Personal data, software updates and mobile apps for connected cars are potential targets for cybercriminals
Kaspersky Lab and the Interactive Advertising Bureau (IAB) of Spain have presented the First Annual Connected Car Study, a groundbreaking study of its kind.
The main purpose of the study is to provide a comprehensive overview of the connected car market, combining all available information to provide answers to important questions. In addition, the research attempts to take a more holistic look at the software ecosystem offered by car manufacturers today, which is highly fragmented. Vicente Diaz, Principal Security Researcher at Kaspersky Lab, was responsible for the part of the research that dealt with the potential security issues raised by connecting cars to the Internet.
Drivers can no longer ignore concerns about the security of communications and Internet services included in the new generation of connected cars. Today, cars not only have electronic driving aids, but also offer the ability to access social networks and email accounts, connect to smartphones, calculate routes, etc. These technologies offer great advantages to drivers, but also bring new risks to users. That is why it is necessary to analyze the factors that could lead to digital attacks and accidents.
Personal data, updates and smartphone apps for these cars could be three separate attack vectors for cybercriminals. “Connected cars can open the door to threats that have long existed in the world of PCs and smartphones. For example, vehicle owners may discover that their codes have been stolen. In this way, the location of their vehicle could be tracked, while its doors could be unlocked remotely. Privacy issues are crucial and today’s drivers need to be aware of new risks that did not exist before,” said Mr. Diaz.
Kaspersky Lab's analysis, based on the study of BMW's Connected Drive system, identified several potential cyberattack vectors:
Stolen Credentials: Theft of credentials required to gain access to the BMW website – using known means such as phishing, keyloggers or social engineering – could lead to unauthorized third-party access to the user’s information and then to access the vehicle itself. It is also possible for someone to install a mobile app with the same credentials, which could activate remote services before the vehicle is started.
Mobile Apps: Enabling mobile services that allow a car to be unlocked remotely essentially creates a new set of keys. If the app is not protected, anyone can gain access to the car by stealing the owner's phone. Using the stolen phone, a criminal could change the app's database and bypass any authentication checks that require entering a PIN code, making it extremely easy to activate remote services.
Updates: The Bluetooth drivers are updated by downloading a file from the BMW website and installing it via USB. This file is not encrypted, and contains a lot of information about the internal systems running in the vehicle. This could allow a criminal to gain access to the corresponding IT environment and modify it to run malicious code.
Communications: Some functions communicate with the SIM card inside the vehicle via SMS. Violating this communication channel makes it possible to send “fake” instructions, depending on the level of encryption adopted by the administrator. In the worst case, a criminal could replace BMW communications with his own instructions and services.
The study also examines Internet connectivity and leading applications in the Spanish automotive sector. In addition, it analyzes business models and future trends for connectivity platforms. The report, which analyzes 21 different car models, has reached the following conclusions:
- There is a lot of fragmentation in the areas of operating systems, connectivity, and applications.
- Free services have time limitations: many manufacturers only offer free subscription for a certain period of time
- There are coverage issues, as many online services require a 3G connection
- Data usage: Some users will have to pay for additional data
- Voice prompts: Used by most models, as it is one of the safest ways to control connectivity.
The study was carried out by IAB Spain in collaboration with Applicantes, Motor.com and Kaspersky Lab.
About IAB Spain
IAB Spain ( Interactive Advertising Bureau ) is the Spanish association of digital advertising, marketing and communication companies . With more than 200 members, it represents 95% of the sector in Spain and is the only association that includes representatives from media agencies , digital agencies , advertising companies, websites, social media , blogs , advertising networks, browsers , consultants, television, radio, publishing companies, e - mail marketing , mobile , IT solution providers, etc. Its main objective is to promote the digital market in Spain. IAB Spain is a member of the global association IAB international . More information is available at https://www.iabspain.net .
About Kaspersky Lab
Kaspersky Lab is the world's largest privately held computer security company. The company is among the top four security providers in the world*. Throughout its 16-year history, Kaspersky Lab has been pioneering security innovations, providing cost-effective solutions to protect consumers, small and medium-sized businesses and large enterprises. Today, Kaspersky Lab operates in 200 countries and regions around the world, providing online security to over 300 million users. For more information, visit www.kaspersky.com .
- Based on IDC’s “Worldwide Endpoint Security Revenue by Vendor” ranking for 2012. Ranking included in IDC’s “Worldwide Endpoint Security 2013–2017 Forecast and 2012 Vendor Shares” report (IDC #235930, August 2013). The report included a ranking of software vendors based on revenue from sales of computer security solutions in 2012.
Kaspersky Contact
Konstantinos Memos
Advocate/ Burson-Marsteller
210 6931000
kmemmos@advocate-bm.gr
