Google's in-car gaming sparks cybersecurity concerns

Google has introduced in-car gaming as part of its latest Pixel Feature Drop, sparking concerns over potential cybersecurity threats.

Google has positioned this new feature, available via Android Auto, as a means to entertain passengers while the vehicle is parked. However, cybersecurity expert Liudas Kanapienis has expressed concern that this addition could provide new avenues for cyber attackers.

Kanapienis, who is CEO and Co-founder of Ondato, has highlighted the need for automakers and tech companies to prioritise cybersecurity measures as vehicles incorporate more connected features. He stated, "Entertainment features cannot come at the expense of cybersecurity, which will require cooperation from both the automakers and tech companies. While gaming in car seems harmless, this situation could provide more entry points for hackers to take advantage of."

The potential vulnerabilities of in-car gaming systems are linked to their connectivity and integration with vehicle controls. Kanapienis warns that hackers might exploit the gaming interface to access critical systems such as braking, acceleration, or steering, particularly in models where these systems are even more integrated. He cautioned, "If an attacker compromises an in-car gaming system, they could potentially gain access to the personal data, track the location, or install malware."

Real-world incidents of car hacking underscore these risks. In 2015, security experts Charlie Miller and Chris Valasek demonstrated a hack on a Jeep Cherokee, taking over its steering, transmission, and brakes through its internet-connected entertainment system. Similarly, a vulnerability in BMW's Connected Drive system allowed for unauthorised remote unlocking of vehicles. Even Tesla vehicles were targeted during the Pwn2Own hacking event when participants managed to open the front trunk or door of a Tesla Model 3 while it was in motion.

Beyond cybersecurity concerns, the issue of driver distraction is also significant. Although Google limits the gaming feature to when vehicles are parked, any relaxation of this restriction could lead to increased risks on the road. Recent data from the National Highway Traffic Safety Administration revealed that in 2022, 3,308 fatalities occurred in crashes involving distracted driving.

Kanapienis emphasised the importance of a security-centric approach in developing in-car entertainment features. He advised, "Companies such as Google should set up strict cybersecurity standards, including intrusion detection systems, end-to-end encryption, and periodic security checks to prevent these features from becoming a vulnerability."

As vehicles become more software-driven, automakers and tech developers are responsible for ensuring cybersecurity and minimising distractions. There is a call for stricter regulations on how these entertainment features interface with vehicle systems, ensuring they remain a safe addition to the driving experience.