With connected cars, zero trust is the best security advice

The road to fully autonomous vehicles has many obstacles but perhaps none more insidious than hacking.

Cybersecurity experts say improvements have been made but there’s much work to be done to secure vehicles before and during production as well as years later once they’re on the road. McAfee recently made headlines by hacking a Tesla enabled with Speed Assist and automatic cruise control and then convincing it to speed on its own owning to a modified traffic sign. The hacking team used a small piece of black tape to alter the speed limit sign so that the Tesla read it as 85mph instead of 35mph.

The two cars used in the research were owned by its employees –  a Tesla Model S and Tesla Model X, both of 2016 vintage employing MobilEye’s camera system, which the company claims has been widely deployed by its 27 automakers to 40 million vehicles. The McAfee blog notes it “did get access to a 2020 vehicle implementing the latest version of the MobilEye camera and were pleased to see it did not appear to be susceptible to this attack vector or misclassification, though our testing was very limited”.

The researchers noted that the latest Tesla models no longer use other MobilEye technology and “do not appear to support traffic sign recognition at all.” They add, however, that while MobilEye seems to have improved “the resilience of their product” that may be of little consolation for the existing fleet of Teslas since “the vulnerable version of the camera continues to account for a sizable installation base among Tesla vehicles”.

This so-called “model hacking” by McAfee is designed to identify and exploit weaknesses in machine learning algorithms “to achieve adverse results and identify upcoming problems in an industry that is evolving technology at a pace that security has not kept up with”. Cyber-security experts say these tests are instructive in finding and exploiting vulnerabilities but note the Teslas are not true Level 5 AVs and that the technology is changing.

Andre Weimerskirch, vice-president, cyber-security and functional safety at Lear Corporation, says these attacks are possible, targeting sign identification or V2X systems that broadcast a traffic light status as false but he asserts they may become less likely as redundancies are being employed. “It’s highly unlikely that self-driving vehicles will rely on a single sensor input for control mechanisms, whether that input comes from radar, LiDAR, camera or V2X. For instance, in the case of a manipulated stop signal, a self-driving vehicle might additionally use high-precision maps that include information about all traffic signs. After all, sometimes, stop signs also disappear under snow or behind low-hanging tree branches.”

To read the complete article, visit TU-Automotive.