Hacking on the Highway: Protecting Yourself from Automotive Cyberattacks

In 2023, security researchers remotely hacked into a Jeep Cherokee and cut its transmission while it was speeding down a highway, taking complete control of the vehicle’s critical functions like brakes and steering. This chilling demonstration showed just how vulnerable our cars have become to cyberattacks as they are increasingly connected to the internet.

Problem

As vehicles become more and more automated and reliant on software, they also become more susceptible to hacking. Automotive cyberattacks involve breaching the complex onboard computer systems and internet-connected features in cars in order to take control, steal data, or cause malfunctions. With some 100 million lines of code in today’s cars, there are countless vulnerabilities that skilled hackers can exploit through various digital entry points. This poses serious risks to drivers, passengers, and everyone on the road.

Scope

A successful automotive cyberattack could enable hackers to remotely take over steering and braking, cause the engine to shut down, disable airbags, and more. Drivers could lose complete control over their vehicles, resulting in crashes or other safety issues. Hackers could also steal personal driver data and location information, compromise privacy, and commit identity theft. Some attacks aim to install ransomware that locks access to car systems until a payment is made. As car technology continues to advance, the methods of attack will become more sophisticated too.

Target Audience

This growing threat impacts regular drivers, car owners, passengers, and automotive industry professionals. Anyone who owns or rides in a car, especially newer connected models, should understand the hacking risks and how to protect themselves in order to stay safe on the road.

Preview

This article will examine the automotive hacking landscape, highlighting the vulnerabilities in modern vehicle tech and real-world examples of different types of car cyberattacks. It will provide practical tips on basic digital protections, security features, and third-party solutions that can help shield your car from hackers. The roles of car manufacturers and governments in improving cybersecurity will also be discussed. Finally, it will promote responsible development and driving practices for managing this emerging threat.

Vulnerability Landscape

As vehicles become more digitally integrated and connected, their attack surfaces are expanding. Modern cars contain a complex network of electronic control units (ECUs), entertainment systems, navigation modules, and external communications that hackers can infiltrate in various ways.

Connected Car Ecosystem

Today’s cars contain over 100 ECUs running on tens of millions of lines of code. ECUs monitor and control mechanical functions, like braking, throttle, steering, airbags, transmission, and more. They communicate over an internal network, and many are now also linked to internet-enabled infotainment systems. This connectivity introduces vulnerabilities that didn’t exist in older isolated analog cars. Entertainment units, navigation systems, Bluetooth connections, cellular signals, WiFi, and automated features like collision detection create more potential digital entry points. Integrating emerging vehicle-to-vehicle (V2V) and vehicle-to-infrastructure (V2I) communications for autonomous driving will further expand the attack surface.

Attack Vectors

Hackers use various methods to infiltrate car systems, including:

• Software vulnerabilities – Bugs, glitches, and weaknesses in code can grant access if left unpatched by manufacturers. Research shows over 150 zero-day flaws across major automakers.
• Unsecured external connections – Bluetooth, cellular networks, WiFi hotspots, USB ports, and other digital car interfaces can be compromised if left unsecured.
• Data injection – Malicious code or data can be introduced via unprotected ports (USB), hardware plugged into ODB ports, CDs, or exposed API endpoints.
• Physical access – Direct access to internal car computers enables attackers to modify ECU firmware and parameters.
• Signal spoofing – Keyless entry systems and tire pressure sensors can be tricked using wireless signal repeaters.
• V2X communication – Future vehicle-to-everything networks for self-driving cars may have vulnerabilities.

Case Studies

• The Jeep Cherokee hack in 2015 allowed attackers to remotely control steering, brakes, and transmission over the internet.
• Hackers have extracted personal driver data from insecure infotainment unit connections. In 2022, Mongo DB databases exposed info on over 3 million vehicles.
• Multiple attacks have leveraged ODB-II ports mandated for emissions testing. Malicious devices plugged in can reprogram ECUs.
• Researchers in 2021 showed luxury car alarms could be disabled and doors remotely unlocked via signal amplifiers.
• Ransomware attacks have locked driver access to navigation systems until ransom payments were made.

Emerging Threats

As vehicles become more automated and reliant on AI, new types of vulnerabilities may emerge:

• Sensor spoofing can manipulate how autonomous vehicles perceive objects and make decisions.
• V2V networks planned for self-driving car coordination could be disrupted.
• AI components create potential for data poisoning, model extraction, and algorithm manipulation attacks.
• Quantum computing could one day break the encryption used to secure vehicle data.

Protecting Yourself on the Road

While automotive cyber threats are rising, there are steps you can take to minimize your risks. Combining basic digital protections, built-in security features, and third-party solutions can help keep your car and data secure in today’s connected world.

Basic Defenses

Practicing general cybersecurity hygiene is key to reducing hacking risks:

• Use strong unique passwords for your infotainment system and other accounts. Avoid default or guessable passwords.
• Be extremely cautious of third-party devices plugged into ODB ports or USB inputs. Only use reputable tools from verified vendors.
• Avoid connecting your car to public WiFi networks, which can enable remote attacks. Stick to cellular connections.
• Only install apps and services from trusted sources. Beware of phishing attempts aiming to infect your car with malware.
• Install all manufacturer software updates as soon as available. Updates often patch known security flaws.
• Turn off wireless connections like Bluetooth when not in use. Keep doors locked when away from your car.

Security Features

Many newer connected vehicles come with built-in cybersecurity protections:

• Firewalls monitor traffic between ECUs and infotainment units, preventing unwanted communication.
• Intrusion detection systems identify abnormal activities and unauthorized access attempts, alerting the driver.
• Data encryption secures onboard data and communications from snooping.
• Secure boot capabilities verify ECU software at startup to prevent tampering.
• Immobilizers and tamper-proof ECUs make physical attacks more difficult.

Third-Party Solutions

There are also some aftermarket products that can enhance automotive security:

• Anti-virus software exists for infotainment systems to detect malware and block cyberattacks.
• Car cybersecurity insurance can cover costs in the event of a successful breach.
• Diagnostic devices attach to ODB ports to monitor for abnormal activities.
• RFID sticker shielding foil can block external signals to keyless entry systems.
• External VPNs can secure your car’s internet connections and communications.

Industry Responsibility

Auto manufacturers and regulators also have a duty to address car hacking risks, including:

• Developing cybersecurity standards for the design of networked vehicles to minimize vulnerabilities.
• Implementing additional layers of encryption, authentication, and authorization for critical functions.
• Providing ways for ethical hackers and researchers to report flaws through coordinated disclosure programs rather than stunt hacks.
• Educating consumers on cyber threats and how to protect themselves through online resources and dealership guidance.
• Enacting regulations requiring more stringent cyber protections and full disclosure of vulnerabilities.

Responsible Development and Driving

Staying secure also requires responsible practices by both automotive cybersecurity professionals and regular drivers.

Ethical Hacking

While stories of stunt hacks grab headlines, most automotive cybersecurity research happens through ethical hacking initiatives:

• Researchers responsibly probe vehicles to uncover vulnerabilities and work with manufacturers to address flaws and patch security holes before they can be exploited.
• Coordinated disclosure programs provide controlled ways for external experts to report bugs without making them publicly known until fixes are ready.
• Simulated testing environments allow for in-depth evaluation of systems without putting real vehicles at risk.
• Information sharing enables various stakeholders to collaborate on understanding threats and developing industry best practices.

Driver Awareness

Drivers should also adopt practices to avoid enabling cyber risks:

• Avoid clicking suspicious links or downloading unverified apps that claim to interface with your car, which could be phishing scams spreading malware.
• Never plug in a stray USB stick or device that you find, which could allow remote code execution on your car’s systems.
• Be skeptical of “performance enhancement” devices claiming to tune your ECU – these usually just deteriorate emissions controls. Legitimate tuning requires extensive modifications.
• Utilize all physical security features like door locks when away from your car. Park in well-lit areas and check for tampering of ports.
• Be judicious in sharing info about your car model, location, and identity online, as hackers can utilize this in social engineering and targeted physical attacks.

Future of Secure Mobility

As vehicles continue becoming technology platforms on wheels, researchers and policymakers are exploring ways to engineer in security:

• Blockchain integration could enable tamper-proof logs of vehicle software activity and detect anomalies.
• Quantum cryptography promises “unhackable” encryption for protecting vehicle networks.
• The development of MISRA coding standards aims to eliminate software vulnerabilities in ECUs and other automotive systems.
• Hardware-based security mechanisms instead of software provide physical protection against cyber intrusions.

Conclusion

Automotive cybersecurity risks are real and rising but they can be managed with vigilance. Taking proactive steps to safeguard your car’s digital systems while also practicing responsible connected driving is key to staying secure on today’s hackable highways. As car technology evolves, we must demand adequate protections are built into these mobile computers we all rely on. Maintaining trust and safety on the road depends on collaboration between consumers, manufacturers, researchers, and regulators to lock the doors on automotive hacking.