Automakers have also been installing a  growing number of advanced technology features into vehicles to further  improve passenger safety as well as to enhance driver and passenger  convenience. For example, automakers may locate all ECUs on a single in- vehicle network or include one network to support safety-critical vehicle  functions, such as steering and braking, and another network to support  convenience and entertainment systems. Remote Attacks Involving Safety- Critical Vehicle Systems Could Have the Greatest Impact on Passenger Safety

		Cyberattacks through Direct and Remote Access Are Possible, but Remote Attacks Are of Most Concern to Stakeholders

Based on our analysis of research and industry stakeholder views,  modern vehicles contain multiple interfaces—connections between the  vehicle and external networks—that if not properly secured, can become  entry points—or attack paths—for cyber attackers. Cyberattacks through Direct Access

Selected industry stakeholders we interviewed identified several vehicle  interfaces that can be compromised through direct, physical access to a  vehicle (see fig. This port is mandated in passenger  vehicles by regulation for emissions-testing purposes and to facilitate  diagnostic assessments by auto dealers, repair shops, and car owners. In addition to being prevalent in modern vehicles, this port also provides  direct and largely unrestricted access to in-vehicle communication  networks. Thus, it can provide an attacker with sufficient access to  compromise the full range of a vehicle’s systems, including safety-critical  systems, such as the brakes and steering wheel. Cyberattacks through Remote (Short- and Long-Range Wireless) Access

Selected industry stakeholders we interviewed identified several main  interfaces that could be used to undertake a remote cyberattack through  short- or long-range wireless channels, such as built-in Bluetooth and  cellular-calling capabilities (see fig. The majority of these industry  stakeholders (23 out of 32) agreed that remote attacks are the most  concerning for passenger safety. Through such interfaces, the cyber attacker could  theoretically exploit vulnerabilities to access the target vehicles from  anywhere in the world and take control over the vehicles’ safety-critical  systems. A Variety of Key Practices and Technologies Are Available to Mitigate Vehicle Cybersecurity Vulnerabilities and the Impacts of Potential Attacks

		Key Practices Used by Other Industries Are Available for Use in the Auto Industry

Selected industry stakeholders informed us that a range of key practices  are available to identify and mitigate potential cybersecurity vulnerabilities  in vehicles. The concept of domain separation was also identified as a key practice by  the majority of selected industry stakeholders we spoke with (22 out of  32). Despite general agreement that domain separation  can be a very effective mitigation strategy, some stakeholders pointed out  that complete isolation or segregation is often not possible or practical  because some limited communication will likely need to occur between  safety-critical and non-safety-critical systems. Notably, most of the technologies identified by selected industry  stakeholders we spoke with cannot be added on existing vehicles; rather,  they must be incorporated into the vehicle design and production process,  which as we describe later in this report, takes approximately 5 years to  complete. Stakeholders Face Challenges Related to Vehicle Cybersecurity, Some of Which May Be Addressed by Industry-Led Efforts

		Stakeholders Identified Several Challenges Facing the Industry Related to Vehicle Cybersecurity

The most frequently cited set of challenges facing the industry in ensuring  vehicle cybersecurity—mentioned by 15 of the 32 selected industry  stakeholders we spoke with—was the lack of transparency,  communication, and collaboration regarding vehicles’ cybersecurity  among the various players in the automotive supply chain, as described  in the following examples. Some stakeholders also noted that it can be difficult for automakers to  oversee and exert control over suppliers’ software code. Another set of challenges cited by 13 of the 32 selected industry  stakeholders was the cost of incorporating cybersecurity protections into  vehicles. Similar to ISACs created for other  industries, such as the Financial Services ISAC, the Automotive ISAC is  intended to serve as a central hub for intelligence collection and analysis  and provide a forum for members to anonymously share threat and  vulnerability information with one another. Selected industry stakeholders we spoke with, as well as DOT officials,  generally expressed positive views regarding the potential effectiveness  of an Automotive ISAC. NHTSA Is Developing Guidance to Help Ensure Consistent Responses to Vulnerabilities

