Cyberattacks on Software-Defined Vehicles – Mike Pedrick, Nuspire

This is texturing TV. Hey guys. Thanks for the throne.

We're here with Mike Patrick who is vice president of cyber security Consulting for new spire and we're talking about cybersecurity and vehicles specifically all those software-defined vehicles that are running around out there Mike. Welcome the show. Thank you.

Thanks for having me. How big an issue is this becoming in terms of cybersecurity for all these vehicles because we are noticing that many of them are dependent upon software than ever. And the question becomes is this just a nuisance where somebody is trying to hack into my entertainment system or is this getting more serious?

Well, it's it's definitely more serious than I then I think it would have been in the 80s when we were worried about our radios going missing. For example, you know, there's a couple of things to unpack here. The first is that a vehicle today represents not just Transportation, but also insight into you know, our personal lives access to our home so on and so forth, right the the opportunity cost of not having our vehicle available to us to go to work etc.

Right. There's a lot more going on there. I think then then a lot of people realize so the in terms of Threat Vector.

There's the safety component what happens if somebody Takes Over Control my vehicle and disables the breaks or you know modifies the navigation system such that I don't end up where I'm supposed to be and therefore and in danger of being robbed Etc. I do find it interesting. That there is still interesting and novel vectors for stealing cars themselves today.

For example, there's a recent state of attacks on cars whereby folks are removing headlights. For example, anything that gives them ready access of the exterior or the vehicle to the can bus to send a message to the ECU that permits them access to the vehicle. Then they can subsequently steal the vehicle and typically they either get stripped down or they get sent overseas to to other locations.

So there's a there's a lot going on here not least of which are privacy concerns. You know the vehicle knows where you've been the vehicle is tracking where you've been and so can anybody else who gets access to those those persons particular systems? Beyond stealing the vehicle has anybody actually hacked into a vehicle while somebody's driving.

I think there's been examples of that. There's also you know, there was a case I think several years ago of somebody taking control over. I believe I don't want to call any manufacturers out and be wrong, you know, but there was you know instances where people were taking care of taking control vehicles while they were in motion, but I think there was a proximity component that you couldn't be that far from the vehicle.

It certainly wasn't to an attack that you could launch from another continent. You had to be close by it by to that vehicle. But listen, it's coming right.

I mean as soon as we have vehicles that are semi-autonomous and capable of being controlled through systems that we trust OnStar for example has been out there for decades. We may trust OnStar, but if anybody is able to intercept that signal we're having for fun. Take care take over the same systems then and there's there's opportunity there.

A lot of our issues today would application security can easily be traced back to the fact that the developers are building software and they don't have a lot of cybersecurity expertise. It was an elective and many of them didn't take it in. The first place.

Is that any better in the vertical industry like Automotive maybe or things pretty much the same everywhere? Well, I think the automotive industry takes you know protection of lives. Seriously.

I think that they take it seriously that they want to protect their intellectual property. I think part of what's working against us from a protection perspective is not just that this is a huge attack service. I mean, there are so many vehicles out there on the road but there's also the sometimes perpendicularity of purpose between having a secure vehicle having a safe vehicle and having a vehicle that provides the conveniences that we demand as as consumers, right, you know, if you told somebody we have to go back to the model where you have two keys one for the lock on the door and one for the ignition that vehicle would never sell.

Nobody would buy that car now. It's you know, I need to be able to use my phone as my key or I have to have a fob at Best in my pocket get into the vehicle push a button if I had to insert a key into the ignition. I'm not in there anymore or if I can't have my apple carplay or my Android auto To interface by phone between or between my phone and my device.

I'm sorry between my phone and my car that's a deal breaker. I can't I can't use either one of those things the way I want to anymore. So there's there's that also leads to issues with integration issues with modularity where the security of the vehicle in its entirety is not subject just to the controls and protections that are baked into the vehicle itself, but also vulnerabilities that may exist in somebody else's source code.

