5 of 5 - IoT-4-Automotive: Understanding the Insecurity Surrounding Connected Cars

This blog is part?5 of a 5 part series on smart cars. The first blog was ‘The Self-Driving Automobile Revolution is Already here’ . The second was ‘ The Future of connectivity- 7 reasons to connect your car’. ?The third was ‘Baseline Planning for Connected Cars’ . The fourth was Baseline planning for Connected Cars. Your Automotive Strategy : A sixth was added as a bonus later on the Security in Self Driven Cars . In this blog we talk about a very critical, nd sometimes scary, subject as we design and build our digital enterprises, build our IoT connected products and services and venture deeper into the hyper connected world of the future. The critical discussion is about Security, or the lack of it, in?most things we?use today, and how it can be a matter of life and death in the wrong circumstances.?As the cars are getting?smarter the fastest this must become a hyper concern for manufacturers and designers. When reading this do apply it to your digitization plans, your industry, products and services.??

When everything gets connected to everything, then everything matters. When everything gets connected to everything then everything needs to be ultra-secure, because hackers can come in from anything. By the time we connect most things to most other things it will no longer be possible to humanly secure these assets. We will, by then, have deployed global automated Security sentinels that will continue to keep everything safe.?

When things get connected to the Internet then hackers can use those very insecure things to breach the national or international systems. This was proven yet again on

The huge dyn cyber-attack that breached the internet on October 21, 2016 disabled a number of major websites and is deemed to be one of the largest cyber-attacks ever. It was basically an IoT attack using these unsecure IoT sensors as proxies for the attack. It basically weaponized the insecure IoT

The problem is that the record may not hold for very long.

In every home, phone and office we have various connected devices like cameras, digital videos and video monitors that mostly sit without any security protocol. This is the world of IoT sitting naked. By leveraging this lack of security, the hackers infect them with malicious ware and switch them on at the same time to paralyze huge portions of the internet with two of junk data. For some this breach was just a stark demonstration, to most others it was a call to reality about our untethered IoT devices and a call to action. Remember the world today does not have just a handful of unsecured IoT devices. We have millions of them and we are creating and installing millions more. The recent hack puts a lot of weight on all things IoT, IoE and autonomous.

The new?global competitive battleground is not only for the IoT connectivity and the digital enterprise, but also about keeping the entire ecosystem secure, i.e. from one edge to the other.

But let’s get back to our IoT for cars and not get lost in the overall security dilemma, as that is a whole another topic that can totally distract us. When Joshua Brown, 40 from Canton, OH was killed driving?Tesla S in the worlds first fatal accident of a self-driving autonomous car, question have arisen to all kinds of things. Starting from the autopilot where the cars speed was 10 miles above the speed limit, to the technical failures of the automatic braking system that never happened. In this first accident, a truck turned left and on to the path of the Tesla, which was under self-driving mode. The Tesla never ‘saw’ the truck, it hit the trailer, went under the truck, passed right through and veered off to the right of the road striking two fences and finally a power pole. My apologies for the gory details but this is the first time we are questioning a whole bunch of IoT and autonomous systems. In this particular case we can be fairly certain that the accident was not caused by a security breach but still these thoughts lurk in the recesses of our minds when we extrapolate this accident and events to the future.

An average car manufactured in 2005 had?under a 100 sensors. Cars today have approximately 180+ sensors. I could bet, still an assumption, that modern smart cars have somewhere between 450 to 600 sensors and these are only increasing on a daily basis. I do know that Nascar’s had close to 2,500+ sensors in 2011. A lot of these sensors are now communicating to smart phones, iPads and other devices and hubs, or clouds?via built in wifi’s. Most of these sensors currently have not been adequately secured. So each of these sensors represents a potential security vulnerability in This blog is part 4 of a 5 part series on smart cars. The first blog was ‘The Self-Driving Automobile Revolution is Already here’ . The second was ‘ The Future of connectivity- 7 reasons to connect your car’. ?The third was ‘Baseline Planning for Connected Cars’ . In this blog we talk more about?the fundamental thinking?that?automotive customers are undertaking in their pursuit of?strategic blueprinting their automotive digital journey. When?reading this do some mental gymnastics and think as to?how this information?translates into your industry and company for building your own future?‘Digital Enterprise’ with hyper-connected products and services. just your, and my, one car. Current vulnerability 1:1 cars.

Your average phone has over 30 sensors and most of them are not secured. So when you patch up your smart car to your smartphone are you increasing conveniences or vulnerabilities.

As we put more and more sensors into all the cars, we need to simultaneously undertake a responsibility to simultaneously make them safer too. The cars we build today will become future personal, or public, vehicles that need to be hyper secure, else the lack of security will have too many ramifications. The big question hovering above IoT right now is the ability for a mere individual hacker entering for the shock value or a foreign power with intent to actually harm to an individual occupant in the car. The question gets answered when we send the president of some major company, or the US, alone in an autonomous car. If not the president, then why me?

