N1005 IBM Research: connected cars

<br /><table cellpadding="0" cellspacing="0" class="tr-caption-container" style="float: left; margin-right: 1em; text-align: left;"><tbody><tr><td style="text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjoBilBMRj0vsduqNkFNrArOHaIrozSzQ7VOuVuE18ym2wYU__6XG4_-gHTmpkm_lv9rjZkwhGMDjhhxxgq5BdC3XttIQ5oU9-Sfx1FS4N7JRvXZR1MGYt9V1UDzIMmMcaTmofZovKVTcA/s1600/yairallouche.jpg" imageanchor="1" style="clear: left; margin-bottom: 1em; margin-left: auto; margin-right: auto;"><img border="0" height="240" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjoBilBMRj0vsduqNkFNrArOHaIrozSzQ7VOuVuE18ym2wYU__6XG4_-gHTmpkm_lv9rjZkwhGMDjhhxxgq5BdC3XttIQ5oU9-Sfx1FS4N7JRvXZR1MGYt9V1UDzIMmMcaTmofZovKVTcA/s320/yairallouche.jpg" width="320" /></a></td></tr><tr><td class="tr-caption" style="text-align: center;">Yair Allouche, IBM cybersecurity researcher</td></tr></tbody></table><div class="MsoNormal"><i><span style="font-family: "verdana" , "sans-serif"; font-size: 10.0pt; line-height: 115%;">Editor’s note: This <span style="font-family: "verdana" , "sans-serif";">article is</span> by Yair Allouche, researcher at IBM’s Cybersecurity Center of Excellence in Beer Sheva, Israel.</span></i></div><div class="MsoNormal"><br /></div><div class="MsoNormal"><span style="font-family: "verdana" , "sans-serif"; font-size: 10.0pt; line-height: 115%;">When my sister reluctantly upgraded to a smart phone, she was concerned that her location, contacts, personal calendar, and even banking information would be vulnerable to cybercrime. And she was right to be concerned. Most of us made the decision to give up a certain amount of security in exchange for the wondrous and practical applications that we can no longer live without. But how many of us are making that same conscious decision when we buy a new car? </span></div><div class="MsoNormal"></div><div class="MsoNormal"><br /><span style="font-family: "verdana" , "sans-serif"; font-size: 10.0pt; line-height: 115%;">IBM cybersecurity researchers in Israel are developing protection for connected cars<span style="font-family: "verdana" , "sans-serif";"> by</span> providing cloud-based intelligence to identify cyberattacks and suspicious activity that can endanger the car or its occupants. By offering car manufacturers a hybrid system that can collect, analyze, and cross-reference massive amounts of data from different vehicles, these researchers are bringing IBM’s security smarts from the data centers to the road<span style="font-family: "verdana" , "sans-serif";">.</span></span><br /><a name="more"></a></div><div class="MsoNormal"><br /><b><span style="font-family: "verdana" , "sans-serif"; font-size: 10.0pt; line-height: 115%;">What makes cars so vulnerable?</span></b></div><div class="MsoNormal"><br /><span style="font-family: "verdana" , "sans-serif"; font-size: 10.0pt; line-height: 115%;">Today hackers can get inside your smartphone and steal identities or personal information, access emails, or in extreme cases, hack into our banking apps. This in itself is pretty scary, but so i<span style="font-family: "verdana" , "sans-serif";">s the idea of</span> hackers t<span style="font-family: "verdana" , "sans-serif";">aking</span> over your car’s steering or braking systems. </span></div><div class="MsoNormal"><br /></div><div class="MsoNormal"><span style="font-family: "verdana" , "sans-serif"; font-size: 10.0pt; line-height: 115%;">Cars are now more digital than ever. And with <span style="font-family: "verdana" , "sans-serif";">more than</span> 100 distributed computer systems and 100 million lines of code in a typical car, there are plenty of components that need protection from hackers. Why do cars have 7 times more code than a Boeing 747? This comes primarily from the fact that today’s cars are assembled from different parts rather than manufactured from start to finish in one factory. As a result, the central door-locking mechanism could easily be the same component <span style="font-family: "verdana" , "sans-serif";">across several differ<span style="font-family: "verdana" , "sans-serif";">ent car manufacture<span style="font-family: "verdana" , "sans-serif";">rs</span></span></span>. This is problematic from the point of view of security because it means that any vulnerability breached in one car leaves the others open to hacking.