Intel Takes On Car Hacking, Founds Auto Security Review Board

After a summer full of car hacking revelations, Intel, today, announced the creation of a new Automotive Security Review Board (ASRB), focused on security tests and audits for the automobile industry.

The potential for modern connected cars to be attacked and remotely controlled by malicious hackers is a topic that has received considerable attention recently from security experts, industry stakeholders, regulators, lawmakers, and consumers.

Demonstrations like one earlier this year where two security researchers showed how attackers could take wireless control of a 2014 Jeep Cherokee’s braking, steering, and transmission control systems, have exacerbated those concerns greatly and lent urgency to efforts to address the problem.

Intel also released a whitepaper describing a preliminary set of security best practices for automakers, component manufactures, suppliers, and distributors in the automobile sector.

An Intel press release described the ASRB as a forum for top security talent in the area of cyber-physical systems. “The ASRB researchers will perform ongoing security tests and audits intended to codify best practices and design recommendations for advanced cyber-security solutions,” for the auto industry, the release noted.

ASRB members will have access to Intel automotive’s development platforms for conducting research. Findings will be published publicly on an ongoing basis, Intel said. The member that provides the greatest cybersecurity contribution will be awarded a new car or cash equivalent.

Intel’s security best practices whitepaper, also released today, identified several existing and emerging Internet-connected technologies in modern vehicles that present a malicious hacking risk.

Modern vehicles have over 100 electronic control units, many of which are susceptible to threats that are familiar in the cyber world, such as Trojans, buffer overflow flaws, and privilege escalation exploits, Intel said. With cars connected to the external world via Wi-Fi, cellular networks, and the Internet, the attack surface has become substantially broader over the last few years.

The whitepaper identifies 15 electronic control units that are particularly at risk from hacking. The list includes electronic control units managing steering, engine, and transmission, vehicle access, airbag and entertainment systems. “Current automotive systems are vulnerable,” Intel noted. “Applying best-known practices and lessons learned earlier in the computer industry will be helpful as vehicles become increasingly connected.”

Concerns have been growing in recent times about critical security weaknesses in many of the Internet-connected components integrated in new vehicles these days. Chrysler for instance, recalled 1.4 million vehicles after two security researchers showed how they could bring a Jeep Cherokee traveling at 70 mph to a screeching halt by hacking into its braking system from 10 miles away.

A report released by Senator Edward Markey (D-MA) in February, based on input from 16 major automakers, revealed how 100 percent of new cars have wireless technologies that are vulnerable to hacking and privacy intrusions. The report found that most automakers were unaware or unable to say if their vehicles had been previously hacked while security measures to control unauthorized access to control systems were inconsistent.

Craig Hurst, director of strategic planning and product management at Intel Transportation Solutions Division’s Internet of Things Group says a holistic approach is required to address security issues in Internet connected vehicles.

“Automotive security must be approached from a system-level perspective, and not from a single attack surface or platform ingredient alone,” he says. Collaboration and contribution across the entire automotive ecosystem are critical to ensuring better security, he says.

“Security begins with the design of the car where hardware, software, and network security technologies can be deployed,” he says. Organizations in the automobile sector have to start thinking about institutional processes such as security development lifecycle and secure supply chain management from a cyber risk standpoint. And processes need to be in place to ensure that vehicles continue to be protected as new threats emerge over its life time,” Hurst says.

“The complexity of the automotive ecosystem requires an industry effort, and there’s a positive momentum building,” he said. “The most important aspect is that security must be observed, designed, tested, and enhanced from a system-level view."