OnBoard Security InSights

Secure Crypto Key Management for Automotive

Posted by Gene Carter on Nov 1, 2017 12:21:38 PM

Car makers use cryptographic keys for a variety of purposes, including Over-The-Air (OTA) software updates, security immobilizers, inter-module communications, and Vehicle-to-Everything (V2X) communication security. Key Management Systems (KMS) are very complex, as the manufacturer has to manage dozens of keys for each car model, both at production and when new components are introduced during repairs, and they must maintain these keys over the long lifetime of a car. Key Management is a daunting task.

Read More

Topics: Cyptography, Automotive, Embedded Security, Autonomous Vehicles, Cyber Security, Research, Connected Vehicles, IoT,

Broadening Support of DSRC for V2V Safety

Posted by Gene Carter on Oct 2, 2017 12:10:17 PM

Toyota recently sent a letter to the Federal Communications Commission (FCC) urging them to protect the 5.9 GHz band for Dedicated Short Range Communications (DSRC), the technology behind Vehicle-to-Vehicle (V2V)communications. Toyota noted that “The market leaders in Japan (Toyota), Europe (Volkswagen), and the United States (General Motors) have now either begun deployment of DSRC technology or announced a specific deployment plan for the technology.”

Read More

Topics: Automotive, Internet of Things, V2X, Cyber Security, V2V, Connected Vehicles, DSRC

Why Don’t More Cars Update Their Software Automatically?

Posted by Gene Carter on Sep 20, 2017 3:41:43 PM

Tesla is the only major automaker that offers over the air (OTA) updates of both software and firmware. This allows Tesla to add new features like new voice commands, driver profiles or blind spot warnings that weren’t available when the car was purchased. It also allows them to fix bugs that were either causing the car to not function as intended or to discourage potential hackers by patching vulnerabilities soon after they are discovered.

Read More

Topics: Automotive, Internet of Things, V2X, Autonomous Vehicles, Cyber Security, Connected Vehicles

UK Offers Cyber Security Guidance to Automotive Industry

Posted by Gene Carter on Aug 17, 2017 8:37:00 AM

Recently, the UK government released "The key principles of vehicle cyber security for connected and automated vehicles." This guidance document provides key cyber security principles for use by the automotive industry and its suppliers. This follows the US Government's guidelines that were issued last fall.

Read More

Topics: Automotive, Autonomous Vehicles, Regulation, Cyber Security, Connected Vehicles

The country’s largest V2X implementation – Securing New York’s Connected Vehicle Pilot

Posted by Gene Carter on Jul 20, 2017 9:25:00 AM

In September 2016, the U.S. Department of Transportation (USDOT) awarded three Connected Vehicle (CV) Pilot Deployment Programs: New York City (NYC), Tampa and Wyoming. The CV Pilot Program will test and operationalize cutting-edge vehicle to vehicle (V2V) and vehicle to infrastructure (V2I) technologies, including in-vehicle wireless, mobile devices, and roadside equipment that have the potential to reduce accidents, save lives, improve productivity, enhance mobility, and lessen the environmental impact of city traffic. The NYC CV pilot will feature an estimated 8,000 vehicles outfitted with V2X equipment, including 5,850 taxis, 1,250 MTA vehicles, 400 UPS trucks, and 500 city vehicles. There will be approximately 350 roadside units installed at Manhattan and Brooklyn intersections and on FDR drive. Additionally, 100 vulnerable road user (pedestrians and bicyclists) devices will be deployed to study the effectiveness of V2X technology in reducing NYC's high rate (5 times the national average) of crash fatalities involving pedestrians.

Read More

Topics: Automotive, Privacy, V2X, Embedded Security, Cyber Security, V2V, Connected Vehicles

Eliminating the Need for Bidirectional Connectivity for V2V Certificate Updates

Posted by Gene Carter on Jul 14, 2017 8:45:00 AM

Certified Reproducible BCAM System will be presented at ACM WiSec 2017

Read More

Topics: Automotive, V2V, BCAM, ACM, SCMS, Research

What Cyber Security Should be Required in a Car?

Posted by Gene Carter on Jun 20, 2017 11:04:36 AM

On June 14, 2017, the US Senate Committee on Commerce, Science, and Transportation convened a hearing titled "Paving the Way for Self-Driving Vehicles."  During the nearly 2.5-hour session, senators and expert witnesses discussed a wide-range of topics regarding autonomous vehicles, including insurance, access for the disabled, impact on safety and drunk driving, etc. The hearing consisted of several polite exchanges of ideas and plans, until Senator Ed Markey pressed the witnesses on their thoughts on mandatory Federal Cyber Security regulations in automotive.

Read More

Topics: Automotive, Privacy, Autonomous Vehicles, Regulation, Cyber Security

Automotive Cybersecurity Best Practices

Posted by Gene Carter on Apr 17, 2017 4:58:39 PM

In July 2016, the Automotive Information Sharing and Analysis Center (Auto-ISAC) released "Automotive Cybersecurity Best Practices" for carmakers and their suppliers. This document expands on their "Framework for Automotive Cybersecurity Best Practices" published in January 2016. This is the first time the automakers have addressed cybersecurity in a formal manner and a strong sign they are treating hacker threats seriously.

Read More

Topics: Automotive, Internet of Things, V2X, Embedded Security, Autonomous Vehicles

Comments on the US DOT V2X Mandate

Posted by Gene Carter on Apr 13, 2017 1:12:08 PM

OnBoard Security, the embedded security division of Security Innovation, recently commented on the US Department of Transportation’s Notice of Proposed Rulemaking (NPRM) on V2V communications. OnBoard Security strongly supports the establishment of the proposed regulation since the number of lives saved increases dramatically as the number of cars with V2V increases. Widespread penetration of the technology, and the corresponding prevention of deaths, can only be reached in a reasonable time with a mandate.

Read More

Topics: Automotive, Privacy, Internet of Things, V2X, Embedded Security, Autonomous Vehicles

What the Tesla Autopilot Crash Tells Us About the Need for V2V Security

Posted by Jonathan Petit on Apr 6, 2017 3:08:29 PM

In September 2016, Tesla Motors issued an over-the-air software update to make its Autopilot system rely more on radar than cameras. This update was in response to a highly publicized crash in May 2016 in which a 40-year-old man was killed when his Tesla crashed into a turning tractor trailer. Tesla wrote in a blog post that Autopilot didn't detect "the white side of the tractor trailer against a brightly lit sky, so the brake was not applied." Without more information about the accident I can only speculate, but let me try to reflect on the problem and how security plays a role. The cause of the accident was that the camera did not detect the object because of natural/non-malicious blinding. I define blinding as the action of affecting the camera in a way that objects are not detected, either partial or full blinding. So, what does it say about the robustness of the system against blinding attacks? It says that Tesla's Autopilot apparently does not prioritize safety or does not do sensor fusion correctly, if at all.

Read More

Topics: Automotive, Internet of Things, V2X, Embedded Security, Autonomous Vehicles

Learn About the Latest in IoT Security from Our Team of Experts

 

OnBoard Security's security experts share insights on the latest security topics in:

  • Connected Cars
  • Autonomous Vehicles
  • Internet of Things
  • Quantum Computing

Subscribe to Email Updates

Recent Posts