Magazine menu Close Magazine menu

autonomous vehicles

Latest stories

Futuristic-looking car drives along while broadcasting much data into the world

This will defend your automotive business against next-gen cyberattacks

  • min read
    • Cars are more connected than ever before: Onboard music streaming, GPS maps beamed to vehicles via the internet of things (IoT) – they're computers on wheels becoming more digitized. Traditional automotive manufacturers are transforming their business models to reflect this, with technologies like in-vehicle online marketplaces. As the automotive industry evolves towards fully autonomous vehicles, security becomes harder to control. But security must be active throughout the car's lifecycle. Make no mistake, security breaches can be fatal and costly. If you're manufacturing vehicles with connected capacity, a Vehicle Security Operations Center (VSOC) can increase protection for your business, fleet and customers against cyberattacks. First, let's explore the changing landscape and its risks. Connected cars are easy targets for remote hackers and terrorists Operating systems in connected vehicles aren't just a personal data goldmine – with audio files recorded by in-car microphones to stored bank details and even Netflix and Spotify credentials leaked on eBay – but they can also control vehicle movement. If a hacker remotely hijacks the operating system of one of your vehicles or even your whole fleet, the consequences could be devastating. Whether it's taking control of a Tesla's brakes, door locks and other electronics, or exposing personal data like Mercedes-Benz – hackers do and will find vulnerabilities in connected vehicles. But why? Terrorists looking to cause fatal chaos. Hackers out for financial gain (they may shut the engine down and demand payment to start it again.) Even mercenaries spying on executives – think how valuable audio files of confidential merger plans would be to rivals. What is a Vehicle Security Operations Center? A Security Operations Center (SOC) is a team that deals with security issues at an organizational or technical level. In most cases, the team uses a platform dedicated to constant monitoring of the organization's IT infrastructure. A Vehicle Security Operations Center (VSOC) is the same, but as well as protecting computers and servers, it also protects assets like connected vehicle cloud and fleet management system (which send and receive messages to and from vehicle's telematics control unit) and the vehicles themselves, mobility servers (phones connected to vehicles) and vehicle internal components like sensors and radars. Two audiences need VSOCs: Automotive manufacturers (like Mercedes or Tesla) and large fleet owners (like logistics companies or taxi firms.) It minimizes the risks of cyberattacks and, in the event of a breach, triages and treats the cyber-wound. It can also give unwavering diagnostics of your entire fleet (great for ongoing and predictive maintenance) and a wealth of information on how your cars are used, like time and distance traveled, Wi-Fi strength or errors in the engine performance. Perfect for R&D for new models. But how do you implement a VSOC? VSOC: To in-house or outsource? There are two ways to create your VSOC: In-house or outsource. In-house means integrating the unit into your current operations, either within your cybersecurity operations, quality assurance or the vehicle software R&D team. On the other hand, you could outsource part or all of the VSOC to a third-party provider. In some instances, this may be helpful to start with, as you may not yet have the cybersecurity infrastructure and expertise. A full VSOC may be out of scope for a small fleet owner, but if you run a large fleet or you're an automotive manufacturer, in the long term, it will be most beneficial to your business to establish your VSOC internally. How to launch your VSOC Here are some tips to get started: Create a playbook Security experts should create incident response playbooks (guidelines) to show how you would respond to specific cyber-threats and how to manage incident communications. Expand your team's knowledge Many cybersecurity teams focus on server infrastructure, not connected vehicles. Implement advanced cybersecurity training to develop the skills of your current team. For example, Kaspersky Cybersecurity Training covers malware analysis, digital forensics and incident response to help a specialist enterprise-level team better face these threats. Funnel issues straight to your VSOC Establish a system to escalate vehicle monitoring and diagnostics when needed, so in the event of a breach, it's sent straight to the cybersecurity teams. Regular security assessments Periodically conduct security assessments of your connected car's infrastructure, both the separate modules (like TCU and mobile apps) and also test how the complete system works together. Share these results with your VSOC team. Maximize data capture Investing in onboard vehicle software, like intrusion detection systems, will feed your VSOC with vital information to detect anomalies and other signs that could lead to data breaches. Enrich your VSOC with threat data feeds from at least two security vendors. There are public feeds available, but licensed feeds are typically better quality. Use white-hat hackers Make use of the global community of white-hat hackers. These are friendly hackers, trained professionals who find vulnerabilities and make sure your systems are bulletproof. And if they're not, they'll give you the diagnosis to fix them. You could also join the likes of BMW and Tesla and launch a Bug Bounty program, which pays people (professional and amateur) for any bugs they find. Work towards the latest regulatory standards Future proof to upcoming vehicle regulation laws like Transport UNECE WP.29, and ISO/SAE 21434. As connected cars and autonomous vehicles speed towards making our roads safer and giving people a more comfortable driving experience, automotive businesses must ensure they're doing everything they can to protect their products from cyberattacks. A VSOC minimizes the chances of a cybersecurity breach in your plant, on the road and for your customers, so you can focus on building the future of transport.
autonomous vehicles avl

