As we have seen in the past couple of years, car hacking is becoming an ever-greater threat. Many of the systems in our vehicles—and the standards to which they were designed—predate the connected car era. And so computerized vehicle systems lack some of the basic kinds of security that we would otherwise expect as default given the ramifications of a hack. The car-hacking problem gained widespread attention in July 2015, when hackers revealed that 1.4 million Chrysler and Dodge vehicles were vulnerable to an exploit—via the car's infotainment system—that could allow a malicious hacker to take over control of the vehicles' throttle, brakes, and even steering.
On Wednesday morning, Fiat Chrysler Automobiles (FCA) announced it has created a bug bounty program, using Bugcrowd's platform to allow the security community to inform it about possible exploits.
"We want to encourage independent security researchers to reach out to us and share what they’ve found so that we can fix potential vulnerabilities before they’re an issue for our consumers," said Titus Melnyk, senior manager of security architecture at FCA. "Exposing or publicizing vulnerabilities for the singular purpose of grabbing headlines or fame does little to protect the consumer. Rather, we want to reward security researchers for the time and effort, which ultimately benefits us all."
FCA is following in Tesla's footsteps; the electric vehicle manufacturer set up its own bounty program on Bugcrowd in 2015. General Motors also instituted a similar program (through HackerOne) in January of this year, and it's believed that Ford and other automotive OEMs (original equipment manufacturers) have similar efforts in the works.
Bug bounties alone won't be sufficient to safeguard our cars from malware exploits, though. After all, a bug needs to be discovered and revealed by a white hat in order for an OEM to take action. And some think that FCA's program is a start, but just that. "They are specifically staying away from the automotive platforms, meaning the cars themselves. The domains in scope are ancillary integration services for some of the vehicle components," explained Cigital's Art Dahnert. "I do notice that they gave a well-defined list of what types of vulnerabilities are important, which helps with keeping the "signal to noise" ratio low. The Bug Bounty is a good first step and I'm hopeful they are able to find value in it. This should be part of a more holistic plan that involves design analysis and threat models as well as internal security assessments. The earlier in the product cycle a vulnerability is found the easier and cheaper it is to fix."
Thankfully, it looks like the car industry may be starting to adopt that holistic, belt-and-braces approach to security, and the effort is being helped by a bevy of technology companies bringing their skills to bear on the problem.
Last month we told you about Symantec's automotive security approach, including an anomaly detection system that runs on any one of the multiple embedded electronic control units (ECUs) now prevalent in our vehicles. Symantec's system uses a heuristic approach to detect malware running on a vehicle's Controller Area Network bus, alerting OEMs to the problem. But this may just be one piece of the puzzle—after all it's fine knowing that you've got a malware problem, but wouldn't you also want to stop it in its tracks?
This is where Karamba Security's Carwall comes in, attacking the problem from the other direction, according to co-founder David Barzilai. Carwall is incorporated into ECUs, (whether they contain rich OSes or scheduler-based controllers), and Barzilai told us that Carwall "automatically learns the factory settings of the ECU as part of the software build process. Based on that it creates a policy that works in real-time so that actions that get performed on the controller are part of the factory settings." If an action isn't one of those factory settings, it's detected as malware and prevented from executing. What's more, by only allowing factory settings to run, there's no false-positive problem to contend with.
The impetus for Carwall was a request from an OEM that wanted to add security to powertrain controllers as opposed to infotainment or telematics systems (which by their nature are connected to the Internet). The technology grew out of endpoint security work for mobile devices. However, it's much more suitable for automotive applications, Barzilai told us: "It's not practical for enterprise and mobile because users change those environments. But in a car if someone wants to change that environment they're probably malicious. It's the best way to harden the ECU against hackers because you don't need a developer's intervention."
reader comments
31