StarterThoughts

Hackers do not have plans: They are psychopaths and there is no machine that can predict a psychopath as they are both random and mad people. They are illogical and bent on random destruction. When these psychopaths get sponsored by states they get a quasi-legitimacy, and security,?by?some rogue government but are still social psychopaths. The 10/21 botnet hack was like putting a social post that anyone that comes to a particular retail point between 5pm and 7pm will each get $20,000 cash on the spot. So suddenly you get 10,000 customers in a location that normally gets 15. Thus, normal customers cannot get their regular services as the retail point simply crashes due to hyper crowding. That is how the hackers used IoT devices.

You cannot make smart products with dumb processes, standards or in dumb factories: It all depends who you talk to about IoT or IoE. There is huge chasm between the two corporate schools of thought [1] Its just another marketing Hype, to [2] It’s the greatest revolution after computers that is transforming the very definition of industries, products and services. Who is the smart one out of these two is a subjective discussion? However, what we can empirically state is that more and more companies are starting to deliver connected and IoT enabled products and services. Step 1 in building smart products is to thing digital and smart. Step 2 if to build smart processes and standards, Step 3 is to build a smart plan that will then Step 4 build smart products. This is where proactive leaders are starting to see true strategic ROI on their investments. IoT enablement is allowing companies to get new and better answers to existing questions. However, the real benefit of the new connected IoT products is not in just doing the same old thing faster, better or cheaper, but in getting real-time answers to questions they never even knew existed. This is the power of digital transformation, the true goal of the digital enterprise and the future for the IoT enabled automobiles.?IoT-4- Automotive is all about two basic fundamentals, A new digital platform and real-time informatics.

A New Platform: IoT and smart digitization?can only be accomplished on a?new platform approach so as to deliver what prior M2M technologies could never deliver. The platform consists of Sensors, Networking, Clouds, Data Generators, Connectivity, Application and solution development, Big-Data Lakes, filters and High Speed Real-Time Analytics engines like SAP HANA.

Informatics: We need to take a leap from Reports to Analytics and then from Analytics to Informatics. IoT delivers a wealth of real-time information, which when coupled with Big-Data, Filtering and alerts. It has the ability to deliver decision metrics that were impossible to even conceptualize before. The days of 100 page reports or 20 page analytics are now gone. We now need spot Informatics that enable key stakeholders to take critical decision on a single view. The Analytics could be segregated into Business Benefit Informatics and real-time dashboards basically providing Business Benefit and usable analytics on [1] New Answers to old unanswered questions; [2] New Answers to Old Questions; [3] Old Answers to Old Questions; [4] New Answers to New Questions

Welcome to the Security Dilemmas

As simple as: Security experts have been doing all kinds of hacks but Chris Valasek and Charlie Miller grabbed headlines when they published how easy it was to hack into the new smart cars. In fact how easy it is to hack into any car that was made after 1997. These two hacked into a Toyota Prius and a Ford Escape by using standard laptops plugged into the vehicles diagnostic ports. This allowed the two to manipulate the brakes, headlights, and steering.

I myself have installed a device called ‘Automate’ that puts all the diagnostics on my smart phone it simply plugs into the standardized diagnostic port available in most cars. . The key here is that my ‘Automate’ is already IoT enabled and can communicate with my iPhone. How easy, or difficult will it be for a hacker to ride this connectivity and take over the car from afar or nearby.

In the Healthcare area in 2014 Scott Evrens and his team demonstrated how easy it was to hack into ICU medical devices that are attached to critical patients. They demonstrated that they could easily manipulate connected devices, change controlled drug dosage and alter drug infusion pumps and connected defibrillators.

In Utilities Homeland Security identified a flaw on the shared grid that allowed their team to launch simulated attacks that could compromise the energy grid. And all this is just the proverbial ‘tip of the iceberg’…

Harmonized or Proprietary:Scenario: Someone important is driving an autonomous car. An institutional hacker and assassin can track where the car is, track the speed it is traveling, can see the oncoming and same direction traffic, see what lane the car is on and more. They enter the car autonomous navigation system on the quiet and then at an appropriate moment, the hacker turns the car head-on to an oncoming big-truck and destroys the car, its occupants and all evidence in one single successful hack. Possible – hopefully not.

Security protocol is possible the biggest of all dilemmas is the decision to harmonize all auto security on to a single global protocol or for each manufacturer to keep their own proprietary security protocol. Both sides have their pros and cons. Proponents of the harmonized model support a global effort to secure all IoT devices with a common secure protocol. Opponents insist that then no device will be secure as every foreign government and supplier will have the potential to either break in or create their own back-door for entry. I for one support the proprietary security model for keeping vehicles safe and secure but for the leap into IoE we will need some kind of harmonized, connected, shared communications else we shall never be able to fully leverage the potential of this technical leap. What it will end with is probably areas that will remain proprietary and other shared areas where it may be harmonized. Right now it seems proprietary will rule for the high end cars.

