Category: Blog

The age of connected cars

Connected cars are no longer a thing of the future – the truth is that many of us are already driving one of these without realizing it. A connected car is a vehicle with internet connectivity and the ability to send and receive data. Since cars have been equipped with Bluetooth and GPS connections since long ago, the transition to internet connectivity is not as noticeable. Vehicles are generally connected in two ways: embedded and tethered. Cars with embedded internet connectivity come equipped with a built-in antenna and chipset to access the internet directly. On the other hand, cars with tethered connectivity connect to another device (i.e. smartphone) to borrow its internet connection.

Prevalent features of connected cars

Some connected features have already become prevalent in most newly manufactured cars. Take the navigation system, for example, a GPS navigation without an internet connection would not be able to provide any real-time information, and tend to show a significant lag at detecting locations. Many of the navigation systems today come equipped with embedded internet connectivity and provide real-time updates on all kinds of information including traffic jams, accidents, prices of nearby gas stations, and weather conditions. Another common feature of cars today is smartphone integration. Almost every vehicle sold in 2020 has Android Auto and Apple CarPlay as available options. This feature allows you to integrate your Android and iOS smartphones with the infotainment system so that you can access the contents of your phone through the infotainment screen. Car buyers today increasingly look for these convenience features for their new car. The infotainment system has become just as important a decision factor as the engine.

The future of connected cars

So far, internet connectivity for vehicles only seems to be a fancy add-on feature for entertainment purposes. Meanwhile, we are at a transition phase where internet connectivity is gradually becoming a necessity. With increased coverage of 5G infrastructure, autonomous driving with preventative safety features will soon kick in as the new standard, making our transportation system smarter. A smart transportation network is sophistically interconnected. Not only will vehicles be connected to our smartphones (vehicle-to-device, V2D), vehicles will connect and communicate with other vehicles on the road (V2V), with pedestrians (V2P), with infrastructures (V2I), and with the power grid while charging (V2G). All these connections are part of the vehicle-to-everything (V2X) network. How do these connections help? A vehicle in the V2X network would be able to automatically avoid physical contact with other vehicles, follow speed limits, and stop at traffic lights, without the need for manual intervention. Indeed, we are still a few steps away from full automation because it requires the active involvement of multiple parties, including governments. Nevertheless, starting from the high-end market, semi-autonomous vehicles will soon dominate our roads.

Click here to see how autonomous driving is classified and which stage your car is at.

Are connected cars safe?

The short answer is yes. Connected cars tend to have smart and preventative safety measures that older cars lack. However, these advanced features are only safe if the system works properly, thus keeping all the connections secured from potential cyberattacks is a crucial part of automotive safety. There is a key difference between IT security and mobility security. In an IT network, you make the connections, then secure them. In a V2X network, you cannot make the connections without securing them in the first place, thus there can be no such thing as an unsecured connection. This is why AUTOCRYPT is a key component of the V2X network. The bad news is that since we are at a relatively silent transition phase, some automakers seem to be lagging behind at adapting to the security standards of connected vehicles. Let’s take a look at this recently disclosed issue.

“Critical security vulnerabilities found on Volkswagen and Ford vehicles”

In early April, Britain-based Consumers’ Association, branded as Which?, teamed up with cybersecurity professionals to examine the connected elements of the two most popular cars in Europe – the Volkswagen Polo SEL TSI Manual 1.0L gasoline, and the Ford Focus Titanium Automatic 1.0L gasoline. The examination resulted in the discovery of several serious vulnerabilities that pose privacy and safety risks to the vehicle owners. First of all, the examiners were able to hack into the infotainment system of the Volkswagen Polo by exploiting a vulnerability found in the electronic traction control system. The infotainment system contains the personal data of the user, including their whole phone contact list, call history, and location history. Another vulnerability involved significant safety concerns. The examiners obtained access to the front radar module by simply opening up the VW emblem from outside the car. Gaining access to the radar system allows hackers to tamper with the collision detection and warning system. This could cause life-threatening consequences, especially if the vehicle were to travel in autonomous mode. The examiners were also able to interfere with the messages sent from the tire pressure monitoring system on the Ford Focus, and trick the system to display that the tires are fully inflated when they are actually flat.

Source: Which?

