The number of reported incidents on cyber attacks on the global automotive transportation system grew by some 50 percent last year, according to a report issued last month by Upstream Security, provider of automotive cloud cybersecurity solutions based in Tel Aviv, Israel.
In a 28-page publication entitled “Global Automotive Cybersecurity Report 2019,” the company said the number of reported industry cyber attacks has grown six-fold in the four years from 2015 through 2018. Last year also marked the first time, the company reported, that criminal hacks outnumbered attacks conducted by researchers to test the security of connected vehicles.
Upstream noted while there were just 60 reported cyber attacks last year, many go unreported. It also said and that a single attack can affect thousands of vehicles, companies and consumers and cost more than $1billion. The report predicts that the number will continue to grow very rapidly over the next three years, as criminal hackers become more familiar with connected systems and the means by which to hack become easier and cheaper to obtain.
According to the report, there have been 170 automotive cyber attacks over the last nine years, with automakers the most frequent target. They were followed, in order, by Tier One Companies (companies that sell components directly to OEMs) and then fleets, ride-sharing companies, and fleet management companies. Train, car rental, car sharing, and insurance companies as well as auto dealerships have also been targeted.
Until last year, so-called “white hat” attacks by researchers outnumbered “black hat” criminal attacks by far. But in 2018, Upstream said criminal hacks exceeded researchers’ attacks for the first time, and by a wide margin.
Attacks can occur both through physical connections, like the onboard diagnostic port (OBD), or remotely via wireless devices. The report also noted that last year wireless hacks accounted for 91 per cent of all black hat attacks. While wireless attacks can be launched from a short range, Upstream said the Internet and mobile phone systems are being used to launch long-range attacks from as far away as another country, raising the specter of possible terrorist attacks.
As automobiles become increasingly connected and operate by computerized subsystems, the number of possible access points has increased. Today, according to the report, there are 12 different “vectors” for attacks. The leading is computer servers, which accounted for 21 percent of all attacks over the last nine years. That was followed by remote keyless entry systems (19 percent), the OBD port (10%), mobile apps and infotainment systems (7 percent each), cellular networks (5 percent), Wi-Fi (4 percent), and sensors (3 percent).
• Driver fraud (5 percent).
“This new category of incidents can be just as devastating as black hat attacks. While the individuals who find these vulnerabilities might not be intentionally malicious, in terms of data privacy, compliance and customer privacy, the consequences are the same [and] your business may be liable” under reigning privacy laws and regulations.