Getty Images
"I think it's going to take something catastrophic, unfortunately, for the car manufacturers to really change their mindsets," David Kennedy, the CEO of TrustedSec, told Tech Insider. "We may be working with some of them, but believe me, they are far from [where they need to be] at this stage."
Tech Insider spoke with Kennedy - a former Marine who consults for companies and teaches offensive hacking to intelligence agencies - soon after a security researcher connected wirelessly to a Mitsubishi Outlander, allowing him to turn off its alarm and perform other functions.
That exploit followed similar findings from a pair of researchers who, over the past few years, have demonstrated hacks on a Ford Escape, Toyota Prius, and Jeep Grand Cherokee, ranging from being able to remotely kill the vehicle's engine or disable acceleration to taking over the power steering.
"It's essentially full control to do whatever you want to the car," said Kennedy, a hacker who works with three major automakers but could not specify which due to nondisclosure agreements. "Run it off the road, kill it in the middle of the freeway. Whatever you want to do is very much possible now."
Your high-tech car is still very much low-tech
Volvo
Newer cars on the road are being outfitted with turn-by-turn navigation, phone integrations with Android Auto or Apple CarPlay, and other high-tech gadgetry. But the overall technology in the car is still very low tech, and it was never designed with security in mind, Kennedy explained.
The underlying technology for most cars is called Controller Area Network bus, or CAN bus, a standard developed in the 1980s that allows all the different devices in the car to communicate with each other. It's the protocol that allows the cruise control system to talk to the engine, for example.
"Taking over cars is trivial. People think that the technology in cars is highly sophisticated," Kennedy said. "But CAN has been around since, the 1980's or 70's. And so, it's a very basic protocol and understanding it doesn't take a lot of effort."
"Underneath your car is an entire network that communicates with one another," Kennedy said. "What hackers are attempting to do is get access to that network."
Getting access to that network isn't all that difficult, especially when the most basic security practices aren't even implemented. Kennedy laughed when asked whether something as simple as a username and password was usually present.
And interestingly, it seems to be getting worse. As cars become more "connected" with onboard WiFi, cellular connections, or smartphone apps, that opens them up to many more vectors for attack. A great example of the threat - and the lack of basic security - came with a hack of the Nissan Leaf in February.
Security researcher Troy Hunt figured out that the Leaf's smartphone app interface (API) used only the VIN to control car features remotely without passwords. These features included seeing the car's current battery life, viewing times and distances the car had traveled, and being able to remotely manipulate the climate control.
The Leaf's app didn't have features like remote unlock of its doors, but a hacker could have easily run API commands to turn on a car's heated seats or air conditioning from the other side of the world that could leave a victim stranded. Nissan shut down the app soon after the vulnerability was disclosed.
"All of these things are new technology that are being introduced to these manufacturers. And the problem is, they're not designing it themselves," Kennedy said. "They have no idea whether or not any of these are introducing security exposures or whether or not there's problems with it."
'There is no security being done at all when a car is being built. Zero.'
AP
Kennedy says car companies recognize the possibility of hacking as a legitimate problem, but they simply don't have the institutional knowledge they need to test security. In an industry focused on manufacturing and sales processes, he explained, it's hard for them to look at the problem like a hacker would.
"I definitely think in the future it will become a major front of attack," Kennedy said of criminals or other bad actors hacking cars. One theory he floated was that cybercriminals might one day adapt ransomware - software that holds computers hostage for money - to work on cars.
But, manufacturers are apparently slow to proactively respond to the issue, despite recent legislation. Last year, two senators introduced a bill requiring the National Highway Traffic Safety Administration to issue new regulations that would require automakers to protect against unauthorized access to cars, or face fines.
"There is no security being done at all when a car is being built. Zero," Kennedy said. "It's usually being done after the fact, after a security researcher publishes information and then they try to figure out a way to get it fixed."
The Security and Privacy in Your Car Act of 2015 was introduced in 2015, but it has since languished in committee. The sponsor of the bill, Sen. Edward Markey (D-Mass.), did not respond to questions directed at his press office.
"When it comes down to it, it's a safety issue," Kennedy said. "When you lose control of a device that can end your life, that's a big deal."
Are car manufacturers doing anything about it?
Kennedy saying that "zero" security being done during the car manufacturing process is certainly a scary prospect. But is that really the case?
For starters, a recent FBI alert about car hacking vulnerabilities seemed to support that assertion, in a bullet point explaining what automakers were doing to mitigate the threat.
The alert didn't get into specific steps individual automakers are doing to address the issue, but it said many were sharing and collaborating on cyber best practices. It did not mention security testing being done during manufacturing, like crash testing that is required by law.
"What's interesting is you have safety rating tests that test the crash impact and the safety of the car," he said. "I absolutely think that security testing should be as well incorporated into the safety testing."
Tech Insider reached out to a number of major automakers to ask whether they had processes in place to test for security flaws. We also asked whether new cars were going through "cyber safety" tests similar to tests they would run to ensure seatbelts and airbags were functioning as designed.
Those two questions were posed to Toyota, General Motors, Volkswagen, Hyundai, Ford, Fiat-Chrysler, and Honda. Only three of the seven companies replied with emailed statements, though neither Toyota nor Fiat-Chrysler addressed the specific questions that were posed.
Toyota, for example, told TI it had "taken steps to make [its vehicles] more secure and to help reduce the risk of cyberattack" but offered no specifics.
Fiat-Chrysler said it is "committed to improving from past experiences and working with the industry and with suppliers to develop best practices to address these risks."
Still, General Motors did respond specifically to the big question at hand: Whether it was actually testing to see if its cars could be hacked.
"General Motors has incorporated a Secure Development Lifecycle process into its Vehicle Development Process where, utilizing risk-based methodology, vehicle components and systems are put through a series of security design reviews, static and dynamic analysis, fuzz testing, and ultimately penetration testing ahead of production launch," it said.
"Customer safety and security is our highest priority and these requirements, tools, and processes are incorporated to ensure the safety and security of the products we deliver."
There is at least one automaker that received high praise from Kennedy: Tesla. That is somewhat surprising since its cars are perhaps the most connected of any car on the road, with large screens, onboard computers, and the use of over-the-air software updates.
"I would say that Tesla is on the path to be the most secure car," he said. "I don't think that they are there yet, but I think they're definitely striving for it."