The next-gen adaptive platform making driverless cars safer

  • min read
    • Driverless vehicles could save energy, limit car accidents and improve transport infrastructure. They could, eventually, save us the time we'd typically spend concentrating at the wheel. But with great autonomy, comes great cyber-risks. Autonomous cars are like big computers on wheels. They have many applications – from sensors to music streaming – collecting, analyzing and transferring data at a rapid rate. But they can be far more dangerous than a typical computer. One wrong decision in a driverless car could injure or kill passengers and other drivers. Fortunately, there are ways we can futureproof the industry. This was the motivation for a collaborative between Kaspersky, the global cybersecurity firm, and AVL Software and Functions GmbH (AVL SFR), the global automotive consultancy. Cybersecurity needs to be a top priority for automotive manufacturers Autonomous vehicles function at different levels; the higher the level, the more control the car has over important decisions, like when to slow down, speed up, stop or change direction. They use connected sensors, radars and artificial intelligence applications (the internet of things in full swing) to communicate with each other via unique SW algorithms running on a computer operating system. Which, like the operating system of your computer, can be infiltrated. If malicious actors took control of an autonomous vehicle, let's say through a remote access attack, or worse, used system vulnerabilities to infiltrate all vehicle models, there could be fatal consequences, particularly for safety. Autonomous vehicle cybersecurity is crucial to our future; here's what it could look like. A safety focused autonomous vehicle cybersecurity partnership As the automotive industry becomes more advanced, the amount of information autonomous vehicles generate, analyze and process will grow. Alongside this growth, evolving cyber-risks are a significant problem. We need to future-proof autonomous vehicle systems to account for cyber-risks in years to come. At Kaspersky, we've been working with AVL Software and Functions GmbH (AVL SFR) to integrate KasperskyOS (Kaspersky's operating system) into an electronic control unit (ECU) of an advanced driver-assistance system (ADAS). Let me explain more. Firstly, this ECU is a component of an ADAS. This system supports several functions to increase convenience as well as road safety by taking over driver activities, from additional braking to driverless functions, which have been widely demonstrated at tech EXPOs and are now used in some restricted areas. Think of it as the brain of an autonomous vehicle. The ECU sends messages across the ADAS based on information from sensors and cameras, the latter executes safety measures like autopilot. As we move towards increased automation, involving less human interaction and decision-making, it will become essential for making safety decisions like emergency braking, pedestrian detection and front collision warnings. But the ECU 'brain' could be a bounty for hackers. Infiltrating an on-board operating system is easier than you might think. Like the Jeep hack in 2015. Security researchers found a way to remotely compromise several internal ECU functions through its Linux operating system, including tracking the car with GPS to stopping the vehicle. The methods may differ, but the consequences are the same: hackers can track cars, cut brakes, shut down an engine and more. Not a situation drivers or vehicle manufacturers want. Next-generation cyber defense for autonomous vehicles Next-generation tech needs next-generation defenses, which is why KasperskyOS, a secure-by-design technology, is at the core of our partnership with AVL. The software monitors processes, communications between each component and the activities of the operating system. To break it down: AVL developed the ECU (hardware and functional algorithms), KasperskyOS protects it (operating software.) Each company contributed its best practices and technologies from many decades of specialized experience in automotive technologies and cybersecurity respectively. This combination of hardware and software can safely connect cameras, radars and sensors while allowing secure communication between devices within the vehicle – crucial requirements for autonomous vehicles of the future. But that's just half the story. AUTOSAR Adaptive Platform – the layer cake of autonomous vehicle security In 2019, AVL approached Kaspersky to make a prototype of an adaptive cybersecurity platform in line with AUTOSAR – a set of standards developed by manufacturers and software companies defining future safety innovations for autonomous vehicles. The result? Kaspersky Automotive Adaptive Platform software development kit (SDK). This allows manufacturers and software developers to create secure and reliable applications for high-performance-ECUs like ADAS, knowing that the operating system is both secure and adaptive to enable other software to be integrated into it. Using this kit, AVL can develop applications like auto-pilot features, control safety systems and vehicle health monitoring. Think of AAP like a layer cake. The base level is the AVL hardware; the next level is the secure KasperskyOS, then the Kaspersky Automotive Adaptive Platform. On the top, the icing: ECU applications. This innovation is not only protecting the automotive industry, but could support other sectors like IoT and manufacturing. AVL SFP's Dirk Geyer thinks this could have a significant impact on the future of cybersecurity systems: "Future technologies will need complex and innovative cyber-protection. The combination of our ADAS ECU and Kaspersky's secure-by-design operating system means comfort, efficiency and safety for our customers. The control unit can be customized to match many different vehicle requirements, while controllers and applications like sensors and communication channels are protected by adaptive software." What next for autonomous vehicle cybersecurity? The automotive industry is on a fast-track to transformation. Soon, fully-autonomous vehicles will be on the roads. Will manufacturers sunset the production of manual cars to become the sole preserve of vintage motor enthusiasts? Will autonomous cars only ever be used for freight and deliveries? It's too early to say. What we do know: as the industry develops, both Kaspersky and AVL SFR will be developing new technologies to keep automotive manufacturers, drivers and people safe.
security bytes 2020 plans

