In automotive cybersecurity news are Argus, Panasonic, McAffee, ASRG HSB Munich Re and Trend Micro.
Argus Cyber Security Partners with Microsoft Azure
Argus Cyber Security, a global leader in automotive cyber security, has collaborated with Microsoft Azure IoT and joined the Microsoft partner network to provide vehicle manufacturers the ability to monitor, detect, and mitigate attacks in the cloud.
Argus cyber security suite, integrated with Azure IoT for automotive applications, includes Argus Fleet Protection, an Automotive Security Operation Center (ASOC) solution, in-vehicle insights from Argus Connected ECU Protection, and update capabilities with Argus Software Updates Over-the-Air (OTA). This end-to-end cloud solution is among the first to provide vehicle manufacturers full visibility into the cyber health of their fleet with on-board and off-board monitoring.
This collaboration in automotive provides vehicle manufacturers easier access to security-related in-vehicle information as well as comprehensive coverage of security events. Argus Connected ECU Protection, deployed on connected ECUs such as telematics, infotainment centers, and ADAS units, detects operating system anomalies and suspicious activity in the vehicle according to customer-defined threat models. Threat models can be based on UNECE R 155 (WP.29), the MITRE Attack framework, or any other chosen model. Alerts from the vehicle are sent to Argus Fleet Protection where they are fused with insights from other sources in dedicated automotive threat hunting and investigation modules. By integrating end-to-end automotive cyber security with Microsoft Azure IoT, vehicle manufacturers can leverage data across a wide range of sources to build a more accurate, all-encompassing cyber intelligence picture.
Moreover, with Argus Delta OTA update technologies, vehicle manufacturers are able to implement security updates OTA to immediately reduce exposure to cyber risks, while reducing vehicle downtimes and deployment costs.
Panasonic & McAfee to Build Vehicle SOC
Panasonic Corporation and McAfee Corp. (Nasdaq: MCFE), have agreed to jointly start building a Vehicle Security Operation Center (hereinafter, Vehicle SOC) to commercialize vehicle security monitoring services. To protect connected vehicles around the world against cyber-attacks, the companies will build vehicle SOCs that enable accurate detection and early response to attacks and help strengthen Cybersecurity measures in the automotive industry.
Panasonic has already been operating SOCs for factories since 2016 to protect systems and networks that manage and control factory equipment and production processes against cyber-attacks – prior to SOC for automobiles. For automobiles, they have developed a Automotive Intrusion Detection System that mounts on a vehicle, detects the occurrence of a cyber-attack and the type of attack, and transmits analysis data to the vehicle SOC and a Security Information and Event Management System that analyzes and visualizes a large amount of data received from the Automotive Intrusion Detection System in the vehicle SOC. McAfee supports world-class SOCs and Managed Security Services (MSSs), and has the know-how cultivated by building and operationally supporting numerous SOCs. The Company will bring these together and start building vehicle SOCs to monitor cyber-attacks that may be conducted against vehicles around the world.
With the innovative development of autonomous driving, the advancement of digitalization, and the increasing number of connected cars, the risk of cyber-attacks against automobiles is increasing every year. It has become urgent for the automotive industry to establish mechanisms to protect and monitor vehicles from cyber-attacks. The Vehicle Security Operation Center will enable the provision of monitoring services to monitor connected cars around the world and contribute to the development of a safe and secure mobility society.
ASRG Works with Cybellum
The Automotive Security Research Group (ASRG) announced its partnership with Cybellum, a leader in Automotive Cybersecurity Risk Assessment.
This partnership will support the members and goals of ASRG, specifically the development of an open vulnerability management platform for automotive products. The new platform will assist the community by allowing access to knowledge on current and past vulnerabilities including a responsible disclosure program.
“We need to partner with experts like Cybellum to enhance our members’ knowledge on how to identify potential risks in their products and provide the most secure solutions available,” said John Heldreth, Founder of ASRG. “Through our partners program, we empower our members to keep up with industry innovation and challenges. Access to innovative solution providers like Cybellum allows our members to enhance their vulnerability management operations, stay informed of relevant cybersecurity threats, and align their organization with the latest technology developments.”
The Automotive Security Research Group (ASRG) is a non-profit organization focused on the advancement of the automotive security industry. Through knowledge, networking and collaboration, we enable the worldwide community of nearly 6000 members in 40 locations to create more secure products by building competencies in automotive security. To get more involved, make an impact on the industry, participate in a technical committee, or become part of a project, please reach out to us. You can find out more about ASRG at www.asrg.io.
American Drivers Worried About Hackers
U.S. motorists worry about possible cyber-attacks on their connected vehicles, a survey by HSB, part of Munich Re, reported today, and some even believe a hacker could confront them over their car audio systems or disable automotive safety features.
