Hacking Your
Connected Car :
What you need to Know
Now
Kapil Kanugo
Twitter: @kapilkanugo
Smart Cars
Cars these days are 90%controlled by
electronics and 10% using mechanics. The
average new car already contains ...
Connected Cars
Many new cars are as “wired” as a
home office — with onboard GPS
navigation and wireless communications
net...
Seriously??
What if modern car’s onboard electronics
be “hacked” or infected by
a computer virus introduced through a
wire...
Connected Car Teardown
Connected Car Eco system
•Drivers
•Smartphone Revolution
•Embedded Open Operating
Systems and Application
Stores
•Innovat...
Types of attacks on
smart cars
What types of Attacks are
Are possible on
Smart Cars
Insider Attacks
Attacker can be legitimate
owner w/ extended access rights
Attacker can prevent
emergency protection
mec...
Offline attacks
Attacker has virtually unlimited
time
Attacker has virtually unlimited
trials
Attacker and attack are h...
Physical Attacks
Asset manipulation or reads via debug
interfaces, probing, side channels,
decryption
Disabling, manipul...
Logical Attacks
Less securely validated software
attack
Less Validated hardware attack
Over the network attack
Over th...
Privacy Attacks
Track Vehicle movement
Compromise Driver personal
info or identity theft, credit
card info
Manipulate t...
Services under Attack:
eCall
eToll
Remote Car Control
Remote Diagnosis
Danger Warning
Flashing Firmware
Where do they attack?
Automotive Interfaces
Direct Interfaces
OBD-II
CAN
OEM and Hybrid Telematics Systems
Cellular
...
Connected Cars: Questions
before us..
Ecosystem
Drivers/Barriers ?
Usage Models ?
Case Studies?
Security Arch ?
1. Data Se...
What YOU need to know
Prevention
•Privacy Theft
• Disaster Deterrence
•Cryptographic
Encryption
Detection
•Intruder detect...
How to safeguard
Car as a black box for defining Security
and Privacy policies.
Service oriented and Layered protocol de...
Connected Car Security
Connected Car
Vehicle Platform
(ECU)
Portal at
Automotive
company
delivering services
Communication...
Scalability
 Flexible configuration and
secure updates
Deployment of security
policies and privacy
Security Architecture
Identity Protocol
• Key Pair
• Certificate
• Psedonyms
• Security Manager
• Key Management
• Securit...
Encapsulation and
abstraction
Overall on-board security architecture
Centralized maintenance of dedicated security
modul...
Need Modular (cost-)
efficient security for:
 In vehicular devices: sensors, actuators, ECU’s
 HW and SW architecture se...
Market Trend: Use cases
Facets of Connected Car
Data
Mobile Operating
Systems
1. Open Source vs.
Proprietary
Operating Systems
2. iPhone and iPod
...
Protection Services for Your
Car
1.Multi-function security bundle
2.Privacy Protection Services
3.Protection services for ...
Protect software security
mechanisms by:
Providing trustworthy security anchor
for upper SW layers
Secure generation, se...
Reduce security costs and
overhead on high volumes
by:
Applying highly
optimized circuitry
instead of costly general
purpo...
Business Continuity and
Resiliency Services
Business continuity is vital to business
success, and in today's
interconnecte...
Managed Web security
 Provide real-time scanning of traffic against known virus
and spyware definitions
 Provide an easy...
Steps to Take
 Help manage compliance with security initiatives by
scanning for and classifying vulnerabilities
 Provide...
Upcoming SlideShare
Loading in...5
×

Hacking your Connected Car: What you need to know NOW

493

Published on

Cars these days are 90% controlled by electronics and 10% using mechanics. The average new car already contains around 20 individual processors to monitor and control various functions — everything from the transmission’s shift points to the operation of the defroster — with about 60 megabytes of software code.

Many new cars are as “wired” as a home office — with onboard GPS navigation and wireless communications networks including Bluetooth, Wi-Fi or Internet run on Embedded OS's which run on converged Electronics to control these actions.

What if modern car’s onboard electronics be “hacked” or infected by a computer virus introduced through a wireless device that might corrupt or disable or controlled by a Hacker sitting at home?

The software does come with built in security but this is not enough and there is a need to offer a full Security package along with Car to guarantee Car's security. Life of people is more important than a gadget and people will pay and buy this package with a new car or upgrade to ensure that their car is not hacked by Hackers to malfunction or be used for other pervert interests.