How will the cybersecurity industry evolve in 2020? Perspectives from InfoSec pros

  • min read
    • 2019 saw a rise in ransomware attacks on institutions, more cyberattack services from the Dark Web and data breaches galore. What will 2020 bring? The Security Bytes series is all about senior security professionals sharing their most savvy advice. Here, I ask several leading cybersecurity insiders: Anastasios Arampatzis, cybersecurity content writer for Bora "I constantly have the feeling we're failing. And we're failing BIG. No matter how many hours we spend writing, talking, presenting… the risk and threat of poor cybersecurity insight, data breaches and security incidents keep growing. Although cybercriminals do their worst, it's our own cybersecurity industry that fails to live up to our expectations. "Have you ever seen a security warranty for any technology product? Warranties only cover mechanical parts and not software-related ones. "So I hope in 2020, cybersecurity will change in two ways. "Firstly, the industry needs to embrace security-by-design and privacy-by-design frameworks. Existing legislation in many countries leans towards this. In the near future, I'd love to see a product with a security warranty so companies offering cyber-insurance won't be able to deny reimbursing their customers. "Secondly, I'd love to see cybersecurity becoming an integral part of the school curriculum, starting even from elementary schools. Let's see what goodies Cyber Santa will bring. Ian Anderson, Security Manager and Sec Ops "I see significant control system threats. Not just critical infrastructure like electric utilities or oil and gas, but also transport. The likelihood is low, but the impact could be enormous. "Cities and states have the least funding and resources to defend their networks and systems. Cyberattacks can affect water systems, emergency services and other civic services like public transport. We've already seen examples in Atlanta and Baltimore. Those cities were big enough to afford recovery. What would happen to smaller towns and cities?" Ian predicts positive change too. "We will see significant improvements to cloud security – improved tools, default settings and accompanying technologies that focus on keeping the organization's cloud-based systems secure. "End-user awareness is rising. InfoSec pros are generally getting better at detecting attempts at compromise. Initiatives like multi-factor authentication (MFA) and role-based access control mean phishing awareness campaigns are getting easier. I think users take some of these practices home, which means safer web access for families." I researched vulnerabilities in food manufacturing and power plant ICS (industrial control systems) and SCADA (supervisory control and data acquisition). I also observed reports of the city of Toronto's susceptibility to ransomware and data breaches in the wake of Atlanta's 2018 SamSam ransomware incident. So I think Ian's predictions are on the money. Cheryl Biswas, threat intelligence specialist "The 2020 US election is around the corner. Disinformation and deepfakes are worrying trends. Obfuscation and evasion tactics keep evolving, like hiding files in files, breaking them up across deliveries and renaming processes to make malware look legitimate to the operating system. I hope national DDoS attack mitigation systems have improved to withstand the next generation of botnets." Nation-state attacks will only get more intense. Industrial control systems and Internet of Things (IoT) devices are especially at risk. But since cybersecurity practitioners become more aware of the threat, I'm optimistic