The HSB poll by Zogby Analytics found that 37 percent of consumers who responded were somewhat or very concerned about the cyber security and safety of connected and automated vehicles.
A similar number (35 percent) feared that a virus, hacking incident or other cyber-attack could damage or destroy their vehicle’s data, software or operating systems.
In a similar finding, 11 percent of those responding said they drive an electric vehicle and 50 percent of them were concerned that charging stations could be a point of entry for a cyber-attack.
Of the 55 percent of consumers who sync smartphones or other devices, 51 percent don’t know or aren’t sure what personal information is stored in their vehicle’s entertainment system.
“Our cars are more connected than ever,” said Timothy Zeilman, vice president for HSB, a provider of cyber insurance and services. “It’s hard for consumers to keep up with rapidly evolving vehicle technology and they wonder if their privacy and personal information is protected.”
Hackers on the Radio?
One in ten consumers reported a hacking incident or other cyber-attack had affected their vehicle, up three percent from a similar HSB poll the year before.
As connected technology continues to advance, some are concerned not only that their vehicle could be hacked, but also controlled by others remotely.
When asked what worried them most about a possible cyber-attack on their vehicle, 46 percent of consumers were very concerned a hacker might communicate with them over their audio system, perhaps to coerce them or demand a ransom payment.
Other top concerns were their vehicle being immobilized (25 percent very concerned), safety systems compromised (23 percent) and being locked out of their vehicle (14 percent).
The most common technologies installed in vehicles included Bluetooth (53 percent), navigation systems (42 percent) and vehicle safety sensors (39 percent).
Thirty-six percent of consumers owned smartphone apps that connected to their vehicles, while 24 percent had Wi-Fi or mobile hotspots that provided internet service on the road.
Survey Methodology
Zogby Analytics was commissioned by HSB to conduct a survey in December 2020 of 1,509 adults in the United States about their attitudes, experiences and concerns about cyber safety. Based on a confidence level of 95 percent, the margin for error is plus or minus 2.5 percentage points. That means all other things being equal, the identical survey would have results within the margin of error 95 times out of 100.
Trend Micro’s New Cybersecurity Research
Trend Micro Incorporated, a global leader in cybersecurity, today announced a major new study into connected car security that describes multiple scenarios in which drivers could encounter attacks that threaten the safety of themselves and others.
The report reveals the scope of the cybersecurity risks examined. Researchers evaluated 29 real-world attack scenarios according to the DREAD1 threat model for qualitative risk analysis. These attacks could be launched remotely against and/or from victim vehicles. Examples and highlights include:
- DDoS attacks on Intelligent Transportation Systems (ITS) could overwhelm connected car communications and represent a high risk.
- Exposed and vulnerable connected car systems are easily discovered, making them at higher risk of abuse.
- Over 17% of all attack vectors examined were high risk. These require only a limited understanding of connected car technology and could be accomplished by a low-skilled attacker.
“Our research shows that there are ample opportunities for attackers looking to abuse connected car technology,” said Rainer Vosseler, threat research manager for Trend Micro. “Fortunately, there are currently limited opportunities for attacks, and criminals have not found reliable ways to monetize such attacks. With the U.N.’s recent regulations requiring all connected cars to include cybersecurity, as well as a new ISO standard underway, now is the time for stakeholders across the industry to better identify and address cyber risk as we accelerate towards a connected and autonomous vehicle future.” 2
More than 125 million passenger cars with embedded connectivity are forecast to ship worldwide between 2018 and 2022, and progress continues to advance towards fully autonomous vehicles. This advancement will create a complex ecosystem comprising cloud, IoT, 5G and other key technologies. It also features an enormous attack surface comprising potentially millions of endpoints and end users.
As the industry develops, there will be multiple opportunities for monetization and sabotage for cybercriminals, hacktivists, terrorists, nation states, insiders and even unscrupulous operators, the report warns. Of all 29 attack vectors studied, the overall risk of successful cyber attacks was assessed as Medium. However, as SaaS applications become embedded in the Electrical/Electronics (E/E) architecture of vehicles and cybercriminals create new monetization strategies, an evolution in attacks will lead to higher risk threats.
To mitigate the risks outlined in the study, connected car security must be designed with an integrated view of all critical areas to secure the end-to-end data supply chain. Trend Micro has the following high-level guidance for protecting connected cars:
- Assume compromise and have effective alert, containment, and mitigation processes.
- Protect the end-to-end data supply chain across the car’s E/E network, the network infrastructure, backend servers, and VSOC (Vehicle Security Operations Center).
- Apply lessons learned to further strengthen defenses and prevent repeat incidents.
- Relevant security technologies include firewall, encryption, device control, app security, vulnerability scanner, code signing, IDS for CAN, AV for head unit, and much more.
Trend Micro offers IoT cybersecurity solutions specific to connected cars.