Story image

How hackers can wreak havoc on connected vehicles & ITS

25 Oct 2017

As the time approaches when autonomous vehicles and intelligent transport systems become commonplace, the IT security industry has been making sure those vehicles are protected against hacking and other cyber attack techniques.

Trend Micro has been on the leading edge of research and published a report that analyses Cyberattacks against Intelligent Transport Systems.

The company says that BI intelligence predicts that 82% of the cars to be shipped in 2021 will be connected in some way.  In addition, smart roads and Intelligent Transportation Systems (ITS) will be used across urban planning and development in areas such as high-volume traffic movement efficiency and the creation of new economic opportunities.

“In today’s connected world of smart devices and ever-increasing volumes of disruptive and destructive cyber attacks, ITS cybersecurity is mandatory and should be considered a fundamental pillar in ITS architectures and frameworks,” comments Trend Micro senior security architect Dr Jon Oliver.

“Earlier this year, we already saw the WannaCry ransomware infecting speed cameras in Victoria. Adding security to an existing solution is always more difficult and costly than building that security from day one. We recommend that the people building ITS systems look into policies and methods so that security can be built into ITS systems in a cost-effective way from its infancy in Australia.”

The security industry has been focusing on car hacking techniques in order to understand attack vectors against modern vehicles and future autonomous vehicles. Hackers could potentially gain control over vehicle functions and steal data, the company explains.

Those hackers could comprise nation states, criminal gangs, hacktivists, cyberterrorists, insiders, ‘unscrupulous operators’ and natural disasters, the report states.

The possibility of ransom demands, data theft, information warfare, system gaming and theft and revenge and terrorism are the most likely motivations for attack.

Those attacks could also be conducted by physical, wireless and network attacks – or a combination of all of them.

“It is very possible that a singular attack can involve all three attack categories at the same time. For example, in an attack against a traffic flow controller device such as Dynamic Message Signs (DMS), the attackers can send the device incorrect/improper commands via a wireless link, by physically connecting to the device, and/or over the network using a compromised controller application. The nature and functionality of DMS make this attack vector multimodal,” the report explains.

The key principle of defense is to assume compromise and take countermeasures:

• Quickly identify and respond to ongoing security breaches.

• Contain the security breach and stop the loss of sensitive data.

• Preemptively prevent attacks by securing all exploitable avenues.

• Apply lessons learned to further strengthen defenses and prevent repeat incidents.

Seagate: Data trends, opportunities, and challenges at the edge
The development of edge technology and the rise of big data have brought many opportunities for data infrastructure companies to the fore.
Popular Android apps track users and violate Google's policies
Google has reportedly taken action against some of the violators.
How blockchain could help stop video piracy in its tracks
An Australian video tech firm has successfully tested a blockchain trial that could end up being a welcome relief for video creators and the fight against video piracy.
IBM X-Force Red & Qualys introduce automated patching
IBM X-Force Red and Qualys are declaring a war on unpatched systems, and they believe automation is the answer.
Micro Focus acquires Interset to improve predictive analytics
Interset utilises user and entity behavioural analytics (UEBA) and machine learning to give security professionals what they need to execute threat detection analysis.
Raising the stakes: McAfee’s predictions for cybersecurity
Security teams and solutions will have to contend with synergistic threats, increasingly backed by artificial intelligence to avoid detection.
Exclusive: Ping Identity on security risk mitigation
“Effective security controls are measured and defined by the direct mitigation of inherent and residual risk.”
CylancePROTECT now available on AWS Marketplace
Customers now have access to CylancePROTECT for AI-driven protection across all Windows, Mac, and Linux (including Amazon Linux) instances.