we can become better prepared. Sameep Agarwal, Information Security Consultant and Penetration Tester Sameep makes predictions for new surfaces we need to protect. "With the automotive industry bringing in remote vehicle administration and infotainment integration as standard, vehicles will become new targets for hackers. "Biometrics is another risk area. Mass fingerprinting data from biometric technology will be at risk of breaches. Cyberattackers may use in-body chip implants intended for geo-location, medical and psychological purposes to monitor people. "I foresee the disruption to food processing and manufacturing to cause mass damage and spoiling. Agriculture will be targeted in 2020, through automated, remote-monitored farming systems, all possible because of industrial IoT." The in-body chips worry me most. There are already IoT medical devices like pacemakers susceptible to cyberattack, and the number of IoT devices in people's bodies will increase. If we can understand the risks now, we can make medical IoT and augmented bodies more secure. Amin Hasbini, Head of Research, Kaspersky, Middle East "The 5G telecommunications revolution is imminent. This fifth-generation network will host more network-connected devices, increase speeds considerably for users and serve as the foundation for many futuristic technologies. "But the security concerns of 5G are inescapable. As an evolving and developing technology built on top of the previous 4G infrastructure, it will inevitably inherit vulnerabilities and misconfigurations. Large-scale distributed denial-of-service (DDoS) attacks could be amplified; the massive increase in the volume of connected devices, with all the uncertainties about their quality and security in the network, will be a challenging task for telco administrators. "5G will be a more complex environment compared to its predecessors. In a global supply chain setting, bans based on the nationality of a provider offer little assurance especially to countries that have adopted a "banned provider" as part of its vendor diversification process." Read more about Mohamed's predictions for 5G security. A more connected world is an efficient but inherently vulnerable one – how will we adapt? Kurt Waller, Cyber Intelligence Analyst Kurt's predictions seem reasonable to me. "I think targeted ransomware will be used to disrupt the supply chains of bigger organizations. "The same attack could use seemingly targeted sextortion (blackmail with private photos and videos) mixed with fake thumbnails, deepfake video and phishing. "Phishing and malware distribution methods will move to office documents that aren't macro-based." Sextortion is no laughing matter. Nobody should assume they're immune to that kind of abuse. What stands out? The common threads in these points of view from some of InfoSec's brightest stars give me pause for thought. What's the one issue above all others that will define cybersecurity in 2020? I'm most concerned by the expansion of IoT without proper security measures. We'll soon see the first car accidents caused by cyberattacks to self-driving vehicles. I'm optimistic that as an industry, we can prepare for the future of IoT. It has impressive potential, like fewer accidents from synchronized cars, or checking the performance of your pacemaker through a mobile app. The future of cybersecurity is making all these new technologies safer. Here's to a year ahead of working together to make the world a safer place. Article reflects the opinions of the author and speakers quoted. Published in 2020.
autonomous vehicles

Driving change: Will autonomous vehicles be safe to use?

