Story image

BMW awards Chinese security team's work in exposing connected vehicle vulnerabilities

24 May 2018

When Chinese security researchers found a number of vulnerabilities in BMW’s connected vehicles, BMW didn’t just fix the vulnerabilities, it even awarded the eagle-eyed researchers for their efforts.

Tencent Keen Security Lab examined BMW’s internet connected systems (Infotainment System (a.k.a Head Unit), Telematics Control Unit and Central Gateway Module) and found that an attacker could potentially conduct a remote targeted attack on multiple vehicles.

Attackers could leverage 14 vulnerabilities across the different vehicle components. Furthermore, the researchers were able to use Ethernet, USB and OBD-II to physically hack the vehicles’ systems.

“Nine of the attack scenarios required a physical connection in the car or a location in the direct vicinity of the vehicle,” a statement from BMW Group says.

“Five attack scenarios were based on a remote connection using the mobile telephone network. After gaining access to the head unit and T-box components, Tencent Keen Security Lab executed specifically developed exploits and in this way was able to gain control of the CAN buses to trigger arbitrary, unauthorised diagnostic vehicle functions remotely.” BMW has started patching the vulnerabilities and awarded the team its first ever BMW Group Digitalization and IT Research Award.

The Award honours Tencent Keen Security Lab’s work in advancing automotive security.

“With this award we want to honour the experts who support us in the transformation towards digitalised mobility,” says BMW Group’s senior vice president of electronics, Christoph Grote.

“We thank Tencent Keen Security Lab for their tremendous effort, their sophisticated research and the highly professional collaboration.” 

Tencent Keen Security Lab details the vulnerabilities in a brief research paper. The team started research in January 2017, and by April 2018 BMW had started rolling out patches.

“We want to contribute our comprehensive expertise and in-depth understanding of vehicle technologies to improving the development processes and security guidelines in the automotive industry, providing a shared benefit for OEMs and customers,” says Tencent Keen Security Lab lead researcher of vehicle and IoT security research, Sen Nie.

BMW states says that security and privacy are key elements in its product development process. It has launched a cybersecurity action plan that incorporates internal testing and independent third parties.

“Third parties increasingly play a crucial role in improving automotive security as they conduct their own in-depth tests of products and services,” BMW Group says.

The Group also says it is in discussions with Tencent Keen Security Lab about joint in-depth research and development opportunities.

The joint research will focus on the security of Android embedded systems, and on autonomous driving security and testing. Additionally, consulting services on security in over-the-air software update mechanisms are within the scope of future collaboration.

Affected BMW models include BMW i Series, BMW X Series, BMW 3 Series, BMW 5 Series, BMW 7 Series. And the vulnerabilities in the Telematics Control Unit (TCB) affect BMW models which equipped with this module produced from year 2012.

 Upgrades were rolled out in the BMW Group backend and uploaded to the telematics control units via over the air connection.

The BMW Group develops additional software updates, which will be made available for customers at BMW dealerships.

Avi Networks: Using visibility to build trust
Visibility, also referred to as observability, is a core tenet of modern application architectures for basic operation, not just for security.
Privacy: The real cost of “free” mobile apps
Sales of location targeted advertising, based on location data provided by apps, is set to reach $30 billion by 2020.
Myth-busting assumptions about identity governance - SailPoint
The identity governance space has evolved and matured over the past 10 years, changing with the world around it.
Forrester names Crowdstrike leader in incident response
The report provides an in-depth evaluation of the top 15 IR service providers across 11 criteria.
Slack doubles down on enterprise key management
EKM adds an extra layer of protection so customers can share conversations, files, and data while still meeting their own risk mitigation requirements.
Security professionals want to return fire – Venafi
Seventy-two percent of professionals surveyed believe nation-states have the right to ‘hack back’ cybercriminals.
Alcatraz AI to replace corporate badges with AI security
The Palo Alto-based startup supposedly leverages facial recognition, 3D sensing, and machine learning to enable secure access control.
Unencrypted Gearbest database leaves over 1.5mil shoppers’ records exposed
Depending on the countries and information requirements, the data could give hackers access to online government portals, banking apps, and health insurance records.