On Friday October 21, 2016, Dyn was subjected to two large Distributed Denial of Service (DDoS) attacks against their internet-address lookup Managed DNS infrastructure. The attackers used Mirai botnets launched from over 100,000 endpoints including cameras, DVRs and baby monitors to generate the significant volume of attack traffic. Affected services included Amazon, Spotify, Netflix and the New York Times.
Toyota recently sent a letter to the Federal Communications Commission (FCC) urging them to protect the 5.9 GHz band for Dedicated Short Range Communications (DSRC), the technology behind Vehicle-to-Vehicle (V2V)communications. Toyota noted that “The market leaders in Japan (Toyota), Europe (Volkswagen), and the United States (General Motors) have now either begun deployment of DSRC technology or announced a specific deployment plan for the technology.”
Tesla is the only major automaker that offers over the air (OTA) updates of both software and firmware. This allows Tesla to add new features like new voice commands, driver profiles or blind spot warnings that weren’t available when the car was purchased. It also allows them to fix bugs that were either causing the car to not function as intended or to discourage potential hackers by patching vulnerabilities soon after they are discovered.
The IoT, or the "Internet of Things," represents an exciting period of innovation in our lives. It describes a world of devices all connected to the internet, a world in which inanimate technology that we use and see every day is becoming smarter. It also predicts a continuous journey towards greater ease and convenience, a future in which technology interacts with us as much as we do with it. As you can imagine, this comes with both perks and drawbacks.
Over the past year, there have been a rush of Internet of Things (IoT) cyber-attacks, the most famous of which was the IoT Denial of Service attack on Dyn that disrupted internet traffic for a day. As more IoT devices are deployed, the frequency of serious cyber-attacks will only increase, and increase quickly. Many consumer IoT manufacturers are under intense schedule and cost pressures where a delay to add cyber security could be the difference between success and failure. Industrial IoT companies have a different problem, where long product lifecycles make security difficult to manage and almost impossible to retroactively deploy.
NTRU is a cryptosystem that uses a special type of polynomial ring. The underlying hardness assumption, known as the NTRU assumption, is that an inverse of a short polynomial (polynomial whose coefficients are very short compared to the modulus q) is indistinguishable from a uniformly random polynomial in this ring. This indistinguishability is crucial in designing a cryptosystem.
In July 2016, the Automotive Information Sharing and Analysis Center (Auto-ISAC) released "Automotive Cybersecurity Best Practices" for carmakers and their suppliers. This document expands on their "Framework for Automotive Cybersecurity Best Practices" published in January 2016. This is the first time the automakers have addressed cybersecurity in a formal manner and a strong sign they are treating hacker threats seriously.
OnBoard Security, the embedded security division of Security Innovation, recently commented on the US Department of Transportation’s Notice of Proposed Rulemaking (NPRM) on V2V communications. OnBoard Security strongly supports the establishment of the proposed regulation since the number of lives saved increases dramatically as the number of cars with V2V increases. Widespread penetration of the technology, and the corresponding prevention of deaths, can only be reached in a reasonable time with a mandate.
In September 2016, Tesla Motors issued an over-the-air software update to make its Autopilot system rely more on radar than cameras. This update was in response to a highly publicized crash in May 2016 in which a 40-year-old man was killed when his Tesla crashed into a turning tractor trailer. Tesla wrote in a blog post that Autopilot didn't detect "the white side of the tractor trailer against a brightly lit sky, so the brake was not applied." Without more information about the accident I can only speculate, but let me try to reflect on the problem and how security plays a role. The cause of the accident was that the camera did not detect the object because of natural/non-malicious blinding. I define blinding as the action of affecting the camera in a way that objects are not detected, either partial or full blinding. So, what does it say about the robustness of the system against blinding attacks? It says that Tesla's Autopilot apparently does not prioritize safety or does not do sensor fusion correctly, if at all.
Autonomous automated vehicles (AV), also known as self-driving cars, have been garnering a lot of press coverage over the past year, as automakers (Audi, Mercedes-Benz, GM, Toyota, etc.), Tier 1 suppliers (Delphi, Bosch, etc.), Universities (Oxford, Stanford, Parma, etc.) and technology companies (Google, Apple, etc.) have all made steps toward releasing autonomous cars in the not-too-distant future.