Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

10/25/2016
04:55 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

NHTSA Issues Cybersecurity Best Practices For Automakers

Focus is on limiting access to electronic components and what someone can do with that access.

The National Highway Traffic Safety Administration (NHTSA) has issued a set of cybersecurity best practices for connected cars.

Vehicle cybersecurity has captured the attention of safety experts in the wake of security researchers demonstrating how attackers can take advantage of vulnerable electronic components in modern connected cars to gain independent control of critical vehicle functions.

The most dramatic examples have been from security researchers Charlie Miller and Chris Valasek of Uber’s Advanced Technology Center, who as recently as this August demonstrated an attack in which they took over a 2014 Jeep Cherokee’s steering, accelerator, and braking system while the vehicle was moving.

Like the NHTSA's earlier research on the topic, the new recommendations contained in the 22-page report released this week are non-binding and meant to serve purely as guidance for automakers. 

But since the NHTSA’s recommendations are non-binding, it’s unclear how many automakers will implement them.

Many of the recommendations cover the things that automakers need to be focusing on during the manufacturing process like secure development practices, information sharing, vulnerability disclosure, and reporting, incident response, and self-auditing.

But a big section is focused on some of the fundamental cybersecurity precautions that automakers need to deploy in the vehicles themselves. The emphasis here is on restricting access to critical components in connected vehicles and on limiting what someone with access could do with it.

For example, the NHTSA wants manufacturers to consider limiting or even eliminating the access that developers have to the Electronic Control Units (ECUs) in their vehicles. Often such access is facilitated via a debugging port or serial console, the NHTSA said.  

"Any developer-level debugging interfaces should be appropriately protected to limit access to authorized privileged users," the NHTSA said. Merely hiding connectors, traces, or pins that enable debugging access does not provide security, the report noted.

Similarly, the NHTSA wants automakers to implement controls that limit the ability for anyone to modify firmware in a vehicle’s electronic components. For example, by using digital-signing technologies, manufacturers can make it much harder for attackers to make an unauthorized modification or to install rogue software.

Physical and logical segmentation and isolation of critical electronic components should be implemented to limit the damage from external threats, the NHTSA said.

Some of the proof-of-concept attacks against connected vehicles have involved researchers first exploiting a weakness in one component—like a vehicle’s entertainment system—and then using that entry point to try and access other components.

By separating processors, vehicle networks and external connections to the extent possible manufacturers can limit and control the pathways that an attacker might use to escalate privileges, the NHTSA said in its recommendations.

"Strong boundary controls, such as strict white list-based filtering of message flows between different segments, should be used to secure interfaces," it noted.

The NHTSA also wants automakers to consider include limiting access to vehicle maintenance diagnostics; controlling access to firmware via encryption, for example; and limiting the number of network ports, protocols, and services in vehicles.

Major automakers, cognizant of the concerns over cybersecurity at the government and regulatory levels, and anxious to stave off regulation, have already taken steps to address securing cars at the industry level.

For example, the 12-member Alliance of Automobile Manufacturers, comprised of companies like Ford, General Motors, Chrysler, and Toyota, is currently working on an industry-wide effort to identify emerging threats to connected vehicles and measures for mitigating them.

Related stories:

  

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 9/17/2020
Cybersecurity Bounces Back, but Talent Still Absent
Simone Petrella, Chief Executive Officer, CyberVista,  9/16/2020
Meet the Computer Scientist Who Helped Push for Paper Ballots
Kelly Jackson Higgins, Executive Editor at Dark Reading,  9/16/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-14180
PUBLISHED: 2020-09-21
Affected versions of Atlassian Jira Service Desk Server and Data Center allow remote attackers authenticated as a non-administrator user to view Project Request-Types and Descriptions, via an Information Disclosure vulnerability in the editform request-type-fields resource. The affected versions are...
CVE-2020-14177
PUBLISHED: 2020-09-21
Affected versions of Atlassian Jira Server and Data Center allow remote attackers to impact the application's availability via a Regex-based Denial of Service (DoS) vulnerability in JQL version searching. The affected versions are before version 7.13.16; from version 7.14.0 before 8.5.7; from versio...
CVE-2020-14179
PUBLISHED: 2020-09-21
Affected versions of Atlassian Jira Server and Data Center allow remote, unauthenticated attackers to view custom field names and custom SLA names via an Information Disclosure vulnerability in the /secure/QueryComponent!Default.jspa endpoint. The affected versions are before version 8.5.8, and from...
CVE-2020-25789
PUBLISHED: 2020-09-19
An issue was discovered in Tiny Tiny RSS (aka tt-rss) before 2020-09-16. The cached_url feature mishandles JavaScript inside an SVG document.
CVE-2020-25790
PUBLISHED: 2020-09-19
** DISPUTED ** Typesetter CMS 5.x through 5.1 allows admins to upload and execute arbitrary PHP code via a .php file inside a ZIP archive. NOTE: the vendor disputes the significance of this report because "admins are considered trustworthy"; however, the behavior "contradicts our secu...