Story image

BMW awards Chinese security team's work in exposing connected vehicle vulnerabilities

24 May 2018

When Chinese security researchers found a number of vulnerabilities in BMW’s connected vehicles, BMW didn’t just fix the vulnerabilities, it even awarded the eagle-eyed researchers for their efforts.

Tencent Keen Security Lab examined BMW’s internet connected systems (Infotainment System (a.k.a Head Unit), Telematics Control Unit and Central Gateway Module) and found that an attacker could potentially conduct a remote targeted attack on multiple vehicles.

Attackers could leverage 14 vulnerabilities across the different vehicle components. Furthermore, the researchers were able to use Ethernet, USB and OBD-II to physically hack the vehicles’ systems.

“Nine of the attack scenarios required a physical connection in the car or a location in the direct vicinity of the vehicle,” a statement from BMW Group says.

“Five attack scenarios were based on a remote connection using the mobile telephone network. After gaining access to the head unit and T-box components, Tencent Keen Security Lab executed specifically developed exploits and in this way was able to gain control of the CAN buses to trigger arbitrary, unauthorised diagnostic vehicle functions remotely.”

BMW has started patching the vulnerabilities and awarded the team its first ever BMW Group Digitalization and IT Research Award.

The Award honours Tencent Keen Security Lab’s work in advancing automotive security.

“With this award we want to honour the experts who support us in the transformation towards digitalised mobility,” says BMW Group’s senior vice president of electronics, Christoph Grote.

“We thank Tencent Keen Security Lab for their tremendous effort, their sophisticated research and the highly professional collaboration.” 

Tencent Keen Security Lab details the vulnerabilities in a brief research paper. The team started research in January 2017, and by April 2018 BMW had started rolling out patches.

“We want to contribute our comprehensive expertise and in-depth understanding of vehicle technologies to improving the development processes and security guidelines in the automotive industry, providing a shared benefit for OEMs and customers,” says Tencent Keen Security Lab lead researcher of vehicle and IoT security research, Sen Nie.

BMW states says that security and privacy are key elements in its product development process. It has launched a cybersecurity action plan that incorporates internal testing and independent third parties.

“Third parties increasingly play a crucial role in improving automotive security as they conduct their own in-depth tests of products and services,” BMW Group says.

The Group also says it is in discussions with Tencent Keen Security Lab about joint in-depth research and development opportunities.

The joint research will focus on the security of Android embedded systems, and on autonomous driving security and testing. Additionally, consulting services on security in over-the-air software update mechanisms are within the scope of future collaboration.

Affected BMW models include BMW i Series, BMW X Series, BMW 3 Series, BMW 5 Series, BMW 7 Series. And the vulnerabilities in the Telematics Control Unit (TCB) affect BMW models which equipped with this module produced from year 2012.

 Upgrades were rolled out in the BMW Group backend and uploaded to the telematics control units via over the air connection.

The BMW Group develops additional software updates, which will be made available for customers at BMW dealerships.

SecOps: Clear opportunities for powerful collaboration
If there’s one thing security and IT ops professionals should do this year, the words ‘team up’ should be top priority.
Interview: Culture and cloud - the battle for cybersecurity
ESET CTO Juraj Malcho talks about the importance of culture in a cybersecurity strategy and the challenges and benefits of a world in the cloud.
Enterprise cloud deployments being exploited by cybercriminals
A new report has revealed a concerning number of enterprises still believe security is the responsibility of the cloud service provider.
Ping Identity Platform updated with new CX and IT automation
The new versions improve the user and administrative experience, while also aiming to meet enterprise needs to operate quickly and purposefully.
Venafi and nCipher Security partner on machine identity protection
Cryptographic keys serve as machine identities and are the foundation of enterprise information technology systems.
Machine learning is a tool and the bad guys are using it
KPMG NZ’s CIO and ESET’s CTO spoke at a recent cybersecurity conference about how machine learning and data analytics are not to be feared, but used.
Seagate: Data trends, opportunities, and challenges at the edge
The development of edge technology and the rise of big data have brought many opportunities for data infrastructure companies to the fore.
Popular Android apps track users and violate Google's policies
Google has reportedly taken action against some of the violators.