Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

3/5/2019
10:55 AM
Steve Zurier
Steve Zurier
Slideshows
Connect Directly
Twitter
RSS
E-Mail
50%
50%

6 Questions to Ask While Buying a Connected Car

Here are six questions to keep in mind when you walk into the showroom to buy a networked car.
Previous
1 of 7
Next

Image Source: Adobe Stock: kinwun

Image Source: Adobe Stock: kinwun

Car manufacturers are quickly moving to a time when autos will be mostly, if not fully, autonomous. Meanwhile, new cars are packed with Bluetooth, cellular gateways, and Wi-Fi connectivity — which means they are open to security vulnerabilities.

In putting together this story, we talked to several experts who follow developments regarding the connected car, and just about all of them say there's still a lot in flux.

"There not a salesperson in a showroom anywhere who could answer even basic security questions," says Steve Hoffenberg, director of Internet of Things (IoT) and embedded technology at VDC Research. "But that doesn't mean consumers shouldn't be asking questions about security."

"People need to ask the car companies where they stand on security," says Kayne McGladrey, director of security and IT at Pensar Development and an IEEE member, who cites companies such as Apple and Google, which have made strong public statements on these matters.

When asked if the car companies have followed suit, McGladrey says, "Not really."

So, what are consumers to do? Security pros may know more about what to ask for, but there are thousands, even millions, of consumers who simply don't know where to start. Read these six tips to get an idea of what you should be thinking about when you step into that showroom and the salespeople start selling you on a connected car.

 

Steve Zurier has more than 30 years of journalism and publishing experience and has covered networking, security, and IT as a writer and editor since 1992. Steve is based in Columbia, Md. View Full Bio
 

Recommended Reading:

Previous
1 of 7
Next
Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
REISEN1955
50%
50%
REISEN1955,
User Rank: Ninja
3/5/2019 | 3:10:38 PM
IoT Devices
Another consideration - my 2014 Honda CRV has a built in GPS navigation system, easy to use and extremely helpful.  Yes questions about it of course but my wife's NEW 2018 CRV has gone to the IPhone for the global positioning service and it's not easy to setup either.  We live with the voice of Siri now.  But now we have an external internet device directly connected to the internals of the car, another entry point through the phone which raises a new family concerns - the phone itself, as always - the interface to the car (physical cable but wireless through the phone) and any external vulnerabilities through GPS ----- which is why I like the 2014 better.  Besides Siri is a bitch and my old car has a nice pleasant lady.  She probably talks to me too on the POS system at Kroger and in hosted meeting rooms too.  (Who is, by the way, this elusive female voice?  She has to make a ton of money).
Munjero
100%
0%
Munjero,
User Rank: Apprentice
3/7/2019 | 1:05:01 PM
Re: IoT Devices
Voice of Siri:  no, not a lot of money, she had no idea that her voice was going to be used for Siri:  https://www.huffingtonpost.ca/2013/10/04/voice-siri_n_4043134.html

 
RyanSepe
100%
0%
RyanSepe,
User Rank: Ninja
3/8/2019 | 9:32:57 AM
Re: IoT Devices
I guess sometimes you never know the popularity something will have until it comes to pass. Otherwise, she would have lawyered up and protected that ubiquitous voice.
bangbakat
50%
50%
bangbakat,
User Rank: Apprentice
3/9/2019 | 1:00:14 PM
Re: IoT Devices
very nice
szurier210
50%
50%
szurier210,
User Rank: Moderator
3/13/2019 | 12:58:17 PM
Re: IoT Devices
Just as follow-up, I have been shopping with my son for a new car over the past few days. I found the salespeople to be monumentally unware of the technology they are selling. I think Apple CarPlay is cool technology, though some may think the hard-wired USB connectivity is old school versus a wireless option. This is a major point: If you read the reviews, Apple and the car companies were going for safety first over convenience. So now with CarPlay there is a way to use Siri to ask for calls and verbally send texts without taking your eyes off the road. As a step toward a more automated experience that is huge. Some of the reviewers complained that they couldn't stream videos when their wives went into a store, but that's not a big deal. Others complained that Siri still can't read back emails. All in due time. For now, it's really great that CarPlay is basically a platform that you can update by simply updating your iPhone's iOS. I checked with Apple Support and they told me to also check with the dealer to see if there are any firmware updates on the car stereo from time to time. If anyone else has any other observations based on using a connected car, please share. I'm feeling like the public is very vulnerable so the more tips and insights we can offer people the better. 
Mcmoore08
50%
50%
Mcmoore08,
User Rank: Author
3/13/2019 | 3:55:06 PM
confidential info
Good posting here! This is especially true where someone thinks they are having a classified conversation and it is ok through the bluetooth within their car. Your car is NOT a SCIF.
Commentary
How SolarWinds Busted Up Our Assumptions About Code Signing
Dr. Jethro Beekman, Technical Director,  3/3/2021
News
'ObliqueRAT' Now Hides Behind Images on Compromised Websites
Jai Vijayan, Contributing Writer,  3/2/2021
News
Attackers Turn Struggling Software Projects Into Trojan Horses
Robert Lemos, Contributing Writer,  2/26/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: Your new device is too complex. Me stick with iWheel.
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-27940
PUBLISHED: 2021-03-03
resources/public/js/orchestrator.js in openark orchestrator before 3.2.4 allows XSS via the orchestrator-msg parameter.
CVE-2021-21312
PUBLISHED: 2021-03-03
GLPI is open source software which stands for Gestionnaire Libre de Parc Informatique and it is a Free Asset and IT Management Software package. In GLPI before verison 9.5.4, there is a vulnerability within the document upload function (Home > Management > Documents > Add, or /front/documen...
CVE-2021-21313
PUBLISHED: 2021-03-03
GLPI is open source software which stands for Gestionnaire Libre de Parc Informatique and it is a Free Asset and IT Management Software package. In GLPI before verison 9.5.4, there is a vulnerability in the /ajax/common.tabs.php endpoint, indeed, at least two parameters _target and id are not proper...
CVE-2021-21314
PUBLISHED: 2021-03-03
GLPI is open source software which stands for Gestionnaire Libre de Parc Informatique and it is a Free Asset and IT Management Software package. In GLPI before verison 9.5.4, there is an XSS vulnerability involving a logged in user while updating a ticket.
CVE-2021-27931
PUBLISHED: 2021-03-03
LumisXP (aka Lumis Experience Platform) before 10.0.0 allows unauthenticated blind XXE via an API request to PageControllerXml.jsp. One can send a request crafted with an XXE payload and achieve outcomes such as reading local server files or denial of service.