sb-nz logo
Story image

How hackers can wreak havoc on connected vehicles & ITS

25 Oct 2017

As the time approaches when autonomous vehicles and intelligent transport systems become commonplace, the IT security industry has been making sure those vehicles are protected against hacking and other cyber attack techniques.

Trend Micro has been on the leading edge of research and published a report that analyses Cyberattacks against Intelligent Transport Systems.

The company says that BI intelligence predicts that 82% of the cars to be shipped in 2021 will be connected in some way.  In addition, smart roads and Intelligent Transportation Systems (ITS) will be used across urban planning and development in areas such as high-volume traffic movement efficiency and the creation of new economic opportunities.

“In today’s connected world of smart devices and ever-increasing volumes of disruptive and destructive cyber attacks, ITS cybersecurity is mandatory and should be considered a fundamental pillar in ITS architectures and frameworks,” comments Trend Micro senior security architect Dr Jon Oliver.

“Earlier this year, we already saw the WannaCry ransomware infecting speed cameras in Victoria. Adding security to an existing solution is always more difficult and costly than building that security from day one. We recommend that the people building ITS systems look into policies and methods so that security can be built into ITS systems in a cost-effective way from its infancy in Australia.”

The security industry has been focusing on car hacking techniques in order to understand attack vectors against modern vehicles and future autonomous vehicles. Hackers could potentially gain control over vehicle functions and steal data, the company explains.

Those hackers could comprise nation states, criminal gangs, hacktivists, cyberterrorists, insiders, ‘unscrupulous operators’ and natural disasters, the report states.

The possibility of ransom demands, data theft, information warfare, system gaming and theft and revenge and terrorism are the most likely motivations for attack.

Those attacks could also be conducted by physical, wireless and network attacks – or a combination of all of them.

“It is very possible that a singular attack can involve all three attack categories at the same time. For example, in an attack against a traffic flow controller device such as Dynamic Message Signs (DMS), the attackers can send the device incorrect/improper commands via a wireless link, by physically connecting to the device, and/or over the network using a compromised controller application. The nature and functionality of DMS make this attack vector multimodal,” the report explains.

The key principle of defense is to assume compromise and take countermeasures:

• Quickly identify and respond to ongoing security breaches.

• Contain the security breach and stop the loss of sensitive data.

• Preemptively prevent attacks by securing all exploitable avenues.

• Apply lessons learned to further strengthen defenses and prevent repeat incidents.

Story image
How cyber-attackers use Microsoft 365 tools to steal data
Vectra security research has recently identified how cyber-attackers use Microsoft Office 365 tools against organisations to steal data and take over accounts.More
Story image
Palo Alto Networks launches new SD-WAN solutions and enhancements
Palo Alto Networks has introduced two new SD-WAN appliances and enhancements to its next-generation SD-WAN solution, expanding the company’s CloudGenix SD-WAN solutions reach.More
Link image
The importance of data resilience in the current cybersecurity climate
Protecting an organisation's data is one of the most crucial functions of any CISO. Strategies should be in place where data is stored securely and cost-effectively.More
Story image
BlackBerry, Microsoft enter partnership for Teams integration
"Integrating BlackBerry AtHoc will ensure that any organisation managing critical events using Teams is able to contact, alert, and account for everyone within the organisation directly."More
Story image
Video: 10 Minute IT Jams - protecting data with user behaviour analytics
In this video, Forcepoint senior sales engineer and solutions architect Matthew Bant discusses the company's DLP solution, the importance of integrating compliance into security solutions, and why cybersecurity strategies should take a more people-based approach.More
Story image
Report reveals relationship between boardroom and cybersecurity investments
“While boards are definitely listening and stepping up with increased budget for cybersecurity, they tend to view any investment as a cost rather than adding business value."More