Threat identification tool addresses cybersecurity in self-driving cars
Connected and automated vehicles are what researchers call a cyber-physical system, with components in the “real” and virtual worlds. The safety stakes are as high as these systems are hard to protect. Connected and automated vehicles will face familiar threats, and new ones, the report describes.
They will be vulnerable to those that regularly disrupt computer networks, like data thieves of personal and financial information, spoofers who present incorrect information to a vehicle, and denial-of-service attacks that move from shutting down computers to shutting down cars.
In addition, new threats unique to automated vehicles themselves emerge—hackers who would take control over or shut-down a vehicle, criminals who could ransom a vehicle or its passengers, and thieves who direct a self-driving car to relocate itself to the local chop-shop, for example.
Finally, there are security threats to the wide-ranging networks that will connect with autonomous vehicles—the financial networks that process tolls and parking payments, the roadway sensors, cameras and traffic signals, the electricity grid, and even our personal home networks.
“It might seem convenient for an autonomous car that gets within 15 minutes of your home to automatically turn on your furnace or air conditioner, open the garage and unlock your front door,” the researchers write. “But any hacker who can breach that vehicle system would be able to walk right in and burglarize your home.”
The new threat identification model
To demonstrate the insights the new model can provide, the researchers used it to examine vulnerabilities in automated parking—both parking assist technology and the more advanced remote, self-parking. They determined that the most likely attacks are: a mechanic disabling the range sensors in park-assist or remote parking in order to require additional maintenance, and an expert hacker sending a false signal to your vehicle’s receiver to turn off remote parking. Both received sixes on the researchers’ 10-point scale, with 0 being lowest probability.
At the same time, the type of attack that would have the most impact would be a knowledgeable thief spoofing your remote parking signal in order to steal your car. This type of attack received a 7 on the researchers’ scale of impact.
“Without robust, fool-proof cybersecurity for autonomous vehicles, systems and infrastructure, a viable, mass market for these vehicles simply won’t come into being,” said Huei Peng, Mcity director and the Roger L. McCarthy Professor of Mechanical Engineering. “Funding this kind of research is a critical part of Mcity’s mission to help break down barriers to widespread deployment of connected and automated vehicle technology.”
— Read more in Andre Weimerskirsch and Derrick Dominic, “Assessing Risk: Identifying and Analyzing Cybersecurity Threats to Automated Vehicles,” M|City, University of Michigan (January 2018); the thread model is also detailed in Derrick Dominic et al., “Risk Assessment for Cooperative Automated Driving,” Proceedings of the 2nd ACM Workshop on Cyber-Physical Systems Security and Privacy (October 2016)