  • min read
    • The Department for Transport in the UK recently claimed it wants to see fully autonomous cars tested on British roads by 2021. Astonishingly, this expectation was set out after several fatal crashes in Arizona, USA. A legacy system risk The communications infrastructure used in cars today (known as a Controller Area Network, or CAN) was designed back in the 1980s. It was developed for exchanging information between different microcontrollers. Essentially, what we have is a peer-to-peer network – and an old one at that. The main issue here is that these networks weren't built with security in mind, as it wasn't a key concern back then. As time has progressed, new functionality has been layered on top of existing functions, all connected to the CAN. This offers no access control or security features but instead leaves vehicle access potentially open to criminals. While there are no real-world hacks that have been executed this way, it has been proven to be possible. For example, in 2015 two researchers and a journalist were able to use wireless technology to drive a Jeep Cherokee off the road. As a result of this flaw, half a million cars were recalled. It's an example of emerging technologies being layered on top of old infrastructure, without fully considering the security implications. Potential security issues don't just lie in the underlying communications network of the car itself; there's also the possibility of an attacker infecting a driver's smartphone and hijacking any apps they use to control functions on the car – for example, to lock and unlock it. Cars need humans too Following the fatal incident in Arizona last year, experts predicted that it would be many years before autonomous cars replace human drivers. The reality is, I don't think driverless cars will or should ever replace human drivers in the way that we think of them doing so now. In the future, I think everyone will continue to drive a private car, but it will be self-driving. However, the issue of how we implement the technology is something for society to ultimately decide – whether this takes the form of private vehicles or a co-ordinated public transport system – but I do not believe either should remove the human aspect of driving vehicles. The risks of delegating control I think people are becoming more apprehensive when it comes to driverless cars, where safety is paramount, and rightly so. Historically, driving has always been an aspect of life where human control has been essential, so the idea of watching a film or sleeping while a car transports us feels understandably 'wrong' to many people. There are various levels of autonomy with self-driving cars – ranging from add-on features such as parking assistance through to completely driverless cars. A 'grey area' lies between the two, where the driver has very little to do, but has responsibility for the vehicle and might need to take control at some point. In the latter scenario, there's a danger that the driver may switch off because they don't feel required to be in full control and might be unable to regain control in an emergency. Driverless car fatalities have shown that there is a very real danger with autonomous vehicles, and it's reasonable to question whether it's wise to resume the use of them so quickly after the incident. Safety first There are concerns about pedestrian and driver safety – as recent stories surrounding autonomous car testing have demonstrated, which society needs to tackle before driverless cars are launched. There's also a moral or ethical issue to consider. Christian Wolmar raised the issue of 'the Holborn problem': if driverless cars are programmed to stop when they sense a pedestrian, what happens when they're confronted with a mass of people milling across a busy road?  Will they wait all day? Or will they be programmed to operate with a lower safety bar? Or if the car is given the chance to choose to avoid hurting pedestrians or the passenger in the car in the lead-up to an accident, how and who will it choose? A car isn't able to make moral-based decisions on its own. Ethics aside, in terms of cybersecurity, it's important to remember that nothing is 100 percent secure. Just like housework, security is never 'done' – you need to continually repeat the process of vacuuming and dusting as it will be back next week. This same logic applies to securing the increasingly advanced technology in cars today. A recent audit by Kaspersky of connected car devices revealed several security issues, including the option to manipulate signals from the tire monitoring system and, alarmingly, the ability to open vehicle doors using the alarm system. Collaborating for a secure future Undoubtedly, autonomous cars – like the Uber you've just ordered – are just around the corner for motorists. So what does this mean for the automotive industry?  'Safety first' is not just a buzzword – it's essential to consider at the design stage. Just relying on software upgrades that are connected to the car's hardware to mitigate risks will not work in the era of IoT when absolutely everything is digital and connected. Devices need to be secure by design, and at the point of manufacture. Collaboration between smart car manufacturers and cybersecurity experts is essential to establish standards in this emerging discipline. For example, Kaspersky collaborated with manufacturer AVL to create a Secure Communication Unit (SCU) to secure communications between car parts, and between connected cars and infrastructure. This is a true secure-by-design software that will protect people, both on and off the road. There are still many unanswered questions and unconsidered scenarios, which regulators, the industry and society as a whole need to ascertain before we can start to consider loosening the reigns on bringing autonomous cars safely to our roads. This article was first published in March 2019, SC Magazine.
by Innovating leaders.
Innovative tech.
About Secure Futures

Secure Futures magazine is your go-to business guide for opinions, trends and insight into the world of technology and cybersecurity. We help your business to bring on the future. Brought to you by Kaspersky, the global cybersecurity experts.

  • For all other countries