Story image

BMW awards Chinese security team's work in exposing connected vehicle vulnerabilities

24 May 18

When Chinese security researchers found a number of vulnerabilities in BMW’s connected vehicles, BMW didn’t just fix the vulnerabilities, it even awarded the eagle-eyed researchers for their efforts.

Tencent Keen Security Lab examined BMW’s internet connected systems (Infotainment System (a.k.a Head Unit), Telematics Control Unit and Central Gateway Module) and found that an attacker could potentially conduct a remote targeted attack on multiple vehicles.

Attackers could leverage 14 vulnerabilities across the different vehicle components. Furthermore, the researchers were able to use Ethernet, USB and OBD-II to physically hack the vehicles’ systems.

“Nine of the attack scenarios required a physical connection in the car or a location in the direct vicinity of the vehicle,” a statement from BMW Group says.

“Five attack scenarios were based on a remote connection using the mobile telephone network. After gaining access to the head unit and T-box components, Tencent Keen Security Lab executed specifically developed exploits and in this way was able to gain control of the CAN buses to trigger arbitrary, unauthorised diagnostic vehicle functions remotely.”

BMW has started patching the vulnerabilities and awarded the team its first ever BMW Group Digitalization and IT Research Award.

The Award honours Tencent Keen Security Lab’s work in advancing automotive security.

“With this award we want to honour the experts who support us in the transformation towards digitalised mobility,” says BMW Group’s senior vice president of electronics, Christoph Grote.

“We thank Tencent Keen Security Lab for their tremendous effort, their sophisticated research and the highly professional collaboration.” 

Tencent Keen Security Lab details the vulnerabilities in a brief research paper. The team started research in January 2017, and by April 2018 BMW had started rolling out patches.

“We want to contribute our comprehensive expertise and in-depth understanding of vehicle technologies to improving the development processes and security guidelines in the automotive industry, providing a shared benefit for OEMs and customers,” says Tencent Keen Security Lab lead researcher of vehicle and IoT security research, Sen Nie.

BMW states says that security and privacy are key elements in its product development process. It has launched a cybersecurity action plan that incorporates internal testing and independent third parties.

“Third parties increasingly play a crucial role in improving automotive security as they conduct their own in-depth tests of products and services,” BMW Group says.

The Group also says it is in discussions with Tencent Keen Security Lab about joint in-depth research and development opportunities.

The joint research will focus on the security of Android embedded systems, and on autonomous driving security and testing. Additionally, consulting services on security in over-the-air software update mechanisms are within the scope of future collaboration.

Affected BMW models include BMW i Series, BMW X Series, BMW 3 Series, BMW 5 Series, BMW 7 Series. And the vulnerabilities in the Telematics Control Unit (TCB) affect BMW models which equipped with this module produced from year 2012.

 Upgrades were rolled out in the BMW Group backend and uploaded to the telematics control units via over the air connection.

The BMW Group develops additional software updates, which will be made available for customers at BMW dealerships.

What MSPs can learn from Datto’s Channel Ransomware Report
While there have been less high profile attacks making the headlines, the frequency of attacks is, in fact, increasing.
Cisco expands security capabilities of SD­-WAN portfolio
Until now, SD-­WAN solutions have forced IT to choose between application experience or security.
AlgoSec delivers native security management for Azure Firewall
AlgoSec’s new solution will allow a central management capability for Azure Firewall, Microsoft's new cloud-native firewall-as-a-service.
Kiwis losing $24.7mil to scam calls every year
The losses are almost five times higher compared to the same period last year, from reported losses alone.
How to configure your firewall for maximum effectiveness
ManageEngine offers some firewall best practices that can help security admins handle the conundrum of speed vs security.
Exclusive: Why Australian enterprises are prime targets for malware attacks
"Only 14% of Australian organisations are continuously training employees to spot cyber attacks."
Exclusive: Why botnets will swarm IoT devices
“What if these nodes were able to make autonomous decisions with minimal supervision, use their collective intelligence to solve problems?”
"Is this for real?" The reality of fraud against New Zealanders
Is this for real? More often than not these days it can be hard to tell, and it’s okay to be a bit suspicious, especially when it comes to fraud.