This week’s research news: A Vulnerability in Infotainment Systems used in VW and Audi Models
Vulnerabilities in automotive software were in the news again this week. These are the coding oversights that can render today’s connected cars and tomorrow’s autonomous vehicles unsafe.
Externally-connected ECUs – Telematics, Gateway and Infotainment controllers, among others – are a source of worry even for manufacturers that are using all of the currently-available cybersecurity solutions. Using an attack vector such as the one discovered by Computest, a cyberattacker can impersonate legitimate ECUs on a vehicle network and send commands to safety-critical systems, including airbags, steering and the powertrain.
The staged “attack” on the infotainment system exploited an in-memory vulnerability in the ECU code. There are dozens of such vulnerabilities in the controller software of modern car ECUs, and the reality is that all current cybersecurity measures are simply ineffective in preventing these attacks.
These are the most severe type of attack on an in-vehicle network and its ECUs, as the hacker modifies permission settings in order to then hijack control flow and execute unexpected or dangerous instructions.
Karamba Security’s Carwall embeds Autonomous Security into the software of an ECU and seals the ECU according to its factory settings. Protection runs on several levels: the disk level, the network level and most importantly the in-memory code logic. Carwall’s validation mechanism is deterministic, not statistics-based, and thus ECUs with this protection are not at risk of dangerous false positives that can be expected in other solutions.
Carwall works without the need for continuous over-the-air (OTA) updates of malware lists, and is therefore not dependent on an internet connection, keeping the vehicle free of these threats at all times. The performance impact of the Karamba solution on the ECU is negligible, for the same reason.
Carwall automatically hardens vehicle ECUs and prevents attacks with zero-day protection, so that the uncertainty of looming unknown threats can be eliminated. Zero-day attacks are the result of unknown vulnerabilities, and the hardening layer considers any attempt to deviate from factory settings as malware, thus protecting against both known and unknown threats.
Regulation involving cybersecurity for autonomous vehicles has been passed in the US House of Representatives, and is awaiting debate in the Senate. Concerns about consumer safety are expected to increase with the continual exposure of vulnerabilities, such as this week’s press and the reports on attack vectors in the Jeep Cherokee and Subaru Outback in 2015 and the GM On-Star system in 2016.
Operation of autonomous vehicles is already permitted in several US states. Hardening gateways and other ECUs in connected and self-driving cars will enable the global community of automakers to add advanced transportation technology to vehicles without the threat of losing consumer trust.
The Computest post about their recent research can be found here.