</span></div><div class="MsoNormal"><br /></div><div class="MsoNormal"><span style="font-family: "verdana" , "sans-serif"; font-size: 10.0pt; line-height: 115%;">A <a href="http://blogs.barrons.com/focusonfunds/2015/09/08/americans-worry-about-falling-victim-to-cyberattacks-more-than-any-other-type-of-crime/" target="_blank">recent study</a> stated that <span style="font-family: "verdana" , "sans-serif";">by</span> 2018, 420 million automobiles will be connected, representing a huge growth over the 45 million connected vehicles in 2013.<i> </i>If the frequency of software threats for the auto industry is similar to that of PCs, the need for a sophisticated system that continuously remains updated becomes critical. By applying the expertise from the IT world to cars, IBM can offer a solution that never stops working and is always updated to deal with new types of attacks. </span></div><div class="MsoNormal"><br /></div><div class="MsoNormal"><b><span style="font-family: "verdana" , "sans-serif"; font-size: 10.0pt; line-height: 115%;">Int<span style="font-family: "verdana" , "sans-serif";">ra-<span style="font-family: "verdana" , "sans-serif";"> <span style="font-family: "verdana" , "sans-serif";">And Inter-<span style="font-family: "verdana" , "sans-serif";">Vehic<span style="font-family: "verdana" , "sans-serif";">le</span> Se<span style="font-family: "verdana" , "sans-serif";">curity</span></span></span></span></span></span></b></div><div class="MsoNormal"><br /><span style="font-family: "verdana" , "sans-serif"; font-size: 10.0pt; line-height: 115%;">At our Cybersecurity Center of Excellence in Beer Sheva, Israel<span style="font-family: "verdana" , "sans-serif";">, my</span> team of researchers decided to take a holistic approach<span style="font-family: "verdana" , "sans-serif";"> to <span style="font-family: "verdana" , "sans-serif";">car sec<span style="font-family: "verdana" , "sans-serif";">urity</span></span></span>. On one hand, we want to protect the car so that hackers can’t take over control<span style="font-family: "verdana" , "sans-serif";"> by</span> changing the car’s speed or direction, or applying <span style="font-family: "verdana" , "sans-serif";">t</span>he brakes, for example. On the other hand, we want to protect the data stored in and sent by the car’s systems. This data is used to send messages if the car was stolen, or if the driver had a heart attack, or simply about its speed and location. If abused by hackers, false data <a href="http://arxiv.org/pdf/1410.0151.pdf" target="_blank">can be injected</a> to create fake traffic jams that reroute vehicles, submit false information to insurance companies for pay<span style="font-family: "verdana" , "sans-serif";">-</span>as<span style="font-family: "verdana" , "sans-serif";">-</span>you<span style="font-family: "verdana" , "sans-serif";">-</span>drive packages, or even <span style="font-family: "verdana" , "sans-serif";">determine if </span>someone is not at home. Each digital component in the car that is connected to an outside system is vulnerable. </span></div><div class="MsoNormal"><br /></div><div class="MsoNormal"><span style="font-family: "verdana" , "sans-serif"; font-size: 10.0pt; line-height: 115%;">Most automotive security systems focus on in<span style="font-family: "verdana" , "sans-serif";">-</span>car security, similar to the way an anti-virus program might work on our home computer. This may include isolating the car’s infotainment and critical drive systems, or even the inter-car connections that are used to prevent accidents. <a href="https://securityintelligence.com/made-in-ibm-labs-solution-for-detecting-cyber-intrusions-to-connected-vehicles-part-i/">Our research technology</a> goes beyond the level of the individual car. By taking into account all cars' data channels, we can build a system that uses the synergy between the many sources. For