Security: Connected Car vs Connected Plant
Over the last few weeks I have been reading articles on security breaches with the connected car; hackers remotely control a Jeep, VW hides a security flaw , researchers hack a Corvette. But these challenges are not as unique as car manufacturers would like you to believe, and they are absolutely avoidable.
The main issue at hand is that we as consumers see our car as an engine with four wheels and a few seats. We don’t think of our car as a production system; with hundreds of sensors, control panels and a visual HMI to display the information in an easy-to-understand screen. But that is exactly what your car is: a mobile automation platform, with a fully integrated supervisory control and data acquisition (SCADA) system, no different than the systems found on a traditional factory floor.
So why can’t we learn from the factory to build a secure car? For the same reason that industry is having challenges securing the plant. SCADA systems were first designed in the 70’s. At that time security was not the primary concern for factories, data acquisition was. Your modern SCADA system is designed around the same principles that were founded almost half a century ago; client-server architecture, where you request the information and the system will give it to you. Sensors connected to PLCs are not programmed to automatically give you values, they must be asked for their values, and once asked they will happily provide you with those values in milliseconds. The same holds true for your car, since the control systems in your vehicle are based on exactly the same principles as industrial automation.
In your typical plant, the SCADA network is protected from operations, and again protected from business planning systems. Since the plant does not require the Internet, its network does not need to be protected against unsecured access. In some cases, plants will allow access through proxy servers, firewalls, and the use of a VPN, all in place to secure the connection. To support this access, the plant must expose a port on a firewall to allow for incoming connections. The problem is that you’re vulnerable at your weakest point as was the case with the Target hack.
Today if you asked a nuclear power facility to attach a black box on their SCADA network which uses a cellular connection to monitor water flow, they would throw you out of the office. So why is the manufacturer of your car or your insurance company doing just that? That black box that you attach to your OBD-II port, the SIM card in your vehicle or your remote key are all potential attack surfaces; exposed ports with an IP address waiting to be hacked.
The only way to prevent a hacker is to remove all attack surfaces, and keep all inbound firewall ports closed, which requires a different approach. At Skkynet, that is exactly what we do. Skkynet’s SkkyHub is a secure end-to-end platform used to connect virtually any industrial or embedded data source, visualize the data, and monitor or control your process or system from afar. Secure by design, there are no Internet attack surfaces, no VPN’s, and yet it allows for bi-directional communications and supervisory control.
Since onboard car systems are so similar to industrial automation systems in this way, the solution for providing secure remote access on industrial systems applies to cars as well. With today’s technology there is no reason to expose a plant, device, or a connected car to Internet attack. What manufacturers need to do is change the conversation. The plant, device, or car should publish the information, to which authorized individuals or devices should subscribe in order to receive the information. It is a simple change that addresses security: no open firewall ports, no attack surfaces.
