The Federal Bureau of Investigation, the Department of Transportation, and the National Highway Traffic Safety Administration (“NHTSA”) are warning that motor vehicles are “increasingly vulnerable to remote exploits.”
In a public service announcement, the agencies noted that, in 2015, security researchers evaluating automotive cybersecurity were able to demonstrate “remote exploits” of motor vehicles. The analysis demonstrated that the researchers could gain significant control over vehicle functions remotely by exploiting wireless communications vulnerabilities. The agencies said that although the identified vulnerabilities had “been addressed,” consumers and manufacturers should be “aware of the possible threats and how an attacker may seek to remotely exploit vulnerabilities in the future.” They added that third party aftermarket devices with Internet or cellular access plugged into diagnostics ports “could also introduce wireless vulnerabilities.” Consumers and manufacturers should “maintain awareness of potential cyber security threats” related to “connected vehicle technologies in modern vehicles.”
The agencies explained that motor vehicles contain an increasing number of computers in the form of electronic control units (“ECUs”) that control numerous vehicle functions ranging from steering, braking, and acceleration to the lights and windshield wipers. Moreover, the agencies noted, a wide range of vehicle components also have wireless capability: from keyless entry, ignition control, and tire pressure monitoring to diagnostic, navigation, and entertainment systems. The agencies observed that although manufacturers “attempt to limit the interaction between vehicle systems, wireless communications, and diagnostic ports, these new connections to the vehicle architecture provide portals through which adversaries may be able to remotely attack the vehicle controls and systems.” They stated:
Third-party devices connected to the vehicle, for example through the diagnostics port, could also introduce vulnerabilities by providing connectivity where it did not exist previously.
The agencies pointed out that vulnerabilities may exist within a vehicle's wireless communication functions, within a mobile device – such as a cellular phone or tablet connected to the vehicle via USB, Bluetooth, or Wi-Fi – or within a third-party device connected through a vehicle diagnostic port. In these cases, according to the public service announcement, “it may be possible for an attacker to remotely exploit these vulnerabilities and gain access to the vehicle's controller network or to data stored on the vehicle.” The agencies added that although vulnerabilities “may not always result in an attacker being able to access all parts of the system, the safety risk to consumers could increase significantly if the access involves the ability to manipulate critical vehicle control systems.”
The agencies said in the announcement that the NHTSA is “actively working on several initiatives to improve the cyber security posture of vehicles in the United States.”
They also pointed out that, in addition to “the steps taken by individual automakers to address vehicle safety and security,” the auto industry has established an “Information Sharing and Analysis Center” to provide “a trusted mechanism for exchanging cyber security information” and to act “as a central hub for gathering intelligence to help the industry analyze, share, and track cyber threats.” Moreover, the announcement concluded, automakers are “collaborating on best practices for enhancing the cyber resiliency of motor vehicle electronics and associated in-vehicle networks.”