Link to the Paper: http://www.autosec.org/pubs/cars-oakland2010.pdf
Summary:
This paper explains the transition of how cars which were once entirely mechanical devices have made the transition into the 21st Century to become more digital and computerized. The reality of this transformation is the number of subsystems that contain computers. When the first computers were introduced into cars it was in response to regulation such as the Clean Air Act which required pollution control. But since then most cars now have 60-70 Electronic Control Units which contain thousands of lines of code. This paper looks at how to exploit 2, 2009 vehicles in 3 different states.
What I didn't like:
The study only explored 2 cars - both of which were form 2009 which begs the study could be outdated
The study noted that modern EV's are much more prone to having a lot more ECU's given their specific hardware requirements but never really flushed this out more. I think this was bad given that EV's are supposed to be the future of automobiles.
The study says its not clear if auto designers made their systems in expectation of an adversary - I think that this could have been solved with a very easy survey that could have been included in this study
Study is really general ie "Looking forward, we discuss the complex challenges in addressing vulnerabilities in the context of the automotive ecosystem" (loosely quoting)
The study is very specific and doesn't go after trends in the industry when noting cyber security challenges - this means its very hard to draw lessons for the general industry
What I liked:
The study paints a clear story of why cybersecurity hasn't kept up. We went from no computers to 50-70 computers really fast.
The study really explained a lot of the different ECU's and how they differ in. a bunch of different cars
The study explores a lot of different facets of car security which aren't just the automatic go to's when you think of a car ie just onstar
The study makes sure to consider actors such as "car tuners" who might not be malicous actors but want more custom control of their car
The study explored experiments on the car in 3 different settings ie (Bench, Stationary, and on the Road)
Points for Discussion:
How easy it is to infiltrate ECUs as a regular user?
Are modular cars a thing right now? How long until I see one on the road in mass production?
Has regulation in the car industry which led to the introduction of ECU's been a positive or negative in the realm of cybersecurity?
What actions in the short term can be taken to help secure cars against future attacks?
How long until we see cars as a major vector for cyber attacks against people?
New Ideas:
How hard would it be to patch ECC bugs with over the network updates
Given the vulnerabilities in cars is it best for some critical systems to stay analog on cars?
Would consolidation of the vehicle software industry improve cybersecurity for automobiles?
Can OnStar be used to leverage new cyber protections for cars - can we learn anything from how they keep their data safe
How does the necessity for cars to be serviced by 3rd parties compromise the vehicle's security?