Manual or Automated:Scenario: Hackers enter a protected asset like the car of an important dignitary. Their sentinel algorithms silently identify the hack, take over the hack, identify the hacker, divert them into a digital simulation labyrinth while sending a high-speed rogue tracer to their core device. At the same time they alert the sentinel HQ about the ongoing hack so additional resources can be diverted to identify and destroy. A barrage of global spiders spread and converge to identify all core devices across all proxy devices. Once it identifies the core device, or devices, it?firstly downloads any critical data while leaving behind a worm that then commences to initially activate all camera and video monitors at the site and record everyone, then proceed to totally destroy the hard drive and the device and all other devices undertaking similar activities and crisps the center. Possible- Not yet but coming soon. In a world heading for IoT and IoE automation is a no brainer. In a world heading for autonomous cars autonomous security sentinels too becomes a no brainer.Just like Darpa funded the autonomous car that gave birth of the google and thus tesla cars, so too Darpa has an ongoing initiative called the ‘Cyber Grand Challenge’ that has this singular challenge. It was initiated in 2013 and in 2014 3 companies walked out with $3.75 million as prize money. To win this challenge contestants will have to create an automated digital defense system that can identify and ix vulnerabilities all on their own. The reminder to step up this development came with the 10/21/16 dns hack that was tracked by Level 3 Communications (a company I used to work with some time ago). They, working with flashpoint, pointed out the current vulnerabilities of the IoT devices in this case. Very soon look for vital automated firepower as a form of active deterrent of hacking and automated security. This is a replica of 2005 when the winning teams of the autonomous vehicles drove 7 hours to complete a 132 mile journey on their own and started the autonomous car revolution. 2005 strted the IoT-4- Automotive revolution that we are writing about and that is becoming a reality all around us, 2014 will thus start the revolution of ‘Mayhem’ and ‘Sentinels’ that is just about starting around us.

What all to Secure:Scenario: The car that needs to be hacked has over 300 sensors. Out of them 32 are wifi enabled. Out of these 32 only 3 are secured, while all the rest are presumed to be dumb data generators that can be leveraged as the need arises. For a hacker each of these unsecured sensors is a torjan entrypoint into the total vehicle and with a very little effort one can enter the communications and practically take over the ‘smart-car. For the rest just use your imagination.?The internet is everywhere. Sensors are there in every car today. In fact my car, and yours too, probably has over 300 sensors today. Very soon these sensors will get connected, some already are. First to a hub and then to everything. IoT is already there in every vehicle but right now we have dumb, disconnected data generators. In some cars these sensors are already getting wifi enabled and starting to communicate. This condition will soon get into every automobile. So along with planning how we design our cars we shall also need to immediately start planning how to secure what all these sensors and devices. The primary areas of Security attack today, in our current state of IoT, are identified as the ability to [1] attack a device, [2] attack the communication between the device the master (i.e. the network), and finally [3] attack the masters. A device is basically your ’Thing’, as in the ‘Internet of Things’, where we install the various sensors and actuators that collect the data. A device could be your Fit-Bit, Your phone or your car. Each device could have a single to thousands of sensors. Communications is done via secure gateways and network devices currently dominated by Cisco. Finally, the Masteris the current IoT communication hub where the Things and communications get consolidated and are then tracked, analyzed and managed.

An attack on the device: The recent 10/21/16 dns hack was a hack on various devices like a security camera that sits on all smart phones, modern displays and homes. All these cameras sit in a state of almost no security. The 10/21 hack simply activated all these various cameras and devices and created a lot of noise that broke the back of the dns provider in the US. Devices also carry a value based trust, i.e. a smart grid assumes that the connected meter readings are true and secure. A hacker could randomly change the truth and create total havoc along the billing systems. In our smart car the vehicle is the device and each sensor has the potential to be hacked and cause havoc for the driver that could range from a practical prank to an assassination. Attack on communications: The communications hack starts with monitoring all communications and networks and then intercept data and alter it for whatever reasons. For example, a hacker can track a residential home usage to see when someone is home or not to facilitate an unauthorized entry. It could then ride on the cameras in the house to ascertain their intent. In our smart car the vehicle could be prevented from communicating a critical defect or alert via changing the truth and a car could be directed along roads that are not part of the destination as a prank or with conspiratorial consequences.?Attack on the Masters: Attack on the manufacturers data centers, servers, clouds, service providers are all forms of disruption and disconnection. When there are a hundred thousand cars on the road each depending on the master to keep them safe and on track an attack on the master can create local, national or global havoc for any connected device manufacturer.