Published in: Technology, Business
0 Comments
0 Likes
Statistics
Notes
  • Be the first to comment

  • Be the first to like this

No Downloads
Views
Total Views
493
On Slideshare
0
From Embeds
0
Number of Embeds
1
Actions
Shares
0
Downloads
33
Comments
0
Likes
0
Embeds 0
No embeds

No notes for slide

Hacking your Connected Car: What you need to know NOW

  1. 1. Hacking Your Connected Car : What you need to Know Now Kapil Kanugo Twitter: @kapilkanugo
  2. 2. Smart Cars Cars these days are 90%controlled by electronics and 10% using mechanics. The average new car already contains around 20 individual processors to monitor and control various functions — everything from the transmission’s shift points to the operation of the defroster — with about 60 megabytes of software code.
  3. 3. Connected Cars Many new cars are as “wired” as a home office — with onboard GPS navigation and wireless communications networks including Bluetooth, Wi-Fi or Internet run on Embedded OS's which run on converged Electronics to control these actions.
  4. 4. Seriously?? What if modern car’s onboard electronics be “hacked” or infected by a computer virus introduced through a wireless device that might corrupt or disable or controlled by a Hacker sitting at home?
  5. 5. Connected Car Teardown
  6. 6. Connected Car Eco system •Drivers •Smartphone Revolution •Embedded Open Operating Systems and Application Stores •Innovation, Time-to-Market, and Cost •Third Party Developer Ecosystem •Electrical Vehicles •Barriers •Safety Concerns and Risks •Government Regulation •Cellular Connectivity Cost and Coverage •Telematics Applications •Emergency Calling (eCall) •Roadside Assistance (bCall) •Remote Control •Remote Diagnostics •Vehicle Tracking, Geofencing, and Driving Behavior Monitoring •Infotainment Applications •Multimedia •Turn-by-Turn Navigation •Social Location Applications •Information and Content •Communication •Safety and Security Applications •Emergency Calling (eCall) •Roadside Assistance/Breakdown Call (bCall) •Stolen Vehicle Tracking and Recovery/Geofencing •Driver Behavior Monitoring •Connected Infotainment Applications •Off-Board and Hybrid Navigation •Concierge Services •Online Services and Multimedia •Pay-as-You-Drive Insurance •Convenience Applications •Remote Diagnostics and Maintenance •Electronic Toll Collection and Congestion Charging •Remote Door Lock/Unlock •Smartphone Applications •Standalone Smartphone- Based Solutions •Smartphone Applications Linked with In-car Display, Audio, and User Interface Systems •Use of Smartphones as Remote Controls for Embedded Systems •Hybrid Systems •Embedded Applications Automotive Application Type Consumer Telematics Services Market Drivers and Barriers Automotive Application Categories
  7. 7. Types of attacks on smart cars What types of Attacks are Are possible on Smart Cars
  8. 8. Insider Attacks Attacker can be legitimate owner w/ extended access rights Attacker can prevent emergency protection mechanisms or security updates Attacker doesn’t care about legal penalties
  9. 9. Offline attacks Attacker has virtually unlimited time Attacker has virtually unlimited trials Attacker and attack are hard to detect
  10. 10. Physical Attacks Asset manipulation or reads via debug interfaces, probing, side channels, decryption Disabling, manipulating or any physical inputs, outputs and processing like brakes failure and force engine to not start
  11. 11. Logical Attacks Less securely validated software attack Less Validated hardware attack Over the network attack Over the application level attack
  12. 12. Privacy Attacks Track Vehicle movement Compromise Driver personal info or identity theft, credit card info Manipulate traffic and GPS info for traffic Jams or accidents
  13. 13. Services under Attack: eCall eToll Remote Car Control Remote Diagnosis Danger Warning Flashing Firmware
  14. 14. Where do they attack? Automotive Interfaces Direct Interfaces OBD-II CAN OEM and Hybrid Telematics Systems Cellular Bluetooth USB Wi-Fi
  15. 15. Connected Cars: Questions before us.. Ecosystem Drivers/Barriers ? Usage Models ? Case Studies? Security Arch ? 1. Data Security (credit card, personal info, location) 2. Privacy Protection and deployment of solution 3. Security as service Business models Risk Mitigation Strategy? Honeypots? Enable Businesses save cost ? Business Model ? Where are we today? Where do we have to go?
  16. 16. What YOU need to know Prevention •Privacy Theft • Disaster Deterrence •Cryptographic Encryption Detection •Intruder detection • Internal security and confidentiality Deflection •Honeypots Countermeasures Risk mitigation Recovery •Backups, •Updates, •self correcting Five Pillars of Security Management in Vehicles:
