The liability of smart cars and understanding the risks
The vulnerabilities of connected vehicles and the steps drivers and manufacturers can take to mitigate the risks.
The global smart car market is expected to grow substantially in the coming years, raising numerous concerns about the safety of these cars. One of the most prevalent is cybersecurity.
This market is expected to be worth $265.7 billion in 2032, growing at a compound annual growth rate (CAGR) of 17 per cent in under a decade. As smart cars are equipped with advanced technologies such as AI, 5G connectivity, and autonomous driving, cybersecurity plays an integral role in creating and maintaining a safe driving experience.
Types of automotive cybersecurity risks
Today’s smart vehicles increasingly rely on software, connectivity, and complex computer systems, opening them up to a range of cybersecurity threats. These risks can be categorized as follows:
- Vehicle control systems: Hackers can potentially exploit vulnerabilities in a car’s electronic control units (ECUs), allowing them to gain control of critical functions like steering, braking, and acceleration, possibly leading to accidents and injuries.
- Data and privacy breaches: Connected cars collect extensive amounts of personal data, including driver information, location history, and even in-car conversations. If this data is compromised, it can be used for identity theft, surveillance, or even blackmail.
- In-vehicle infotainment systems: Vulnerabilities in infotainment systems allow attackers to access personal data, install malware, or even disrupt the vehicle’s operation by interfering with connected systems.
- Keyless entry and ignition systems: These systems may be susceptible to relay attacks, where thieves amplify the signal from a key fob to unlock and start a car without needing physical access to the key.
- Over-the-air (OTA) updates: OTA updates are undoubtedly convenient for patching software vulnerabilities, but they can also introduce new risks if the update process itself is compromised.
Due to their interconnectivity, smart cars are uniquely vulnerable to cybersecurity breaches that can lead to long-term consequences.
Examples of automotive cybersecurity breaches
The threat of automotive cyberattacks is not just theoretical. Several real-world instances have already been reported where vulnerabilities in connected cars were exploited, with varying degrees of severity.
In 2015, security researchers were able to remotely take control of a Jeep Cherokee. They demonstrated their ability to operate the vehicle’s steering, brakes, and other important functions remotely and without permission. This became a highly publicized incident that highlighted the vulnerability of connected cars to remote attacks.
Tesla was hit by a breach in 2016 when Chinese researchers remotely accessed a Tesla Model S and controlled its brakes and other systems while the car was in motion. The car giant was quick to issue a software update to patch the vulnerability, but the reputational damage was extensive, especially as the hackers successfully executed the same attack a year later.
In the last few years, car manufacturers and connected car service providers have also experienced data breaches, exposing customer information such as names, addresses, and vehicle location data. In May 2024, Mercedes Benz disclosed that it had suffered a data leak after a third-party vendor exposed the personal information of up to 1.6 million prospective and actual customers.
Implications of cybersecurity breaches
Due to their interconnectivity, smart cars are uniquely vulnerable to cybersecurity breaches that can lead to long-term consequences. For example, drivers with a compromised vehicle system may have their personal information leaked, making them more likely to fall victim to identity theft, fraud, and other digital privacy violations. On a financial level, ransomware attacks, vehicle theft, and the cost of repairing damage from an attack may be too much of a burden for the consumer.
Manufacturers are also not safe from breaches and can face major financial and reputational repercussions. Cybersecurity incidents erode consumer trust while damaging the manufacturer’s brand. Lawsuits, recall costs, and liabilities are also possibilities, leading to disruptions to supply chains and production.
Strategies for mitigating risks
Protecting vehicles from cyberattacks requires a multi-faceted approach involving manufacturers, policymakers, and drivers.
Manufacturers must prioritize cybersecurity throughout the vehicle lifecycle, from design and development to manufacturing and post-sale support. To ensure driver safety and security they must implement vigorous security measures in vehicle software and hardware, conduct regular vulnerability assessments and penetration testing, and establish incident response plans.
Policymakers also need to step in and play a role in setting cybersecurity standards and regulations for the automotive industry, promoting information sharing and collaboration, and investing in research and development. Raising public awareness about automotive cybersecurity risks and best practices is another way they can assist in safeguarding drivers and their cars.
Finally, there are actions drivers can take to protect themselves, such as keeping their vehicle software up to date, avoiding connecting to public Wi-Fi networks, and not utilizing third-party apps and devices that could introduce vulnerabilities. Drivers should also ensure they are not too reliant on autonomous driving systems as these can be hacked, leading to an increase in the already high numbers of vehicular accidents with trucks, other cars, and pedestrians.
Protecting vehicles from cyberattacks requires a multi-faceted approach involving manufacturers, policymakers, and drivers.
The role of automotive cybersecurity regulations and policies
Governments and regulatory bodies play an indispensable role in establishing a framework for automotive cybersecurity, setting minimum security standards, and promoting best practices throughout the industry. The International Organization for Standardization (ISO) and the Society of Automotive Engineers (SAE) has established ISO/SAE 21434, which specifically addresses automotive cybersecurity for the automotive development lifecycle and post-production activities.
These regulations mandate specific security measures for vehicle manufacturers, such as vulnerability disclosure programs, incident response plans, and secure software update mechanisms. They establish frameworks for data protection and privacy, ensuring that vehicle owners have control over their personal data.
Policies such as the ISO/SAE 21434 are also important for encouraging collaboration and information sharing between manufacturers, security researchers, and government agencies, cultivating a collective approach to addressing the most common threats.
Future trends in automotive cybersecurity
As we move further into a connected world, several trends are shaping the future of automotive cybersecurity.
In the next few years, Artificial Intelligence (AI) will play a growing role in both attack and defence, and we’ll see hackers using AI to develop more sophisticated attacks, while manufacturers rely on AI for real-time threat detection and response. Blockchain technology will also play a greater role in securing over-the-air software updates, vehicle-to-everything (V2X) communication, and supply chain management.
In terms of vehicle design, integrating cybersecurity considerations from the earliest stages looks set to become increasingly important to minimize vulnerabilities and build a strong security foundation. Greater collaboration between manufacturers, researchers, and governments will be essential to stay ahead of evolving threats and to develop effective security solutions.
The future of driving depends on prioritizing automotive cybersecurity. To create a secure and reliable connected vehicle ecosystem we must understand the risks, embrace proactive solutions, and promote collaboration at every level.
Image credit: Depositphotos.com
The post The liability of smart cars and understanding the risks appeared first on Auto Service World.