example, by collecting and analyzing data from many cars, we can cross reference them to validate that the information coming in is correct. If one car says it’s traveling at 50 kmph and all the other cars near it are traveling 90 kmph then obviously something is not right. </span></div><div class="MsoNormal"><br /></div><div class="MsoNormal"><span style="font-family: "verdana" , "sans-serif"; font-size: 10.0pt; line-height: 115%;">Our goal is to offer security visibility by identifying suspicious activity and alerting the drivers or car manufacturers<span style="font-family: "calibri" , sans-serif; font-size: 11.0pt; line-height: 107%; mso-ansi-language: EN-US; mso-bidi-font-family: "Times New Roman"; mso-bidi-language: AR-SA; mso-fareast-font-family: Calibri; mso-fareast-language: EN-US;"><span style="mso-spacerun: yes;"></span></span></span><span style="font-family: "verdana" , "sans-serif"; font-size: 10.0pt; line-height: 115%;"><span style="font-family: "calibri" , sans-serif; font-size: 11.0pt; line-height: 107%; mso-ansi-language: EN-US; mso-bidi-font-family: "Times New Roman"; mso-bidi-language: AR-SA; mso-fareast-font-family: Calibri; mso-fareast-language: EN-US;"><span style="mso-spacerun: yes;"><span style="font-family: "verdana" , "sans-serif"; font-size: 10.0pt; line-height: 115%;"> — </span></span></span>even without having to install a specific component in the car. Our hybrid solution includes a component that sits in the car, but its intelligence sits in the cloud. This allows us to continuously protect the car and driver, remaining connected at all times and not only when the car goes in for servic<span style="font-family: "verdana" , "sans-serif";">e</span>. </span></div><div class="MsoNormal"><br /></div><div class="MsoNormal"><span style="font-family: "verdana" , "sans-serif"; font-size: 10.0pt; line-height: 115%;">This new solution also offers more control and transparency over what information is being collected about you from your car. Since the data collected includes information on where your car is every single second of the day, our technology will allow users to access services to help secure the car, but will only use personal identification if the driver agrees to share it.</span></div><div class="MsoNormal"><br /></div><div class="MsoNormal"><span style="font-family: "verdana" , "sans-serif"; font-size: 10.0pt; line-height: 115%;">By building a protective solution whose architecture allows it to adjust itself to new threats as they arise, we are giving the automotive industry a boost in the right direction. With IBM’s vast amounts of IT security knowledge and assets — alongside new algorithms from Research</span><span style="font-family: "verdana" , "sans-serif"; font-size: 10.0pt; line-height: 115%;"><span style="font-family: "verdana" , "sans-serif"; font-size: 10.0pt; line-height: 115%;"> — </span> we can offer true protection for connected cars and the data being collected from them. </span></div><div class="MsoNormal"><br /></div><div class="MsoNormal"><span style="font-family: "verdana" , "sans-serif"; font-size: 10.0pt; line-height: 115%;">Our next step<span style="font-family: "verdana" , "sans-serif";"> is</span> targeted at bringing the technology to market. We recently demonstrated a prototype solution for securing vehicles at the <a href="https://securityintelligence.com/events/66th-international-motor-show-2015-in-frankfurtmain/" target="_blank">International Motor Show</a> in Frankfurt, Germany.<span style="font-family: "verdana" , "sans-serif";"> Read m<span style="font-family: "verdana" , "sans-serif";">ore about the de<span style="font-family: "verdana" , "sans-serif";">m<span style="font-family: "verdana" , "sans-serif";">o,</span></span></span></span><span style="font-family: "verdana" , "sans-serif";"></span> <a href="https://securityintelligence.com/made-in-ibm-labs-solution-for-detecting-cyber-intrusions-to-connected-vehicles-part-i/">here</a>.</span></div>

Yair Allouche, IBM cybersecurity researcher Editor’s note: This article is by Yair Allouche, researcher at IBM’s Cybersecurity Center of Ex...