Challenges of Software-Defined Vehicles – Curtis Yanko, GrammaTech

This is Techstrong tv. Hey guys, thanks for the throw. We're here with Curtis Yako from Grandma Tech, and we're talking about software defined vehicles and security, or actually the lack thereof.

Curtis, welcome the show. Uh, thank you. What exactly is the challenge we're looking at?

Because we are realizing, of course, that there's more software and more processors going into these vehicles, and some of it's embedded and some of it is over the air. And are we really thinking through the security issues as well as we might? Um, I mean, that's a great question and I, I think folks, uh, you know, are, are definitely gathering and, and having the conversations.

Uh, the question is, you know, are we far enough along? Are we mature enough and are we doing the right thing? So I'm hopeful, uh, but it's not to say there aren't challenges.

It seems harder to secure these environments because somebody's building a car and they're gonna release it on a certain date every year, and if they're laying on a particular function, um, it's a tough choice. You're not gonna sit there and say, well, I guess we'll roll the car back. I mean, so how do we know what the level of security that's being applied, and is this not a job for the fe heart?

Yeah, um, I mean, you're right. I mean, the, the cars are incredibly sophisticated. Uh, as we, you know, there's an old saying that, you know, we put a lot of software in these cars, and that software is gonna age like milk, right?

It, it does not get better with time. Uh, so it only becomes more and more, uh, vulnerable or, or, you know, potential of failure. And, and to mitigate that, we have to open up attack vector so that we can update it, which means other people can update it.

Uh, you know, so, so it's a, it's definitely a, a a challenging merry-go-round to get on. And, you know, the hope is that as you look across the merry-go-round, that horse on the other side is behind you and not in front of you. So, to your point about opening these systems up, a lot of this is over the air updates to navigation systems or whatever it may be.

Are all those things isolated from other components, or can malware, like other systems, start to move laterally through the vehicle? I don't have a good answer for that in terms of like, if there's a, you know, if everything's touching a bus, uh, I have a sense that there kind of is a, a fairly common bus, uh, in these systems. And, and so the actual impact isn't, isn't fully understood by myself, but, um, you, you gotta believe the potential's there, right?

Because the whole idea here is we're gonna invoke behaviors that people didn't anticipate. So you're right to focus on really what's touching and what's adjacent, because that's how, how things are gonna move through. Um, yeah, I, it, it's, it, you know, this is all growing, right?

These things are doing updates. I see lots of people on forums, their cars try to update and fail, and now their car is sitting there dead and stuff, right? You know, so there's a lot of growing paints going on with all of this.

Uh, ho hopefully we can get in front of it in a way that makes everyone safe. And as we head towards autonomous vehicles, you know, then, then like, you know, let's, let's just hope we, we get it right. Are the bad guys starting to figure this out themselves?

Because, you know, one of the rules of cybersecurity is if you can imagine it, it means somebody's trying it. Yeah. Yeah.

I mean, there's definitely that you would assume. So I, it, it just comes down to what's the incentive or the motive? Is this something they're gonna sit on, you know, to, uh, very, uh, uh, precise attack, uh, on an individual or something like that?

You know, what's the real goal here is they go to just try and steal a bunch of cars and, and do that. Uh, it, it's hard to know, but I'm sure, um, you know, somebody's sitting on some zero days out there, uh, thinking about how they can, uh, best leverage them. What do we need to do with developers who are building software for these vehicles?

I mean, we've been talking about DevSecOps for a while, but is this a unique case of DevSecOps? Is are the developers really up to the task? What is the level of maturity?

That's a good question. I, I do think that level of maturity has grown. That's not a, that's not a brand new area.

So I, I think we are getting good at providing the developers the feedback they need to be successful very early in the process. Um, but time is the enemy again here. So even if our developers get it a hundred percent right, that thing still gets flashed.

It's gonna be put into a car for a year. Uh, you know, so we, it, it just doesn't stop there. But I, I think we're doing a good job of getting in front of it with the devs.

I think it's just that the tail never ends. And so the challenges never go away. You can't, you can't get it right and then wash your hands and walk away and say, okay, that one's perfect.

That's not, that's not an option. Can you imagine a world where we're gonna get maybe a recall notice telling us that we need to bring our car back in for a security update? I mean, is that gonna be part of the standard motion as we go along?

I would assume so. You, you have to assume. So, I mean, we already have mechanisms for recall notices as it is.

There's guidelines on, you know, when, when they have to do it. They're very targeted. You know, it's worth pointing out that the auto industry has done a as good a job of anyone as managing their, uh, supply chains and having a deep understanding of exactly which parts from which factories went into which vehicles.

