Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

10/25/2016
04:55 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

NHTSA Issues Cybersecurity Best Practices For Automakers

Focus is on limiting access to electronic components and what someone can do with that access.

The National Highway Traffic Safety Administration (NHTSA) has issued a set of cybersecurity best practices for connected cars.

Vehicle cybersecurity has captured the attention of safety experts in the wake of security researchers demonstrating how attackers can take advantage of vulnerable electronic components in modern connected cars to gain independent control of critical vehicle functions.

The most dramatic examples have been from security researchers Charlie Miller and Chris Valasek of Uber’s Advanced Technology Center, who as recently as this August demonstrated an attack in which they took over a 2014 Jeep Cherokee’s steering, accelerator, and braking system while the vehicle was moving.

Like the NHTSA's earlier research on the topic, the new recommendations contained in the 22-page report released this week are non-binding and meant to serve purely as guidance for automakers. 

But since the NHTSA’s recommendations are non-binding, it’s unclear how many automakers will implement them.

Many of the recommendations cover the things that automakers need to be focusing on during the manufacturing process like secure development practices, information sharing, vulnerability disclosure, and reporting, incident response, and self-auditing.

But a big section is focused on some of the fundamental cybersecurity precautions that automakers need to deploy in the vehicles themselves. The emphasis here is on restricting access to critical components in connected vehicles and on limiting what someone with access could do with it.

For example, the NHTSA wants manufacturers to consider limiting or even eliminating the access that developers have to the Electronic Control Units (ECUs) in their vehicles. Often such access is facilitated via a debugging port or serial console, the NHTSA said.  

"Any developer-level debugging interfaces should be appropriately protected to limit access to authorized privileged users," the NHTSA said. Merely hiding connectors, traces, or pins that enable debugging access does not provide security, the report noted.

Similarly, the NHTSA wants automakers to implement controls that limit the ability for anyone to modify firmware in a vehicle’s electronic components. For example, by using digital-signing technologies, manufacturers can make it much harder for attackers to make an unauthorized modification or to install rogue software.

Physical and logical segmentation and isolation of critical electronic components should be implemented to limit the damage from external threats, the NHTSA said.

Some of the proof-of-concept attacks against connected vehicles have involved researchers first exploiting a weakness in one component—like a vehicle’s entertainment system—and then using that entry point to try and access other components.

By separating processors, vehicle networks and external connections to the extent possible manufacturers can limit and control the pathways that an attacker might use to escalate privileges, the NHTSA said in its recommendations.

"Strong boundary controls, such as strict white list-based filtering of message flows between different segments, should be used to secure interfaces," it noted.

The NHTSA also wants automakers to consider include limiting access to vehicle maintenance diagnostics; controlling access to firmware via encryption, for example; and limiting the number of network ports, protocols, and services in vehicles.

Major automakers, cognizant of the concerns over cybersecurity at the government and regulatory levels, and anxious to stave off regulation, have already taken steps to address securing cars at the industry level.

For example, the 12-member Alliance of Automobile Manufacturers, comprised of companies like Ford, General Motors, Chrysler, and Toyota, is currently working on an industry-wide effort to identify emerging threats to connected vehicles and measures for mitigating them.

Related stories:

  

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Mobile Banking Malware Up 50% in First Half of 2019
Kelly Sheridan, Staff Editor, Dark Reading,  1/17/2020
Exploits Released for As-Yet Unpatched Critical Citrix Flaw
Jai Vijayan, Contributing Writer,  1/13/2020
Microsoft to Officially End Support for Windows 7, Server 2008
Kelly Sheridan, Staff Editor, Dark Reading,  1/13/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
The Year in Security: 2019
This Tech Digest provides a wrap up and overview of the year's top cybersecurity news stories. It was a year of new twists on old threats, with fears of another WannaCry-type worm and of a possible botnet army of Wi-Fi routers. But 2019 also underscored the risk of firmware and trusted security tools harboring dangerous holes that cybercriminals and nation-state hackers could readily abuse. Read more.
Flash Poll
[Just Released] How Enterprises are Attacking the Cybersecurity Problem
[Just Released] How Enterprises are Attacking the Cybersecurity Problem
Organizations have invested in a sweeping array of security technologies to address challenges associated with the growing number of cybersecurity attacks. However, the complexity involved in managing these technologies is emerging as a major problem. Read this report to find out what your peers biggest security challenges are and the technologies they are using to address them.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-7227
PUBLISHED: 2020-01-18
Westermo MRD-315 1.7.3 and 1.7.4 devices have an information disclosure vulnerability that allows an authenticated remote attacker to retrieve the source code of different functions of the web application via requests that lack certain mandatory parameters. This affects ifaces-diag.asp, system.asp, ...
CVE-2019-15625
PUBLISHED: 2020-01-18
A memory usage vulnerability exists in Trend Micro Password Manager 3.8 that could allow an attacker with access and permissions to the victim's memory processes to extract sensitive information.
CVE-2019-19696
PUBLISHED: 2020-01-18
A RootCA vulnerability found in Trend Micro Password Manager for Windows and macOS exists where the localhost.key of RootCA.crt might be improperly accessed by an unauthorized party and could be used to create malicious self-signed SSL certificates, allowing an attacker to misdirect a user to phishi...
CVE-2019-19697
PUBLISHED: 2020-01-18
An arbitrary code execution vulnerability exists in the Trend Micro Security 2019 (v15) consumer family of products which could allow an attacker to gain elevated privileges and tamper with protected services by disabling or otherwise preventing them to start. An attacker must already have administr...
CVE-2019-20357
PUBLISHED: 2020-01-18
A Persistent Arbitrary Code Execution vulnerability exists in the Trend Micro Security 2020 (v160 and 2019 (v15) consumer familiy of products which could potentially allow an attacker the ability to create a malicious program to escalate privileges and attain persistence on a vulnerable system.