There’s a glaring gap between the public perception of the autonomous vehicle industry, and what’s actually happening at the R&D facilities around the world. While the public still treats any news about cars that drive themselves as almost-magic, engineers who work on them know that these cars are your typical advanced combination between hardware and software, one that’s incredibly complex and often buggy.
One of the main reasons for that, which, again, is something the public is blissfully unaware of, is the reliance of vehicle manufacturers on 3rd party components. A modern car might have software and hardware from dozens, if not hundreds, of different providers. Some of it is bespoke, but a large number of components that go inside a car are made to be universally compatible. To achieve maximum compatibility, those components have massive codebases, and massive codebases are what lead to security issues.
Safety in all aspects of a car is important, it is not just for how it is made but how the driver handles it. Despite security software updates in cars, it can’t stop drivers from driving erratically and creating issues on the road, so much so that they end up with a traffic ticket. If this does happen, you may be able to have a traffic ticket dismissal if you attend an online driving school. No amount of security software upgrades can stop you from getting a ticket if you don’t behave on the roads.
Securing One Car, Securing Thousands of Components
Unfortunately, the automotive companies themselves are limited in their ability to ensure the safety of the software they receive through their supply chain. With no access to the source code of 3rd party software, risk analysis becomes reliant on manual testing of each component.
This process is only partially effective, for several reasons. The first one is the difficulty to accurately assess risk from each component without having full visibility into it. The second issue is the scale of the tests required: there’s just too many components, oftentimes with multiple versions of each one, for effective risk assessment and mitigation without a dedicated cyber security-based system. As these concerns rise about security, so does the risk of instances of Lemon law coming into effect if the security is flawed. California Lemon Law is very detailed on the subject of if there is an issue with the vehicle, and this is a risk that rises in relevancy the more technology is added to the car.
As a result, we already hear about proof-of-concept attacks against vehicles, which use seemingly-innocuous components to take over control-related functions. And that’s for cars which aren’t even supposed to enable computers to drive. With more and more semi-autonomous vehicles on our roads and fully-autonomous vehicles coming in the near future, the security question is only about to get bigger.
Rethinking Automotive Security
At Cybellum, we think about automotive security a lot. We approach it as a two-pronged challenge: how to secure the vehicle as much as possible before it hits the road, and how to monitor it after the launch in case something terrible happens.
Cybellum In-Production is our solution to the first challenge, that of the pre-deployment testing. Our security suite is designed for full component visibility and risk assessment, based on automated vulnerability detection. It automatically reverse-engineers and scans firmware for security vulnerabilities and threats, mimicking an attacker, and gives you full visibility into the scanned component. Operating in the integration phase, with no code going into the vehicle, it enables to assess the risk posed by any component, and remediate it before releasing the car.
It also ensures that the firmware is meeting security regulations, standards and best-practices such as MISRA coding standard, and complies with the ISO 26262 safety standard.
It uses proprietary Machine Learning algorithms and mature models, proven to detect a wide range of vulnerabilities. Leveraging Machine Learning enables our products to learn and improve with every new vulnerability that’s discovered and published.
Cybellum On-Road is designed to ensure car safety after its launch. It monitors all deployed components for new vulnerabilities and threats using resources from across public, private and darknet sources. It’s able to integrate into the inventory management system, to have a full understanding of which components it should be monitoring at any given moment.
It goes a step further, and analyzes the vulnerabilities to assess the risk they pose, based on both the technical severity of the vulnerabilities and their risk of exploitability.
Both products can be deployed both in the cloud and on the client’s servers. They also can be implemented as part of the OEM’s Security Operation Center (SOC), to complete the vulnerability and risk assessment loop for all the components.
By Michael Engstler
Cybellum CTO and co-founder. An Entrepreneur, skilled in defensive and offensive cyber security, experienced in leading large scale R&D projects throughout all stages of design, development and deployment. Served as an officer in Israel’s elite intelligence corps for many years in various R&D and management positions, receiving Outstanding Officer Honor for my service.
