Security firm Symantec has released a study containing tips and practical guidance for combating the increasingly important issue of automotive security vulnerabilities.
Car security has made headlines this year with security researchers demonstrating the ability to remotely take control of a car's braking system, and BMW disclosing a flaw that allows, among other problems, the remote unlocking of car doors.
The latter issue was addressed in the white paper “Building Comprehensive Security into Cars” by Symantec, which believes that providing security updates to cars is problematic, given that the traditional mechanism for applying security patches to the IT infrastructure is not compatible.
Solutions, Symantec explains, must be “in a framework that works both inside the car and at scale for automakers.” Real-time, over-the-air (OTA) patching, for example, conflicts with the multi-year security certification processes required by automakers.
Symantec argues that many keyless entry systems, which work by detecting the proximity of virtual keys to a car, are not satisfactory in terms of recording location and proximity data with appropriate safeguards.
The simplest signal-strength triangulation mechanism that has been deployed in many systems is open to attacks, in which a would-be carjacker can relay the signal emitted by the key fob to the car and vice versa with a phone key. By deploying “digitally capturing the location, signing the data at that time, and using secure boot and code signing to ensure that the firmware has not been tampered with,” car manufacturers could mitigate the problem, the report says.
The security firm also highlighted the threats stemming from the use of Bluetooth in-vehicle and the vulnerabilities of systems that offer entertainment and navigation data.