Only two vehicles were chosen for this experiment. More likely than not, a handful of other vehicles would have similar vulnerabilities. At first glance, these issues may not seem that vital. Some may say, “So what if the collision detection system malfunctions? You are supposed to keep your eyes on the road anyways.”

Indeed, as of now, these issues do not seem that harmful. However, remember that we are still at a transitional stage. As cars gain increased autonomy, such vulnerabilities would no longer be tolerated. You don’t want your vehicle to bump into the wall during remote parking, a feature that most news cars already have today. Mobility security deserves more attention. As consumers, we must treat these issues seriously to help build a better future for transportation.

For more information on how AutoCrypt V2X protects connected vehicles, click here.

It has only been a little more than a decade since the introduction of the smartphone, yet they have now replaced laptops and desktops as the primary personal computing device. As we become so used to being connected to the Internet anytime and anywhere, more and more “things” now come equipped with such connectivity. One of the most common Internet of Things (IoT) devices are vehicles, but what happens when vehicles connect to each other and infrastructure?

How does vehicle connectivity work?

Most new cars in 2020 come with either embedded (built-in) or tethered (brought-in) internet connectivity, or a mixture of both. Vehicles with embedded connectivity are equipped with a built-in modem to directly receive cellular data, while those with tethered connectivity borrow the driver’s smartphone data to access the Internet (similar to WI-FI hotspots).

Most automakers offer embedded connectivity free trials for a few months, after which the driver would need to pay for continued internet access. This works similarly to a smartphone plan. For instance, AT&Tprovides a connected car data plan at cost per month for coverage in the US and Canada.

Some automakers offer embedded connectivity only for critical functions such as remote control and crash notification, and require tethered internet for all other entertainment purposes.

Whether having embedded or tethered internet connectivity, connected vehicles bring a lot of convenience and joy to the drivers. They have remote control features that allow users to unlock the doors, turn on the engine, and adjust the in-vehicle environment via their smartphone. They allow users to listen to the news, search for information, and access their smartphone all through voice control. In addition, they provide high definition streaming media content for both drivers and passengers.

Why hack a connected vehicle?

Wherever there exists an internet connection, there are security threats. The cyberthreats a connected vehicle system faces are very similar to that of a traditional IT system, in which almost all threat actors are driven by financial or political motives. In the context of a traditional IT system, the three most common objectives of cyberattacks are:

1) to exfiltrate or encrypt data for financial gains (by using the data for phishing and identity theft, selling the data to third parties, or demanding a ransom),

2) to steal intellectual property from adversaries (either businesses or political units), and

3) to disrupt operations and activities of adversaries (either businesses or political units).

In contrast, let us take a look at the most common objectives for someone to attack a car:

Vehicle theft

Believe it or not, vehicle thefts are still common. Over 150,000 vehicles were stolen in California alone in 2018 according to the Insurance Information Institute. Connected cars with smart or digital keys might decrease the chance of theft from unskilled thieves, but could as well increase the chance of theft from high-skilled hackers.

Personal data theft

Connected vehicles collect and store tons of personal data. At the very least, they store the driver’s contact list, call history, calendar, search history, entertainment preferences, driving history, and location data. Some might even store financial information for automatic payment of toll fees and EV charging fees. Attackers who gain the data may use them for identity theft, sell them to third parties, or blackmail the car owner for ransoms.

Personal attack or terrorism

This is perhaps the most concerning risk involving connected vehicles. When used abusively, cars have the potential to cause serious physical damage and death. When a threat actor hacks the system and takes full control of a car, the car becomes a destructive weapon that can be used to target specific individuals or the general public. What’s worse is that such a crime would be very difficult and expensive to solve as cybercriminals are much harder to catch.

Notice that under the third objective, a so-called cyberattack has crossed the line of cyberspace to threaten our physical safety. This has always been the biggest concern of autonomous driving. To prevent criminal groups and terrorists from destroying our transportation system, governments must work with industry experts to establish a complete international regulatory compliance for vehicle security.

In a traditional IT system, we create the network, then secure it. In a connected car system, we secure first, then ride. Having an unsecured car network is essentially the same as having a bridge built with substandard materials. This is why it is critical for us to understand where the weaknesses come from and protect them accordingly. To read more on the specific threats modern vehicles face, click here.