Car Computer Security is becoming increasingly critical in this digital age. Because modern vehicles rely on computers for all their core functions. Modern vehicles are equipped with an Engine Control Module (ECM), or an Engine Control Unit (ECU). A Transmission Control Module (TCM), although this is only relevant for automatic gearboxes. Modern cars use a Power Terrain Module (PCM), a combination of the ECU and the TCM, which increases the efficiency and the output of the vehicle.
While these computers help us drive, increase safety protocols, improve fuel efficiency, they are vulnerable to cyber-attacks. There are currently 237 million connected cars on the street, a figure expected to reach 400 million by 2025. These numbers indicate an enormous number of potential targets for malicious actors. Therefore, safeguarding Car Computer Security is imperative to ensure the safety and functionality of modern vehicles.
Exploring Realistic Car Computer Security: From Jeep Cherokee to Tesla Hacks
Cyber-attacks Fast and Furious style, where all the cars in a city are hacked at once and get dropped from parking lots, are great for cinematic effect, but not necessarily realistic. Ensuring Car Computer Security is a complex and evolving challenge that involves more nuanced scenarios. However, several security researchers have shown what a cyberattack on a car would look like in the real world. For example, in 2015, Charlie Miller and Chris Valasek famously took control of a Jeep Cherokee remotely. Nullifying the driver’s attempts to regain control of the vehicle. More recently, in January 2022, a 19-year-old teenager, David Colombo, hacked into 25+ Teslas across the planet. Remotely unlocking doors and windows and initiating keyless driving.
Security researchers conducted these tests, but state-sponsored actors could potentially exploit car vulnerabilities to their advantage, and there exist several methods for them to achieve this. One such way could be through infecting another state’s car diagnostic device supply chain (F1 CyberSecurity).
Ridin’ Spinners
Nowadays, mechanics run all their tests through a car diagnostic device, like Autel® MP808K, or Launch® X431 V Plus, to identify various problems with a car. These highly specialized computers can indicate whether a suspension needs to get recalibrated. If the axel is not in line. Or when the headlights are too dim. Car diagnostic devices determine the exact issue, reducing costs and operation times.
However, Car Computer Security faces not only software vulnerabilities but also the risk of hardware manipulation within the supply chain. An attacker can pose as an employee and infiltrate the production line, taking the car diagnostic device apart and planting a Raspberry Pi inside. Or spoofing the cables that connect the device to the car. These hardware attack tools allow the perpetrator to compromise a car’s firmware through the car diagnostic device. Allowing them to take complete control over the vehicle. To add to the risk, Rogue Devices operate on Layer 1, enabling them to bypass existing security solutions, such as NAC, EPS, IDS, or IoT Network Security. In other words, the victim won’t know they’re suffering from a hardware-based attack until it’s too late.
Ridin’ Dirty
Let’s look at an example of a state-sponsored actor carrying out a hardware-based attack on a car diagnostic device. Say tensions are rising between “Fakeistan” and “Madeupistan”. The former could pay a hardware-based hacking group to infiltrate the latter’s manufacturing warehouses. Here, the bad actor will replace the diagnostic device’s connecting cables with spoofed ones that compromise a vehicle’s firmware. But why would Fakeistan want to conduct such an attack on its adversary? Well, by gaining control over vehicles, Fakeistan could cause car accidents across Madeupistan. Resulting in physical injuries, chaos, and fear that, in itself, are a threat to national security.
However, in addition to that, malicious actors could target emergency vehicles in a similar manner, posing a grave threat to Car Computer Security. This means that not only do civilian cars fall victim to takeover, but also the essential services required in such situations become unavailable. Ambulances cannot intervene, and police cannot provide emergency assistance. By undermining national security on such a large scale, Fakeistan could gain an upper hand over its adversary. Going even further, Fakeistan could use the opportunity to launch a direct invasion into Madeupistan. With no emergency vehicles available and streets jammed by car accidents making it extremely challenging to put up a strong defense.
Ride With Me
As cyberwarfare proliferates, state-sponsored actors are exploiting all possible attack vectors, making the above scenario all the more likely. Tackling the manipulation of a car diagnostic device through hardware attack tools requires physical layer visibility. Car Computer Security is paramount in this context. Sepio’s HAC-1 Hardware Access Control platform provides a panacea to gaps in device visibility by covering Layer 1. In doing so, customers benefit from complete asset visibility. No device goes unmanaged. The solution identifies, detects, and handles all IT/OT/IoT devices. Moreover, HAC-1’s policy enforcement mechanism and Rogue Device Mitigation capabilities instantly block any unapproved or rogue hardware. Enabling a Zero Trust Hardware Access approach, which stops attackers at the first line of defense.
HAC-1 requires no hardware resources and does not monitor any traffic; within 24 hours, we can provide you with complete asset visibility and identify previously undetected rogue or vulnerable devices. Think of HAC-1 as a diagnostic device for a diagnostic device.