So, uh, they can do very precise and efficient, uh, recalls. Um, but yeah, you know, they're gonna figure out sometime that they can't just do a quiet over the air update and they're gonna, you know, they're gonna have to plug in to make sure it works. And yeah, I can see, I can see this, uh, being a, a future recall, Do you think we might have accidents caused by security issues and software because somebody hacked into a system?

I mean, honestly, you know, the federal government, if somebody steals your data, they look at it one way, but if suddenly, you know, lives are being endangered because of security issues, that's a whole other conversation. Yeah, I think the risk is real. And I mean, it's not just, you know, it's automobiles, it's industrial controls, it's everything.

Uh, there, there's a saying out there that we're all trying to stay left of boom, right? Boom is what you're hinting at here, right? Where like, real physical damage could happen, lives could be lost.

Um, so, you know, so you're absolutely right. Um, I, I think it's, it's in the carts, uh, you know, but until it's in the news, it's just theoretical. Mm-hmm.

So what's your best advice to folks? What should they be doing today to kind of get ahead of all this? Uh, it depends on what hat you're wearing.

If you're a consumer, if you're buying these things, I, you know, I think you just gotta do your homework like anything else, and, and, and pay attention, right? Uh, be, you know, be aware of, of, of what's there. And, uh, it's ability to update and make sure it's updated.

You know, stay on top of it, you know, know that it's working after that, you know, for the, for the producers, I think they're doing the right things. You know, they're having, they're getting together and they're having open conversations and they're sharing information because they recognize that, you know, this is, uh, it's not about competitive advantage or intellectual property. This is trying to keep everybody, everybody safe and secure.

Um, so I, I think a lot of the right things are happening, uh, but like I said, you know, we don't know what we don't know. And, and, uh, until that happens, uh, we, we all hope that we're a step ahead and not a step behind. All right, sir, are you gonna be at the front of the line for buying one of these software to buying vehicles, or are you gonna wait a little while to see how all this turns out?

I keep one car that's extremely low tech. I have an op, a pickup truck that has virtually no technology in it, and I love that. But, uh, but my other car, uh, is, is much more sophisticated.

It's got all the kind of crazy sensor on it and stuff. I don't, I see it all as a beneficial and safety, but yeah. Do I recognize that these are very complex systems and things could go wrong?

Absolutely. But I can't live in fear either. So I dunno if I'll be the first in line, but, uh, but I'm also, I, I, I, uh, I don't overly analyze it like I do at my day job, but in reality, I get my car, I trust that it's gonna get me where I'm gonna go safely.

Are we reaching a point where, given all this complexity that we really can't build software without help from some AI capability to help us deal with all these cybersecurity issues? Have we just reached some point of departure where we can't really, um, rely solely on humans to go build these types of systems? Uh, it, it's, it's probably true.

I mean, you know, you're, where you're probably definitely getting to the point. Um, it's hard, you know, a car could have as many as, you know, a hundred plus different systems in it, and, and it's hard for any one person to keep their head wrapped around all of that. Um, we already divvy up the work into, you know, into silos, uh, and they all have to integrate.

But you're right. I mean, it, it couldn't hurt to have, uh, some overarching A I M L double checking our work. There's, I see nothing, but, uh, upside to that.

Uh, the thing is, it can only learn the things we teach it, and sometimes we're gonna have to learn those the hard way, uh, you know, before we can get in front of it. So, we'll, we'll see how that plays out. But, but I think we're definitely headed in that trajectory.

You know, I, I, I think it's impossible for people to comprehend the full scope of, of what's happening anymore. If you were a developer, would you head into this vertical industry or would you look somewhere else? Because this is a lot of stress, let's face it.

Uh, yeah. But, you know, I don't know if that stress isn't everywhere. Uh, you know, we're talking about it in this context, but we could have a very similar conversation and, and numerous other contexts.

Um, I do think it's an exciting industry. It's going, it's going through a transformation, and with that comes a lot of opportunity. Um, I personally don't have a lot of firsthand experience with it, but it looks like, uh, uh, as, as good as any as, uh, I can think of.

And, and it just seems to be going, you know, uh, electrical engineers gotta be excited, right? The cars are shifting from mechanical devices to now increasingly just electrical devices. So, so we're, it's going through a very transformative time and that with that should come a lot of opportunity and growth.

Hmm. Cool. Well, folks, you heard it here.

We don't quite know what to expect. It's gonna be a grand adventure as we go forward. But you might wanna make sure that your car, if you're driving it, has been updated recently with the most important patches available.

Curtis, thanks for being on the show. Thank you. Back to you guys in the studio.