You know again Apple carplay Android auto integration with various apps that we rely on a regular basis or think we need as part of our Lives vulnerabilities for those applications could potentially compromise Vehicles. There's a lot of time spent on making sure that we're not just protecting the occupants from external attack, but also, you know protected the vehicle from ancillary systems that are installed or associated with the vehicle. Of course, the government takes a lot of interest in anything that involves public safety especially roads.

Do you think we're going to see more regulations in this space? What might that look like and how cognizant are they of these issues? I think we're probably gonna see a tremendous amount of legislation.

And I think there's going to be one area that I think is going to be impactful to the automotive space sooner rather than later is centered around privacy is again the control of personal data. We already have vehicles that are by necessity monitoring drivers for drowsiness or inattentiveness, you know for those those smart cruise control features where it's not just controlling the speed of the vehicle, but also steering the vehicle, you know provided again, you're paying enough attention to intervene if there's an issue that the car is incapable of picking up on straight away or responding to straight away. I'll say and so that lead that runs into runs right up against we have monitoring mechanisms inside the vehicle monitoring occupants, theoretically in direct violation of their privacy.

In fact Tesla just recently ran a foul of You Know video sharing within their organization that feature clips that Recorded not just around the vehicles but inside the vehicles that could potentially be I will say embarrassing to the occupants of those those clips were out on the internet. So again, that's a privacy concern straightaway, especially with you know, mounting legislation and that space Do you think that the folks who provide insurance for these vehicles are going to weigh in because they might say well we're going to charge more for a vehicle that perhaps is viewed as being less secure than another it was it was several years ago at this point. It was very nearly 20 years ago that we were already starting to see out on the Enthusiast Market where insurance agents were monitoring people who were buying new powerful vehicles and finding their way to local race tracks Etc.

And if your insurance agent found out that there was an issue with the car that you'd been in an accident or something and you were anywhere near a racetrack at the time that claim was going to be immediately denied now again that was decades ago and that would have theoretically required somebody to have been at the same event monitoring who was coming in the gates. We don't need that anymore. We have all the Telemetry information.

We need in the vehicle native to the vehicle. And so I absolutely think that insurance providers are going to start leaning into that technology to say. Hey your average speed over the last six months was X or you know, based on the locations that you travel.

This is outside the bounds of normalcy. So, you know, here's what's going to happen your premiums accordingly and I I don't want to be too dismissive of that practice. I think it's there's probably value in conducting those operations, but certainly for those folks who who think they have some degree of autonomy and independence from those Telemetry data Gathering mechanisms.

It's gonna be a real Awakening. Course many people buy cars based on the ratings that they see. So do you think that cybersecurity will be incorporated into the ratings of the various Services out there as they evaluate one vehicle versus another I would like to I think it'll be a pretty it won't be the priority for the average person.

That would be for somebody like myself. I will candidly admit that I own a Tesla product that everybody looks at me with a side eye. You know, you're a cyber security professional and a privacy Advocate you own a Tesla product.

Are you kidding? So I just do what I can to mitigate the risk and you know go from there and I certainly it weighs into my decision-making process, but I think that It's it's pretty apparent that we're in the minority again convenience Trump's Security in the minds of the vast majority of folks. Now, if we start to find out again that there's you know, really blatant egregious of fronts to data privacy or consumer privacy on the part of Manufacturers.

I think the manufacturer on the whole could suffer accordingly, but it's going to be a pretty slow roll. I think through the market convenience will still be of the most important. Our achievable is all this going to be because if I look inside the vehicle, there are hundreds maybe thousands of processors and tons of software components and they all have dependencies to things that are both custom and things that are downloaded off the internet's that you can't really fix until the original developer fixes.

So how feasible is it to really expect these things to be fixed? Is that security? There's no utopian status of being secure.

It's a hygiene. It's a protocol. It's a way of life.

It's not a destination and especially in the automotive space. There's a lot of pressure on the owner of the vehicle, right? So for example, and this does go back as far as you know, as far as we can remember it was your responsibility if you park somewhere to lock lock the doors as you walked away from the vehicle, right you couldn't rely on the vehicle to lock itself.