Building a secure foundation: The prime goal for all connected devices, for all companies undertaking digitization and building the future digital enterprise, for all enterprises building a connected IoT environment we have to be able to break down the confusion into small steps of manageable administration. What we need to build as a team is Trust on all our components, devices, communications and master.

Securing the Device: In our case, we need to first and foremost secure the vehicle. It has to have a reliable identification and authentication, that is associated with the manufacturers naming standards and cannot be hacked or replicated randomly, that has a ‘sentinel’ based secure communication bridge between the device sensors, the communications framework and the master. This would be enabled by device level ID certifications issues to each individual device at the point of manufacturing and preferable imbedded into the device to facilitate and protect authentication protocols. \

Secure the communications: Working with reliable global partners to secure all internal communications, then communications to the driver smart devices and finally all communications ot the various clouds, servers and masters. This will need transparent and seamless encryption of all access to sensitive and non-sensitive data and sensors. Remember in an IoT world hackers will enter from the non-sensitive sensors into the system so everything matters. The key here is encryption of data and communications in motion, as most of this data will be created when the car is moving. One way is to lock down all sensitive sensors and data unless there is a critical alert. Even then only let the alert pass through the secure encrypted firewall. The second is to protect the data as it travels across clouds and IoT connection points from device to Master and back.

Secure the Master:?This is the hub of communications, data, trust and everything we are reviewing from a security point of view. It is the mother load of all the IoT connectivity and communications. A trusted master must ensure that all internal communications and every communication from master to device and from device to master remains trusted and secure at all times. There is a need for encrypted code signage of all firmware/software updates powered by secure digital certificated with multiple layers of authentication. It must be further secured with SSL communication with devices and sensors therein all along the field and in motion using SSL certificated. All data must be protected in perpetuity with encryptions. This includes data at rest in our big-data lake encryptions and also data in motion with encrypted communications.

Remember Machines have no Ethics: We have been traveling down a path of programs and algorithms and until recently these consisted only of the machine simply doing what it was programmed to do. In the last decade, we have entered the world of machine learning, which put simply is a machine being fed a lot of data and it then making up its mind on what works and what does not. Machine learning gives machines the ability to inject large amounts of data and then undertake the optimal path for their decision. Over time and with human assistance the machines get better and better with their decision capabilities but it is important to remember that machine learning today is in a black-box. These machines only take decision based on prior decision matrixes and there is no human ethics or values attached to their decisions. These machines can have their own biases and when some of this machine logic is somehow reset it can only obey the instructions without thought, ethics and or remorse whatsoever. I hate to think what happens in our autonomous weapon system that are often driven by machine logic, but we should be concerned in how our cars behave and think from an overall morality, ethics and security point of view.

Finally remember ‘When everything is connected to everything, then everything matters’

PS there is a bonus blog coming shortly. An unusual #6 of 5 – The 10 commandments of Digital Transformation

?????????????????????????????????????????????????????????????...ooOooo...

About the Author: Hari Guleria?is a global Analytics thought leader having working with two leading electric car manufacturers enabling their operations, analytics and decision systems. He has a?passionate focus on Business Excellence in?‘Analytics for the Digital enterprise’. He currently works as the?VP SAP HANA Digital Solutions at PrideVel in Santa Clara, CA, in the heart of the Silicon Valley.?PrideVel is a global SAP HANA and Cisco partner with offices across the US and offshore facilities in India.?

Prior to this Hari was Director for SAP HANA Solutions at HP services responsible for the Americas.?Before that he was the Director for SAP HANA with HCL-Axon for North America and before that he worked with SAP in their Value Realization Group covering North America. His current focus is on delivering ‘Highest Quality at the Lowest Cost’, where quality and true business benefits are never negotiable.

Hari is the author of ‘BI Valuenomics- The story of meeting business expectation sin BI’ a book far more relevant today than it was in 2010 when it was published.

He is currently working with Bill Inmon the father of Data Warehousing and TR Palle the Global Business Architect at Genentech/Roche to release a new book on ‘Analytics in the digital Era.

Hari has been the ‘C’ level strategy lead, mentor and solution architect for some of the world’s largest and most complex BI platforms. In the last 20 years he has consulted for many CIO’s at Fortune 100 companies worldwide. Currently he is the solution lead for a net new S/4 HANA implementation in the US.

Hari routinely works with customers as their Business Solutions Architect- as the layer between business owners, SI vendor partners and the core delivery teams for?assuring SAP and SAP HANA Business Value Attainment or BVA.??Hari has over 35,000 hours of BI, 17,000 hours of HANA an outlier score of 3.5 for BI and 1.7 for HANA. Hari comes with a platinum level background of SAP BW, BWA and SAP HANA. He also consulted in SAP SD and MM. Prior to SAP he comes with over 9 years of Sr. Business Management experience with major European multinationals.?Hari may be contacted at [email protected]