In November 2015, NHTSA officials informed us that they were  developing guidance to help automakers understand the agency’s  determinations—and to assist automakers in making their own  determinations—regarding the types of vehicle cybersecurity  vulnerabilities that would constitute a safety defect and, therefore, merit a  recall. As of July 2015, officials estimated that the agency  was about 3 years away from making a final determination about the  need for additional government standards or regulation in this area; thus,  such a final determination is not expected until at least 2018. NHTSA Has Not Yet Defined and Documented Its Roles and Responsibilities in Responding to a Vehicle Cyberattack

In its whitepaper NHTSA and Vehicle Cybersecurity, NHTSA states that  its goal is to “be ahead of potential vehicle cybersecurity challenges, and  seek ways to address or avoid them altogether.” As described above,  NHTSA has made progress in many areas in an effort to proactively  address potential cybersecurity threats to vehicle safety-critical systems;  however, NHTSA has not yet formally defined and documented the  agency’s role and responsibilities in the event of a real-world vehicle  cyberattack and how the agency’s response actions would be coordinated  with other federal agencies. Until such a plan is  developed, NHTSA’s response efforts—regardless of the threat  environment in which an attack is carried out—could be slowed as  agency staff and other stakeholders may not be able to quickly identify  the appropriate actions that NHTSA should take. DOT concurred with our recommendation to define and document  NHTSA’s roles and responsibilities in response to a vehicle cyberattack  involving safety-critical systems. The Departments of Homeland Security, Defense, and Commerce  reviewed our report, but did not have any comments. Appendix I: Objectives, Scope, and Methodology

The objectives of this report were to examine: (1) available information  about the key cybersecurity vulnerabilities in modern vehicles that could  impact passenger safety; (2) key practices and technologies, if any,  available to mitigate vehicle cybersecurity vulnerabilities and the impacts  of potential attacks; (3) views of selected stakeholders on the challenges  they face related to vehicle cybersecurity and industry-led efforts to  address vehicle cybersecurity; and (4) the Department of Transportation’s  (DOT) efforts to address vehicle cybersecurity. Automakers were selected to ensure we had representation from each of  the 3 major auto-producing regions of the world (the U.S., Europe, and  Asia) and the two U.S. industry associations (the Alliance of Automobile  Manufacturers and the Association of Global Automakers) that were  jointly pursuing several efforts related to vehicle cybersecurity, such as  the formation of an Automotive Information Sharing and Analysis Center  (ISAC).
Why GAO Did This Study

Over time, the amount of software code in vehicles has grown exponentially to support a growing number of safety and other features. However, the reliance on software to control safety-critical and other functions also leaves vehicles more vulnerable to cyberattacks.
GAO was asked to review cybersecurity issues that could impact passenger safety in modern vehicles. This report addresses, among other things, (1) available information about the key cybersecurity vulnerabilities in modern vehicles that could impact passenger safety; (2) key practices and technologies, if any, available to mitigate vehicle cybersecurity vulnerabilities and the impacts of potential attacks; (3) views of selected stakeholders on challenges they face related to vehicle cybersecurity and industry-led efforts to address vehicle cybersecurity; and (4) DOT efforts to address vehicle cybersecurity.
GAO reviewed relevant existing regulations and literature and interviewed officials from DOT; the Departments of Commerce, Defense, and Homeland Security; industry associations; and 32 selected industry stakeholders, including automakers, suppliers, vehicle cybersecurity firms, and subject matter experts. The experts were selected based on a literature search and stakeholder recommendations, among other things.