  17. 17. How to safeguard Car as a black box for defining Security and Privacy policies. Service oriented and Layered protocol design External data communication based on verification if its trustworthy Safeguard against malwares, rootkits, ROP for x86,ARM etc platforms
  18. 18. Connected Car Security Connected Car Vehicle Platform (ECU) Portal at Automotive company delivering services Communication link between portal and Vehicle
  19. 19. Scalability  Flexible configuration and secure updates Deployment of security policies and privacy
  20. 20. Security Architecture Identity Protocol • Key Pair • Certificate • Psedonyms • Security Manager • Key Management • Security Daemon • Application Layer • Network Layer • Device Layer Test Management Center • Certificate Management • Certificate Revocation TCP/IP Secure tunnel Internet Security Central Control Internet Roadside Stations Security Daemon Communication Control Layer IEEE 802.11g WPA2 protected Secure tunnel Secure tunnel Decision basis for Cryptographic Algorithms • Privacy • Key Distribution • Verification time • Security Overhead per message • Authentication • Active revocation necessary • Security Risk • Standards and Regulation • Security header in Message Payload transmitted
  21. 21. Encapsulation and abstraction Overall on-board security architecture Centralized maintenance of dedicated security modules. Security API for Application developers Static and Dynamic configuration of security policies and privacy credentials Addition of Security payload data for each MAC transaction.
  22. 22. Need Modular (cost-) efficient security for:  In vehicular devices: sensors, actuators, ECU’s  HW and SW architecture securing SW apps based on HW modules In order to  Enforce ECU s/w protection against SW attacks  Provide reliable ECU/ HW/SW configuration and protection Based on:  Hardware based security  Security software layer
  23. 23. Market Trend: Use cases
  24. 24. Facets of Connected Car Data Mobile Operating Systems 1. Open Source vs. Proprietary Operating Systems 2. iPhone and iPod Touch 1. Android 2. Nokia-Symbian and MeeGo 3. Blackberry 4. Java 5. Windows Mobile • Dock and Transfer of Credentials • Media Content • Web • Widgets • Audio • Conferencing • Facetime • Browsing • Searching • Maps 3G Service Provider, App Developer, HW/SW OEM, 3rd Party
  25. 25. Protection Services for Your Car 1.Multi-function security bundle 2.Privacy Protection Services 3.Protection services for Cloud farm 4.Self Managed and monitored firewall service 5.Identity Protection services 6.Intrusion prevention and detection service 7.Security services for unified threat management (mass attack)
  26. 26. Protect software security mechanisms by: Providing trustworthy security anchor for upper SW layers Secure generation, secure storage and secure processing of security critical material from all malicious SW Establish secure sessions between ECU and External entity over the network for secure communication
  27. 27. Reduce security costs and overhead on high volumes by: Applying highly optimized circuitry instead of costly general purpose hardware
  28. 28. Business Continuity and Resiliency Services Business continuity is vital to business success, and in today's interconnected world, virtually every aspect of a company's operation is vulnerable to disruption.
  29. 29. Managed Web security  Provide real-time scanning of traffic against known virus and spyware definitions  Provide an easy-to-use, Web-based policy administration that establishes appropriate usage and identifies prohibited sites, content and file types  Filter Web traffic according to your usage policy and helps block inappropriate traffic from reaching your network  Allow forwarding of "clean" Web traffic to the end user with no noticeable delay in performance  Help protect your network from new and undiscovered vulnerabilities using advanced analyses that identify suspicious activities  Include Help Desk services, security advisories, and access to the incident response team
  30. 30. Steps to Take  Help manage compliance with security initiatives by scanning for and classifying vulnerabilities  Provide remediation steps and data to assess and manage security risks to help reduce threat exposure  Help reduce cost and complexity of security maintenance through Intel cloud security services  Vulnerability management can detect vulnerabilities across network devices, servers, web applications and databases to help reduce risk and better manage compliance requirements. And because solution is cloud-based, customers can save on licensing fees and security operations maintenance costs
  1. A particular slide catching your eye?

    Clipping is a handy way to collect important slides you want to go back to later.

×