What Are Connected Vehicles & their Vulnerabilities

Many people ask what is a “connected vehicle”? A connected vehicle is a car, truck, bus or any other type of vehicle that has Internet capabilities. It’s almost a misnomer to think of today’s vehicles as simply “cars” or “trucks”. Just as mobile phones have become handheld computers, so too connected vehicles are becoming computers on wheels with all of the conveniences, benefits—and risks—that we have with other types of computers.

The Origins of the Connected Vehicle

Computers have been in cars since 1968 when Volkswagen introduced a computer-controlled electronic fuel injection (EFI) system. In 1996, General Motors introduced the first connected cars with its OnStar audio-based system for emergency services, vehicle diagnostics, and directions. In addition, if airbags were deployed in an accident, an automatic collision notification and GPS location would be sent to the OnStar call center for notifying first responders.

Subsequent features to the OnStar system included stolen vehicle tracking, remote engine slowdown and more. While the initial system relied on CDMA mobile voice and data communication, in 2014 it was replaced with 4G technology. 

The Motivations for Connected Vehicles

What are the motivations for connected cars and who benefits from them? Actually, everyone in the vehicle value chain benefits from connected vehicles: consumers, OEMs/manufacturers, fleet owners, aftermarket services providers and end-consumers, and their motivations include:

• Drivers who are spending more and more time in their vehicles, and want to make their journeys more pleasant, personalized, more productive or even more extreme. This could include adding the Spotify streaming music platform, reading emails (or having them read out loud) or enhancing their car performance for use on a race track.

• OEMs/car manufacturers and aftermarket service providers who want to improve customer experiences with their brand and reduce costs. By gathering vehicle performance statistics, they can update car functionality, proactively arrange maintenance visits to garages and even pre-order replacement parts. By enabling downloadable services or connected functionality, they can also create new revenue streams from their current customers. 

The Growth of the Connected Car Market

Today we are seeing the very rapid growth of connected vehicles, with many cars having up to four connections to the Internet. In 2015, there were an estimated 110 million connected vehicles. By 2020, an estimated 40% of all vehicles on the road—that’s 280 million vehicles—will be connected to the Internet. Five years later, 90% of all vehicles will be connected. In other words, nearly every new car will soon be connected to the Internet.

Lots of Cars Means Lots of Data

All of these connected cars will generate a lot of data. The data will be used by OEMs for a variety of purposes, including improving the car and engine performance, analyzing consumer needs and improving the customer experience. But since we’re talking about generating multiple gigabytes of data per hour, some data must be processed locally on the vehicle with what is called “edge computing.” Then personal or confidential data like credit card information is stripped out and securely sent to the cloud via the secure channel.

However, not all vehicles come equipped with the high computing power necessary to take advantage of additional services. While there are services that could be integrated into a connected vehicle, without the raw power to compute the data, the service offerings are severely limited. This creates a situation where some vehicles would need additional computing power not for the vehicle to operate as intended by the OEM, but in order to enable the services the drivers and passengers wish to use.

Most importantly, when it comes to the safety and security of connected vehicles, there is no room for compromise. A system that is mostly secure or immune to most known hacking attempts will not cut it when a vehicle carries your person and family from Point A to Point B. Just like you need to protect your home, you need to protect your vehicle. 

Communicating Over the Cloud

Today's vehicles comprise approximately 100-150 automotive computers or ECUs (Electronic Control Units) which generate a lot of data over the Internet and between other car’s computers. There are a lot of systems that communicate over the cloud to provide a wide variety of functionality, including remote keyless entry (RKE), navigation, infotainment, telematics, over-the-air (OTA) software updates and more.

Securing these systems requires in-vehicle security, a secure encrypted, authenticated transmission channel and a secure cloud.

Cyberthreats to the Connected Vehicle

Just like ransomware and malicious vulnerabilities put networked computers and mobile phones at risk, so too are our connected vehicles—our computers on wheels—are at risk. Today’s connected vehicles are like unprotected networked computers 20-30 years ago, before firewalls became ubiquitous on networks as well as on individual computers.

So what are some of the risks?

• A ransomware message demanding that you pay a sizeable number of bitcoins or you’ll lose the use of your car forever

• Having someone make your car suddenly brake or take control of the steering while you’re driving

• Hackers could disable sensors so objects become invisible to your navigation systems

• Getting remotely hijacked and having your vehicle remotely shut off while you’re on the highway or driven into a ditch.

Unlike an infected network computer which usually puts money or data at risk, an infected or hijacked vehicle could do the same and additionally put you and your loved ones at risk of bodily harm.

But the complexities and cyber risks will multiply as connected vehicles are replaced by semi-autonomous vehicles with further connectivity. Then vehicles will not just communicate with OEMs, but they will also communicate with each other and with road infrastructures like traffic lights, electrical charging systems and more. All of these entities will be supported by multiple business processes and require that vast amounts of data be stored on the vehicle and transferred to multiple service providers over the Internet.

Stay tuned for our next blog, Getting Started With a Connected Vehicle Cybersecurity Solution, to learn more about the existing cybersecurity threats.

Click on the image below to find out how to secure connected vehicles from cybersecurity threats: