Research and Markets: The Threat of Over-the-Air Hacking for Cars - 2013 Report Analyses the Threat

DUBLIN--(BUSINESS WIRE)--

Research and Markets (http://www.researchandmarkets.com/research/lrst24/the_threat_of) has announced the addition of the "The Threat of Over the Air Hacking for Cars - 2013" report to their offering.

With cars becoming more connected, the scope of vehicle security is shifting from theft prevention to minimizing hackers capability to gain unauthorized access of in-car ECUs.

This report provides a unique analysis of the ways in which the connected car could be exploited by thieves. Different methods by which a vehicle could be compromised, such as direct physical attacks, proximitybased attacks and direct over-the-air attacks are discussed, together with the results of academic research performed in this area.

The report analyses the risks that cars may get stolen due to various possible weaknesses in the entire chain of connected service delivery (IT infrastructure, servers, communications, etc.).

The fast-paced recent development of vehicle telematics systems to provide an ever-greater number of convenience features is generally incompatible with the approach necessary to make a system secure. Due to the complex embedded software and a multitude of communication channels, it is likely that weaknesses exist in all systems which a criminal could exploit to facilitate theft of the car.

The inconvenient truth is that software attacks are already used to steal cars.

In the last few years there has been a rise in thefts of late-model cars where criminals have used hand-held tools, such as key programmers and immobiliser overrides, to steal them without needing the original key.

The speed with which these devices perform their attacks on the embedded software, via the OBD port, has transformed electronic theft from a minority method to, in some markets, the dominant method used by thieves to steal the most targeted models. The proliferation of theft tools available today illustrates both the ingenuity of the attackers and the complacency of the vehicle manufacturers.

A growing number of vehicle manufacturers today offer telematics systems to provide the connectivity demanded by a new generation of buyers. Some of these systems already offer services which could potentially be manipulated by an attacker to steal cars, such as remote door unlock and remote engine start.

This report shows that vehicle manufacturers and their telematics service providers should take heed of emerging academic studies which have demonstrated that remote attacks can result in a criminal manipulating vehicle systems. Reverse-engineering vehicle CAN messages, frequently to override security protocols, is already mainstream research for aftermarket companies. This level of knowledge, combined with any single exploitable weakness in the telematics platform, would provide an attacker with almost any remote control functionality they desire.

This report looks at how vehicle telematics systems could be used to facilitate car theft in the future. It considers how criminals may remotely access or start the car and whether such attacks could be performed entirely over-the-air, or whether the vehicle would firstly need to be compromised by some alternative method. It also examines the explosion in internet-facilitated crime to consider what the automotive industry should know about today's cybercriminals.

Key Topics Covered:

1. Executive Summary

1.1 Software Attacks are Already Used to Steal Cars

1.2 Could Cars be Manipulated Remotely?

1.3 Will Remote Attacks Remain Science Fiction?

2. Background

2.1 Ubiquitous Connectivity

2.2 The Need for Embedded Security

2.3 Scope of this Report

3. What Might be Possible with Remote Attacks?

3.1 Scenario

3.2 Theoretical Capabilities

3.3 Reverse Engineering Vehicle Messages

4. How Could a Vehicle be Attacked?

4.1 Prior Physical Access

4.2 Prior Proximity to the Vehicle

4.3 Direct OTA Attack

4.4 Conclusions

5. Proof of Principle Attacks

5.1 OEM Telematics System Exploited

5.2 SMS 'War Texting' Demonstration

5.3 What do These Attacks Demonstrate?

6. Actual Attacks

6.1 Malicious Employee Activates Remote Immobilisers

6.2 Attacks in other Domains

For more information visit http://www.researchandmarkets.com/research/lrst24/the_threat_of