When Chinese security researchers found a number of vulnerabilities in BMW's connected vehicles, BMW didn't just fix the vulnerabilities, it even awarded the eagle-eyed researchers for their efforts.
Tencent Keen Security Lab examined BMW's internet connected systems (Infotainment System (a.k.a Head Unit), Telematics Control Unit and Central Gateway Module) and found that an attacker could potentially conduct a remote targeted attack on multiple vehicles.
Attackers could leverage 14 vulnerabilities across the different vehicle components. Furthermore, the researchers were able to use Ethernet, USB and OBD-II to physically hack the vehicles' systems.
"Nine of the attack scenarios required a physical connection in the car or a location in the direct vicinity of the vehicle," a statement from BMW Group says.
"Five attack scenarios were based on a remote connection using the mobile telephone network. After gaining access to the head unit and T-box components, Tencent Keen Security Lab executed specifically developed exploits and in this way was able to gain control of the CAN buses to trigger arbitrary, unauthorised diagnostic vehicle functions remotely." BMW has started patching the vulnerabilities and awarded the team its first ever BMW Group Digitalization and IT Research Award.
The Award honours Tencent Keen Security Lab's work in advancing automotive security.
"With this award we want to honour the experts who support us in the transformation towards digitalised mobility," says BMW Group's senior vice president of electronics, Christoph Grote.
"We thank Tencent Keen Security Lab for their tremendous effort, their sophisticated research and the highly professional collaboration."
Tencent Keen Security Lab details the vulnerabilities in a brief research paper. The team started research in January 2017, and by April 2018 BMW had started rolling out patches.
"We want to contribute our comprehensive expertise and in-depth understanding of vehicle technologies to improving the development processes and security guidelines in the automotive industry, providing a shared benefit for OEMs and customers," says Tencent Keen Security Lab lead researcher of vehicle and IoT security research, Sen Nie.
BMW states says that security and privacy are key elements in its product development process. It has launched a cybersecurity action plan that incorporates internal testing and independent third parties.
"Third parties increasingly play a crucial role in improving automotive security as they conduct their own in-depth tests of products and services," BMW Group says.
The Group also says it is in discussions with Tencent Keen Security Lab about joint in-depth research and development opportunities.
The joint research will focus on the security of Android embedded systems, and on autonomous driving security and testing. Additionally, consulting services on security in over-the-air software update mechanisms are within the scope of future collaboration.
Affected BMW models include BMW i Series, BMW X Series, BMW 3 Series, BMW 5 Series, BMW 7 Series. And the vulnerabilities in the Telematics Control Unit (TCB) affect BMW models which equipped with this module produced from year 2012.
Upgrades were rolled out in the BMW Group backend and uploaded to the telematics control units via over the air connection.
The BMW Group develops additional software updates, which will be made available for customers at BMW dealerships.