Those days seem to be gone now too. We can walk away from most modern vehicles and they'll lock themselves. But again that that onus was on the the driver of the vehicle or the possessor of the vehicle to and lack certain things and and take certain risk mitigation measures.

So and I think that will always be the case. I think that we will always have some level of responsibility to risk mitigation. I also don't think that there's ever going to be a time where we should say that.

Any vehicle is going to be invulnerable that it's going to be impervious to any attack Vector. If you'd said to me 10 years ago that these were going to be uninstalling headlights and taking control of vehicles accordingly. I decided you were crazy.

There's no way that's not only is that an awful amount of effort awful lot of effort to go to just to steal a car but gosh, you know, that doesn't make any logical sense. But yet here we are right and again button up against the convenience aspect vehicles that leverage Bluetooth or near field communication for for Access gaining access to the vehicle. Um relays exist relays have always existed that we can increase that distance there accordingly such that if the owner of the vehicle is sitting in their home with their Bluetooth device and somebody institutes a relay then you know from the street level they can get access to that vehicle and drive off with it without even, you know, without any breaking in without any damage to the vehicle.

They can just make off of it. So I don't know. There's no perfect.

And we certainly don't want to let perfect get in the way of better. But you know again, I think a lot of the pressure is going to continue to be on on us as humans. Do you think there might one day soon be a recall because of cybersecurity issues will all get a message that says hey got to take your vehicle back to the dealer.

Absolutely. I think that's very possible. And I think it's just a matter of how you couch what is or is not a cybersecurity issue in the cybersecurity world.

We say Access Control violations, right? Somebody who is not you get gets access to data or systems or platforms that only you would have access to that's a that's an access control violation. We certainly have the same thing with vehicles.

You know, I have a key but if somebody made a copy of my key and I'm talking physical old school Keys think of like a 1972 Chevelle with a key, but if somebody makes a copy of that key that's unauthorized access right so couched that way we already have cybersecurity issues if any manufacturer has found to have very weak, you know. Evidence of negligence level week access controls to a vehicle. I think that would result in an immediate recall situation fortunately today.

It might also be as simple as an over-the-air update to the vehicle. You don't have to take into it take it into a dealer and it's automatically fixed the way we would do an operating system in our laptops tablets Etc. But yeah, I think that's I think that's imminent.

If not already there depending on how you look at the issues. All right. I'm not entirely sure about that because I have seen software updates the vehicles that require you to drop off the car for the entire day.

So there is absolutely that too, you know anecdotally very anecdotally there was a issue of Uncontrolled acceleration Toyota went through this. What does a 10 years ago now or 12 years ago and there was unfortunately folks that lost lost their lives as a result. but it was or trade in the media as being a technology issue a technology related issue, you know as we've gone from you know, throttle cable driven throttle plates to electronically controlled throttle plates.

Maybe it gets the wrong signal or it locks open whatever the case would be and then you get that unintended acceleration or certainly, you know, it stays open when you were trying to stop the vehicle. What it ended up being was very very low Tech the floor mats would get caught in the way of the the gas pedals and so the solution at the dealer via recall was to take an 8th of an inch off the bottom of the gas pedal that's not nearly as Sensational when it hits the news. So I think there's there's a good bit of you know, what we're facing and in the vehicle world that has direct parallels to the issues.

We've seen over and over and over again through well for as long as we've had vehicles All right, it's surprising but I think it was about a half a century ago that Ralph Nader wrote unsafe in any speed. Do we need an update to that famous work because it's a whole new digital age. Absolutely.

Yeah, try to imagine if somebody could via an API an unsecured or poorly secured API issue a command to the throttle body of a vehicle to just open and stay open indefinitely. That would be that would be terrible. All right, folks.

Well, you heard it here. It's a whole new way of driving and with it comes all kinds of new challenges and issues. We all got to think about but hopefully some bright minds are working on it as we speak.

Hey Mike. Thanks for being on the show. Sure.

Thanks for having me. Back to you guys in the studio.