Story image

How hackers can wreak havoc on connected vehicles & ITS

25 Oct 2017

As the time approaches when autonomous vehicles and intelligent transport systems become commonplace, the IT security industry has been making sure those vehicles are protected against hacking and other cyber attack techniques.

Trend Micro has been on the leading edge of research and published a report that analyses Cyberattacks against Intelligent Transport Systems.

The company says that BI intelligence predicts that 82% of the cars to be shipped in 2021 will be connected in some way.  In addition, smart roads and Intelligent Transportation Systems (ITS) will be used across urban planning and development in areas such as high-volume traffic movement efficiency and the creation of new economic opportunities.

“In today’s connected world of smart devices and ever-increasing volumes of disruptive and destructive cyber attacks, ITS cybersecurity is mandatory and should be considered a fundamental pillar in ITS architectures and frameworks,” comments Trend Micro senior security architect Dr Jon Oliver.

“Earlier this year, we already saw the WannaCry ransomware infecting speed cameras in Victoria. Adding security to an existing solution is always more difficult and costly than building that security from day one. We recommend that the people building ITS systems look into policies and methods so that security can be built into ITS systems in a cost-effective way from its infancy in Australia.”

The security industry has been focusing on car hacking techniques in order to understand attack vectors against modern vehicles and future autonomous vehicles. Hackers could potentially gain control over vehicle functions and steal data, the company explains.

Those hackers could comprise nation states, criminal gangs, hacktivists, cyberterrorists, insiders, ‘unscrupulous operators’ and natural disasters, the report states.

The possibility of ransom demands, data theft, information warfare, system gaming and theft and revenge and terrorism are the most likely motivations for attack.

Those attacks could also be conducted by physical, wireless and network attacks – or a combination of all of them.

“It is very possible that a singular attack can involve all three attack categories at the same time. For example, in an attack against a traffic flow controller device such as Dynamic Message Signs (DMS), the attackers can send the device incorrect/improper commands via a wireless link, by physically connecting to the device, and/or over the network using a compromised controller application. The nature and functionality of DMS make this attack vector multimodal,” the report explains.

The key principle of defense is to assume compromise and take countermeasures:

• Quickly identify and respond to ongoing security breaches.

• Contain the security breach and stop the loss of sensitive data.

• Preemptively prevent attacks by securing all exploitable avenues.

• Apply lessons learned to further strengthen defenses and prevent repeat incidents.

Cloud application attacks in Q1 up by 65% - Proofpoint
Proofpoint found that the education sector was the most targeted of both brute-force and sophisticated phishing attempts.
Singapore firm to launch borderless open data sharing platform
Singapore-based Ocean Protocol, a decentralised data exchange that promotes data sharing, has revealed details of what could be the kickstart to a global and borderless data economy.
Huawei picks up accolades for software-defined camera ecosystem
"The company's software defined capabilities enable it to future-proof its camera ecosystem and greatly lower the total cost of ownership (TCO), as its single camera system is applicable to a variety of application use cases."
Aussies too lax about IoT security - McAfee
Aussie consumers are at a loss when it comes to securing the increasing number of connected devices in their homes and are often opting to take no action at all.
Barracuda expands MSP security offerings with RMM acquisition
Managed Workplace delivers an RMM platform with security tools and services, such as site security assessments, Office 365 account management, and integrated third-party antivirus.
Flashpoint: APAC companies must factor geopolitics in cyber strategies
The diverse geopolitical and economic interests of the states in the region play a significant role in driving and shaping cyber threat activity against entities operating in APAC.
Expert offers password tips to aid a stress-free sleep
For many cybersecurity professionals, the worries of the day often crawl into night-time routines - LogMeIn says better password practices can help.
SolarWinds extends database anomaly detection
As organisations continue their transition from purely on-premises operations into both private and public cloud infrastructures, adapting their IT monitoring and management capabilities can pose a significant challenge.