks.

Advertisement




Transportation companies, their clients and every organization with a fleet of its own should be asking questions about the security of the vehicles that are used in the course of their daily operations — and whether they have cover that will respond if their vehicles fall prey to cyber tampering.

“Having insurance coverage in place that would address bodily injury and property damage is something companies should seriously consider as this risk matures,” said William A. Boeck, senior vice president. and insurance and claims counsel for Lockton’s cyber risk practice.

Michelle Kerr is associate editor of Risk & Insurance. She can be reached at [email protected]

More from Risk & Insurance

More from Risk & Insurance

2017 Teddy Awards

The Era of Engagement

The very best workers’ compensation programs are the ones where workers aren’t just the subject of the program, they’re a part of it.
By: | November 1, 2017 • 5 min read

Employee engagement, employee advocacy, employee participation — these are common threads running through the programs we honor this year in the 2017 Theodore Roosevelt Workers’ Compensation and Disability Management Awards, sponsored by PMA Companies.

A panel of judges — including workers’ comp executives who actively engage their own employees — selected this year’s winners on the basis of performance, sustainability, innovation and teamwork. The winners hail from different industries and regions, but all make people part of the solution to unique challenges.

Advertisement




Valley Health System is all-too keenly aware of the risk of violence in health care settings, running the gamut from disruptive patients to grieving, overwrought family members to mentally unstable active shooters.

Valley Health employs a proactive and comprehensive plan to respond to violent scenarios, involving its Code Atlas Team — 50 members of the clinical staff and security departments who undergo specialized training. Valley Health drills regularly, including intense annual active shooter drills that involve participation from local law enforcement.

The drills are unnerving for many, but the program is making a difference — the health system cut its workplace violence injuries in half in the course of just one year.

“We’re looking at patient safety and employee safety like never before,” said Barbara Schultz, director of employee health and wellness.

At Rochester Regional Health’s five hospitals and six long-term care facilities, a key loss driver was slips and falls. The system’s mandatory safety shoe program saw only moderate take-up, but the reason wasn’t clear.

Rather than force managers to write up non-compliant employees, senior manager of workers’ compensation and employee safety Monica Manske got proactive, using a survey as well as one-on-one communication to suss out the obstacles. After making changes based on the feedback, shoe compliance shot up from 35 percent to 85 percent, contributing to a 42 percent reduction in lost-time claims and a 46 percent reduction in injuries.

For the shoe program, as well as every RRH safety initiative, Manske’s team takes the same approach: engaging employees to teach and encourage safe behaviors rather than punishing them for lapses.

For some of this year’s Teddy winners, success was born of the company’s willingness to make dramatic program changes.

Advertisement




Delta Air Lines made two ambitious program changes since 2013. First it adopted an employee advocacy model for its disability and leave of absence programs. After tasting success, the company transitioned all lines including workers’ compensation to an integrated absence management program bundled under a single TPA.

While skeptics assume “employee advocacy” means more claims and higher costs, Delta answers with a reality that’s quite the opposite. A year after the transition, Delta reduced open claims from 3,479 to 1,367, with its total incurred amount decreased by $50.1 million — head and shoulders above its projected goals.

For the Massachusetts Port Authority, change meant ending the era of having a self-administered program and partnering with a TPA. It also meant switching from a guaranteed cost program to a self-insured program for a significant segment of its workforce.

Massport’s results make a great argument for embracing change: The organization saved $21 million over the past six years. Freeing up resources allowed Massport to increase focus on safety as well as medical management and chopped its medical costs per claim in half — even while allowing employees to choose their own health care providers.

Risk & Insurance® congratulates the 2017 Teddy Award winners and holds them in high esteem for their tireless commitment to a safe workforce that’s fully engaged in its own care. &

_______________________________________________________

More coverage of the 2017 Teddy Award Winners and Honorable Mentions:

Advocacy Takes Off: At Delta Air Lines, putting employees first is the right thing to do, for employees and employer alike.

 

Proactive Approach to Employee SafetyThe Valley Health System shifted its philosophy on workers’ compensation, putting employee and patient safety at the forefront.

 

Getting It Right: Better coordination of workers’ compensation risk management spelled success for the Massachusetts Port Authority.

 

Carrots: Not SticksAt Rochester Regional Health, the workers’ comp and safety team champion employee engagement and positive reinforcement.

 

Fit for Duty: Recognizing parallels between athletes and public safety officials, the city of Denver made tailored fitness training part of its safety plan.

 

Triage, Transparency and TeamworkWhen the City of Surprise, Ariz. got proactive about reining in its claims, it also took steps to get employees engaged in making things better for everyone.

A Lesson in Leadership: Shared responsibility, data analysis and a commitment to employees are the hallmarks of Benco Dental’s workers’ comp program.

 

Michelle Kerr is associate editor of Risk & Insurance. She can be reached at [email protected]