- Technologists explain that using smartphone technology in cars, technology that was never designed to protect safety-critical systems, is a recipe for disaster. Expert hackers report that time and money are the only things that stand between them and hacking a fleet of cars. Software design practices that result in frequent hacks of everything from consumer electronics to financial systems cannot be trusted in cars, which can endanger not only the lives of their occupants, but also pedestrians and everyone else on the road.
- Connected cars have suffered more than half a dozen high-profile hacks in recent years. All have been benign demonstrations, not intended to cause harm. Hundreds more vulnerabilities have been reported to carmaker "bug bounty" programs. Experts report a hack of American vehicles designed to cause damage is inevitable without better security.
- The car industry's response when vulnerabilities are exposed is to patch individual security holes and ignore the design problems that underlie them. Technologists have described the practice as attempting to address structural security problems by "using chewing gum and duct tape".
- Car hacking demonstrations to date have always focused on a single vehicle, but the networked nature of connected cars creates numerous avenues for a fleet-wide attack. Viruses can spread vehicle-to-vehicle. Malicious WIFI hotspots can infect any susceptible vehicle that passes within range. Cars can be infected with "sleeper" malware that wakes at a given date and time, or in response to an external signal, resulting in a massive coordinated attack.
- Security-critical components in cars are black boxes. Even the car makers themselves often do not know the origins of the software they use, nor their true risks. Vehicles from many major carmakers – including Tesla, Audi, Hyundai, and Mercedes – rely heavily on software written by third parties. This includes open source software, like Android, Linux, and FreeRTOS. This software often comprises contributions from hundreds or thousands of different authors around the world, and there is usually little accountability for flaws. For example, FreeRTOS, used in critical systems by Tesla, had major vulnerabilities discovered in October 2018, but Tesla never acknowledged using the software, the vulnerability, or whether it patched the problem.
- The veil of secrecy surrounding automotive software and the ability to update it "over the air" without touching the vehicle lets automakers cover up safety problems and sloppy testing practices. Consumers are driving cars whose systems run on unfinished and under-tested software.
"Despite working on the problem for more than a decade, carmakers have proven incapable of creating Internet-connected vehicles that are immune to hacking, which is the only standard that can keep consumers safe," the report concludes. "With connected cars rapidly overtaking the market, consumers will soon have no haven from the online connections that threaten them."
The report recommends numerous steps to safeguard the public, but its simple answer to the problems is that, as soon as possible, carmakers should install 50 cent "kill switches" in every vehicle.
"Allowing consumers to physically disconnect their cars from the Internet and other wide-area networks should be a national security priority," Court said. "If a 9/11-like cyber-attack on Americans cars were to occur, recovery would be difficult because there is currently no way to disconnect our cars quickly and safely. The nation's transportation infrastructure could be gridlocked for weeks or months. Mandatory 'kill switches' would solve that problem."