Connectivity plays a major part in the developments of the latest infotainment systems. Much like smartphones and other consumer devices, there is a growing expectation that in-car entertainment systems should feature internet connectivity and enable integration with mobile devices. While it has become common for consumer devices to be supplied with built-in security software or the ability to use aftermarket alternatives, few have any expectations for car security beyond alarms and immobilisers. Much like the computers first connected to the internet, current automotive architecture does not contain security measures designed to repel remote infiltration and intrusion. As such, comprehensive in-car connectivity could lead to cyber-attacks that have the potential to range from inconvenient to more serious. In this interview, Matthew Beecham spoke to Robert Boatright, director of Automotive Networking at Harman about what it is doing to counter this.
Can you provide some background to this particular situation?
Go deeper with GlobalData
With the latest infotainment systems, you now have full internet connectivity which has its benefits of providing real-time updates and information, but such access can also leave an open door to malicious software. Infotainment cyber security presents an issue that OEMs need to consider and resolve before systems can be exploited and corrupted by opportunistic hackers. We are talking about firewalls and other measures as found on PCs and develop systems with encryptions.
Overcoming vehicle security is not a particularly new issue for OEMs to contend with. For years car thieves have found methods to disable immobilisers and start vehicles without the keys. Why is a threat now?
Hacking a car remains a fairly new field and one that could affect the control of the vehicle. Researchers from the Centre for Automotive Embedded Systems Security have found that it is possible to seize control of a vehicles engine and brakes by connecting a laptop to the a car’s on-board diagnostic port and hacking the vital systems. However, to date, successful car hacks have required direct hardware access to the car’s systems and few have been implemented outside of research conditions. Yet, theoretically, the potential exist to hack a car and wrest control of its critical systems via malware transferred over an internet or wireless network connection.
And is it the internet connection that provides the access to the car that is raising the risk?
How well do you really know your competitors?
Access the most comprehensive Company Profiles on the market, powered by GlobalData. Save hours of research. Gain competitive edge.
Thank you!
Your download email will arrive shortly
Not ready to buy yet? Download a free sample
We are confident about the unique quality of our Company Profiles. However, we want you to make the most beneficial decision for your business, so we offer a free sample that you can download by submitting the below form
By GlobalDataYes, it is. In addition to LTE connections, there are also threats posed from smart phone Bluetooth, WiFi, and NFC connectivity as well as the increasing trend of BYOD [Bring Your Own Device] consumer electronics integration. All modern vehicles contain multiple electronic control units (ECUs) and independent systems, integrated networks such as CAN bus and Ethernet networks that are used to link the operation of various components. The infotainment system is on one hand linked with these systems to access information from the speed sensor or other safety-critical ECUs and on the other hand connected to the internet, from where attacks could come from.
How could this actually happen?
Many infotainment systems have USB and phone connectivity, allowing users to transfer music files and other data from their smartphones, MP3 players and USB sticks, on to the unit’s hard disc. Malicious code can hide behind an app downloaded directly to the infotainment hub or be embedded in a music file transferred onto the system via a smartphone of USB connection. Some of the latest infotainment units from Harman allow apps to be downloaded from the internet on to the head unit, and facilitate seamless connectivity between mobile devices such as smartphones and tablets, with the infotainment system.
Once on the system, what could the impact be?
Once on the system, a virus could disrupt the operation of the infotainment system causing errors in music playback, navigation and potentially corrupt the multimedia display. Equally intrusive, malware could lurk unnoticed on a system, and siphon any personal and private information that may be on the infotainment hub or contained on linked devices, back to another source. We think that of more concern is the potential for malware to migrate via the infotainment system to other in-car networks such as the controller-area-network bus (CAN bus). This links infotainment to the vehicle’s critical systems. While extreme, it is hypothetically possible for a hacker to use malware to remotely seize control of a car’s control functions such as brakes, engine and throttle. I would emphasise that no real-world occurrences of such cyber-attacks have been recorded.
So what is Harman doing to pre-empt this situation?
Harman, together with the OEMs is already working to prevent the opportunities for remote car hacking. I can’t provide all the specifics for obvious reasons but we have implemented firewalls and other hardware and software security mechanisms to act as a barrier between malware and an infotainment system. We are also developing a protocol to isolates ‘crashed’ or ‘compromised’ parts of an infotainment system from other connected components and networks.
Some solutions we are implementing involve software that partitions various hardware parts using a micro-kernel to strictly define the amount of access individual programmes have to vehicle information. This technique limits the amount of resources other software has access to. In this case if a system becomes corrupted and fails it does not compromise the functionality of another.
Harman has been rolling out 4G, cloud computing in the past 12 months, becoming one of the first to offer this. Does this increase or manage the risk better?
We believe that 4G architectures can assist us. If you can run an infotainment system via a cloud then the local software can be bypassed. Using the cloud, we can take advantage of a powerful, robust and secure server doing both the processing and security. This then can stream the required infotainment functions to a vehicle, significantly lowering the risk of malicious software from being downloaded onto an in-car system.
When do you expect to be rolling these preventative measures into the OEMs?
The remainder of this interview is available on just-auto’s QUBE research service
