Story image

How hackers can wreak havoc on connected vehicles & ITS

25 Oct 2017
Twitter
Facebook

As the time approaches when autonomous vehicles and intelligent transport systems become commonplace, the IT security industry has been making sure those vehicles are protected against hacking and other cyber attack techniques.

Trend Micro has been on the leading edge of research and published a report that analyses Cyberattacks against Intelligent Transport Systems.

The company says that BI intelligence predicts that 82% of the cars to be shipped in 2021 will be connected in some way.  In addition, smart roads and Intelligent Transportation Systems (ITS) will be used across urban planning and development in areas such as high-volume traffic movement efficiency and the creation of new economic opportunities.

“In today’s connected world of smart devices and ever-increasing volumes of disruptive and destructive cyber attacks, ITS cybersecurity is mandatory and should be considered a fundamental pillar in ITS architectures and frameworks,” comments Trend Micro senior security architect Dr Jon Oliver.

“Earlier this year, we already saw the WannaCry ransomware infecting speed cameras in Victoria. Adding security to an existing solution is always more difficult and costly than building that security from day one. We recommend that the people building ITS systems look into policies and methods so that security can be built into ITS systems in a cost-effective way from its infancy in Australia.”

The security industry has been focusing on car hacking techniques in order to understand attack vectors against modern vehicles and future autonomous vehicles. Hackers could potentially gain control over vehicle functions and steal data, the company explains.

Those hackers could comprise nation states, criminal gangs, hacktivists, cyberterrorists, insiders, ‘unscrupulous operators’ and natural disasters, the report states.

The possibility of ransom demands, data theft, information warfare, system gaming and theft and revenge and terrorism are the most likely motivations for attack.

Those attacks could also be conducted by physical, wireless and network attacks – or a combination of all of them.

“It is very possible that a singular attack can involve all three attack categories at the same time. For example, in an attack against a traffic flow controller device such as Dynamic Message Signs (DMS), the attackers can send the device incorrect/improper commands via a wireless link, by physically connecting to the device, and/or over the network using a compromised controller application. The nature and functionality of DMS make this attack vector multimodal,” the report explains.

The key principle of defense is to assume compromise and take countermeasures:

• Quickly identify and respond to ongoing security breaches.

• Contain the security breach and stop the loss of sensitive data.

• Preemptively prevent attacks by securing all exploitable avenues.

• Apply lessons learned to further strengthen defenses and prevent repeat incidents.

Story image
22 Aug
Spear phishing techniques evolving to execute lateral attacks – Barracuda
Barracuda’s research uncovered fresh insights into how these popular attacks are evolving and the tactics used by cybercriminals to try to make them successful.More
Link image
Report: Fortinet releases latest analysis of the cyberthreat landscape
Learn about the latest cyber-threat trends from the newest release of the Fortinet Threat Landscape Report, including remote desktop protocol vulnerabilities and why cybersecurity automation is part of a comprehensive cyber hygiene practice. Download it for FREE.More
Story image
16 Aug
Limiting access key to minimising data breaches, says expert
"When a company provides only a minimum amount of access needed for the employees to fulfil their roles, the risk of wide-spread breach greatly diminishes."More
Story image
16 Aug
New research highlights third party risks facing organisations
modern risk management must account for ongoing changes in third-party relationships and mitigate risks in an iterative way — that is, on a continual basis, rather than at specified intervals."More
Story image
Today
Victoria University partners with Cisco to open Cybersecurity Training Centre
The Centre will prepare students to meet the demand for talent in the cybersecurity pipeline through skill development, with technology that is at the forefront of this digital future.More
Story image
08 Aug
CrowdStrike launches threat-scoring platform
CrowdScore is a metric that enables CSOs to instantly see the real-time threat level their organisations are facing, allowing them to mobilise resources to respond.More