Cutting the Lifeline to the Fleet. Not on Upstream’s Watch.
Car manufacturers and managed fleets use a wealth of data to gain visibility into their connected cars and fleets. Smart use of telematics data, which is usually sent from the vehicle to a back-end telematics server, can improve safety and business efficiency as well as enable new services, maintain assets, reduce costs and liabilities, improve customer service and ultimately drive competitive advantage.
However, telematics servers don’t only collect data. They can also send remote commands to the car including: updating car software remotely, turning the engine on or off, locking and unlocking doors and many others.
It goes without saying that as telematics systems become part of the connected car ecosystem, if not properly secured they could be exploited by hackers for a wide range of purposes, with worrying implications for both the business and driver and passenger safety.
If hackers gain access to the telematics’ private network and impersonate the command and control server via one of the fleet vehicle’s attack surfaces: e.g. Wi-Fi, Bluetooth or SIM etc., they could potentially reach multiple vehicles within the fleet, inject remote commands to the vehicles, cut their lifeline communication to the real back-end server and even cut off an entire fleet’s communication. Injecting telematics commands into the fleet’s telematics communication channel could enable the hacker to:
- Remotely re-configure the vehicles Telematics Control Unit (TCU) to stop communications
- Send a “disconnect from carrier” command to vehicles to disconnect them from the cellular network
- Infect the fleet’s vehicles with malicious software
Imagine a ransomware attack on a connected fleet where hackers cut off all server-to-fleet communication, demanding ransom to resume services. For the hacker, such a ransomware attack on taxi mobility providers, on-demand services, car rental and car sharing firms and a range of commercial enterprises could be worth vast sums of money.
For the fleet’s operation, this kind of server impersonation hack could result in
- No remote command and control communication to vehicles
- No OTA software updates
- No data from vehicles
- No route planning
- No data services
- No location data
- No emergency services
For these mega businesses, this type of hack could result in potential serious long-term damage to their reputation and profits.
What needs to be done?
One way to secure the telematics channel is to use an encrypted VPN from the vehicle to the back-end server. However, implementing a VPN client on the vehicle side requires the installation of new software or hardware components into the vehicles themselves. To do this, close collaboration with OEMs throughout the entire design and production cycles would be required. These cycles take years to complete so they do not address the vulnerabilities of the millions of cars and fleets currently in production or already on the road.
Upsteam’s centralized cloud-based automotive cybersecurity platform can protect connected fleets from the above threat, even fleets that are already on the road today. Upstream’s solution connects to data feeds and the operational data center infrastructure – the most strategic location for true protection. This creates a demarcation point between the operational network (OT) and information network (IT). Upstream’s solution collects and inspects data from the telematics network and detects threats that target the protocol and application layer in a non-intrusive, friction-less manner. By looking at source and destination addresses, malformed command syntax, illegal commands, injection attacks and unauthorized network sources, Upstream can detect impersonated servers, generate an alert and activate a preconfigured workflow to even prevent the threat. Since the solution is cloud-based, non-intrusive and does not require any in-vehicle integration, it can even protect connected fleets that are already on the road today.
The security of telematics data channels should not be overlooked. Like any other critical business data, it should be protected with a comprehensive security platform which is able to piece together every piece of the security puzzle in one central location.
Learn more at upstream.auto
Upstream’s 2023 Global Automotive Cybersecurity Report
The Power Grid Must Be Protected, But Are EV Charging Stations Secure?
The widespread adoption of electric vehicles (EVs) depends on a robust and reliable network of charging stations. However, as the number of EVs on the…Read more
Navigating the Risks of Automotive Subscription Revenue Streams: Cyber Hacking Enables Bypassing, Tampering and Fraud
“A significant increase in hacking attempts by vehicle owners is expected, aimed at bypassing premium costs by manipulating systems fraudulently.” – Upstream Security 2023 Global…Read more
API Security Needs to be Integral in Automotive Threat Analysis and Risk Assesment
APIs enable the opportunity to innovate and improve services in the connected vehicle and smart mobility ecosystem. APIs are widely used in advanced features, services…Read more
NHTSA Updates US Cybersecurity Guidelines for Vehicles
Connected and software-defined vehicles technologies are on the rise, offering customers a better user experience, and introducing new monetization strategies for OEMs. Given the rising…Read more