What GAO Found

Modern vehicles contain multiple interfaces—connections between the vehicle and external networks—that leave vehicle systems, including safety-critical systems, such as braking and steering, vulnerable to cyberattacks. Researchers have shown that these interfaces—if not properly secured—can be exploited through direct, physical access to a vehicle, as well as remotely through short-range and long-range wireless channels. For example, researchers have shown that attackers could compromise vulnerabilities in the short-range wireless connections to vehicles' Bluetooth units—which enable hands-free cell phone use—to gain access to in-vehicle networks, to take control over safety-critical functions such as the brakes. Among the interfaces that can be exploited through direct access, most stakeholders we spoke with expressed concerns about the statutorily mandated on-board diagnostics port, which provides access to a broad range of vehicle systems for emissions and diagnostic testing purposes. However, the majority of selected industry stakeholders we spoke with (23 out of 32) agreed that wireless attacks, such as those exploiting vulnerabilities in vehicles' built-in cellular-calling capabilities, would pose the largest risk to passenger safety. Such attacks could potentially impact a large number of vehicles and allow an attacker to access targeted vehicles from anywhere in the world. Despite these concerns, some stakeholders pointed out that such attacks remain difficult because of the time and expertise needed to carry them out and thus far have not been reported outside of the research environment.
a In this context, long-range refers to access at distances over 1 kilometer.
b This port is mandated in vehicles by statute for emission-testing purposes and to facilitate diagnostic assessments of vehicles, such as by repair shops. 42 U.S.C. § 7521(a)(6).
Selected industry stakeholders, both in the United States and Europe, informed GAO that a range of key practices is available to identify and mitigate potential vehicle-cybersecurity vulnerabilities. For instance, the majority of selected industry stakeholders we spoke with (22 out of 32) indicated that—to the extent possible—automakers should locate safety-critical systems and non-safety-critical systems on separate in-vehicle networks and limit communication between the two types of systems, a concept referred to as “domain separation.” However, some of these stakeholders also pointed out that complete separation is often not possible or practical because some limited communication will likely need to occur between safety-critical and other vehicle systems. In addition, selected industry stakeholders we spoke to identified technological solutions that can be incorporated into the vehicle to make it more secure. However, according to stakeholders, many of these technologies—such as message encryption and authentication, which can be used to secure and verify the legitimacy of communications occurring along in-vehicle networks—cannot be incorporated into existing vehicles. Rather, such technologies must be incorporated during the vehicle design and production process, which according to stakeholders, takes approximately 5 years to complete.
Selected industry stakeholders identified several challenges they face related to vehicle cybersecurity. For instance, the lack of transparency, communication, and collaboration regarding vehicles' cybersecurity among the various levels of the automotive supply chain and the cost of incorporating cybersecurity protections into vehicles were the two most frequently cited challenges—mentioned by 15 and 13 of the 32 selected industry stakeholders, respectively. However, several industry-led efforts are planned and under way that, according to stakeholders, could potentially help automakers and parts suppliers identify and mitigate vehicle cybersecurity vulnerabilities and address some of the challenges that industry stakeholders face. For example, two U.S. industry associations have been leading the effort to establish an Automotive Information Sharing and Analysis Center (ISAC) to collect and analyze intelligence information and provide a forum for members to anonymously share threat and vulnerability information with one another. Selected industry stakeholders we spoke to, as well as DOT officials, generally expressed positive views regarding the potential effectiveness of an Automotive ISAC.
The Department of Transportation's (DOT) National Highway Traffic Safety Administration (NHTSA) has taken steps to address vehicle cybersecurity issues but has not determined the role it would have in responding to a real-world vehicle cyberattack. For example, NHTSA added more research capabilities in this area and is developing guidance to help the industry determine when cybersecurity vulnerabilities should be considered a safety defect, and thus merit a recall; it expects to issue this guidance by March 31, 2016. Further, pursuant to a statutory mandate, NHTSA is examining the need for government standards or regulations regarding vehicle cybersecurity. However, officials estimated that the agency will not make a final determination on this need until at least 2018. Although NHTSA's stated goal is to stay ahead of potential vehicle-cybersecurity challenges, NHTSA has not yet formally defined and documented its roles and responsibilities in the event of a real-world cyberattack. Until it develops such a plan, in the event of a cyberattack, the agency's response efforts could be slowed as agency staff may not be able to quickly identify the appropriate actions to take.

What GAO Recommends

GAO recommends that DOT define and document its roles and responsibilities in response to a vehicle cyberattack involving safety-critical systems. DOT concurred with our recommendation.