Published: April 27, 2016
The degree of connectivity solutions inside and outside of the vehicle has exploded in recent years, enabling a tremendous list of features for comfort, safety and performance. Starting with the CAN communication bus technology nearly 30 years ago, now up to 50 different intelligent ECUs exist in a standard vehicle exchanging critical data between each other and also with service platforms residing in the cloud. The continuous connectivity that we as consumers experience in our daily lives won’t stop at the door of our vehicles. Apps and other complex interaction features triggered through our phones are crucial elements to excite consumers to purchase a new vehicle.
However, recent demonstrations within the last year have shown that with continuous connectivity features and technologies come a continuous threat potential which is no longer a theoretical problem. The automotive industry has been lucky so far that only white-hat hackers and members of the research community have investigated existing designs and implementations of vehicle E/E architectures to find low and high risk vulnerabilities able to put the life of drivers and passengers in danger. It is just a matter of time that more dubious people will become interested in hacking into vehicles and other telematics systems and hold vehicle assets and passenger safety as ransom.
OEMs and other automotive value chain members worldwide are now realizing the criticality of cybersecurity topics, but it will take more time to finally say that all communication protocols inside and outside the vehicle are protected from unknown adversaries. In fact, the majority of companies are still struggling to define cybersecurity technology and implementation roadmaps that provide a holistic protection. OEMs, Tier1s, and others have to integrate cybersecurity elements within their vehicles and products to the full extent, not halfheartedly.
Testing & validation activities are an integral part of today’s automotive development lifecycles to ensure safe performance in the real-world. Nevertheless, cybersecurity related testing of single components and systems aren’t considered as ultimately necessary as there is no standardization on how to perform these checks. Before today, the specifications of an installed product were considered as the only baseline.
P3 understands the complexity of cybersecurity related elements in today’s vehicles and the subsequent necessity to validate their effectiveness, even years after a vehicle market launch. Therefore, with our strong automotive knowledge and expertise gained in the last 20 years, a holistic testing suite with innovative tools was conceptualized and developed internally. This cybersecurity test suite tests 250 different known vulnerabilities and weak vehicle electronics settings in the following categories:
Numerous tests also cover cloud-based telematics portals and smartphone apps, normally used by vehicle owners, as it has been demonstrated that those bear significant cybersecurity related vulnerabilities due to insufficient implementations.
P3 also created a unique scorecard system reflecting best practices and common vulnerabilities discovered in the past and thereby providing a holistic and transparent overview about the cybersecurity level of a certain vehicle.
Due to our long history of benchmarking activities for mobile networks worldwide, we want to provide the same transparency for cybersecurity technology in the automotive industry. Therefore, we tested seven different vehicles regarding the aforementioned categories. We selected vehicles from European OEMs as well as car manufacturers operating in the North American market, in order to assess possible differences in cybersecurity strategies and weaknesses between the two major automotive regions. Our automotive cybersecurity test suite is designed to execute and analyze 60 percent of all test cases automatically. The remaining tests are executed and monitored by our automotive and cybersecurity experts.
Unfortunately, no OEM could demonstrate comprehensive working cybersecurity protection. Nevertheless, they successfully passed between 55 and 80 percent of our test cases. One test domain, Cryptography, showed significant differences in implementations, with two vehicles not able to prove sufficient protection with less than a 20 percent success rate. More concerning is the fact that at least in one case a deprecated encryption method for communication data was used, setting the telematics and other vehicle systems at risk for overall safety.
Further severe vulnerabilities were detected within the smartphone applications provided by the OEMs through the official app stores, where privacy-related and user access data was stored on the phones without any further protection. Also popular features like the LTE/Wi-Fi hotspot functionality of our tested vehicles showed significant cybersecurity related weaknesses in their implementations.
The seven tested vehicles were selected as they represented the latest versions of connectivity and telematics solutions. The P3 automotive cybersecurity benchmark study demonstrated that current development activities of most OEMs and their technology suppliers cover the critical requirements of today’s cybersecurity technology sufficiently, but leave critical room for improvement. The cybersecurity benchmark results are serving the interests of OEMs and their consumers. Increasing public awareness for cybersecurity in general will eventually lead into the situation where potential buyers will inform themselves about the protection level of the next vehicle they are about to buy. OEMs, not advancing their cybersecurity protection measures, are then on risk for their overall business success.
“We are convinced that an easily understandable representation of these test results is necessary. A transparent assessment process that summarizes all results on a score card is fulfilling this target and enables managers a direct comparison of his own vehicles with the competition, including a clear display of the temporal trend. Furthermore it clearly demonstrates the current status of all cybersecurity value chain elements, the identification of the weakest link can be done then with much less efforts”, said Hakan Ekmen, Managing Director, P3 communications.
Dr. Samit Ghosh, president and CEO of P3’s North American automotive division, added further “The results of the P3 automotive cyber security benchmark clearly demonstrate the need for current vehicles with sophisticated connectivity features to improve their cybersecurity protection levels. The P3 test cases highlight the current deficiencies and give valuable input to vehicle engineering teams to remediate issues as soon as possible. We strongly advocate the inclusion of similar cybersecurity testing in future vehicle developments, along the same lines as functional safety testing.”
The P3 automotive cybersecurity test suite will expand over time to address new detected vulnerabilities within the automotive industry, but also developments within the IT domain as the technology boundaries between these industries are continuing to blur.