The prospect of the next generation of cars being always connected, to the manufacturer and smart city grids, connected transport infrastructure and swarm systems, is a fundamental change for the automotive industry.
While the last few decades have seen major changes in that industry, with the introduction of hybrid and electric vehicles (or at least practical version of them) and autonomous cars, the potential for cars to be always connected changes the very nature of the device’s relationship with manufacturer and owner, not to mention service providers.
“It is one thing to allow someone to hack a phone and get sensitive personal information, it is an altogether different prospect to allow someone to gain control of a vehicle through poor security implementation, as the potential for destruction with a vehicle has been tragically demonstrated too often already”
advertisement 
The opportunities for improved safety from cars being constantly in contact with a managed transport infrastructure, as well as smart city systems, is massive. A car can broadcast details of hazardous conditions to other oncoming cars before they arrive at the scene, as well as allowing authorities to take note and take action.
Smart cities could redirect traffic to avoid not just congestion, but poor air quality and pollutant build-up. As reported in these pages before, an IBM research project is already looking into the prospect of allowing car owners to opt-in to smart city schemes where the sensor platform of their car can be incorporated into the city’s sensor net to broaden its capability and effectiveness.
Manufacturers are excited by the prospect of being able to have a relationship with a car and its owner throughout its life, not just for the first owner, or the extent of a warranty, but right to end of life. This would mean things like recalls, updates, servicing and maintenance, as well as loyalty programmes, would be fundamentally different to what has been seen previously.
Service providers too, would be able to make profile, usage and geolocation based offerings to drivers, tailored and customised for that personal appeal.
However, while the technology for all of these potential developments is all here, all demonstrated and all available, it could be threatened by a failure to understand the impact of these capabilities.
Having had the privilege of reviewing a few cars here and there, I’m familiar with the experience of scrolling through a bunch of personal details from people who have previously used or reviewed the car. Inevitably, some person in using the car will have paired a mobile device, or input a user profile, and forgotten to remove it on passing it on. It is also a reminder of where one comes in the pecking order.
But that is not what one Charles Henderson did. Henderson sold a connected car some two years ago, and was careful to use the factory reset option to remove all customisation, providing a minty fresh experience for the potential new owner. Furthermore, Henderson passed the car on through a factory dealer, not privately, which one would have thought would be an extra layer of protection, as surely any dealer would ensure that any and all traces of a previous owner would be removed from a connected device, albeit one with four wheels and an engine, before passing it on.
This was not the case.
Henderson, it is worth mentioning, is an information security professional, being as he is, the global head of IBM’s X-Force Red penetration-testing team. As such, Henderson took a keen interest in what happened as he passed on his connected car in good faith.
But as he presented at the recent RSA conference in San Francisco, some two years after selling the car, he was still able to use the car’s connected app to control certain aspects of the car’s operation. It is something he describes as a “catastrophic failure”.
Henderson was kind enough not to mention the car maker, but he said that he had retained the ability to geolocate the car, use the climate control, the navigation controls and remotely unlock the car, as well as toot the horn. It is also worth mentioning that this was a high-end marque and a luxury model.
This failure could threaten the entire potential of connected devices, beyond tablets and mobile phones, and the whole Internet of Things (IoT) revolution as a more catastrophic failure, or worse still an actual exploitation, could prompt legislatures to act, people to lose confidence and the entire industry to be locked down.
While the initial signs were good, with big car manufacturers such as Ford, FIAT Chrysler and Audi all partnering with specialists to get immediate expertise as to how to do things right, stories have emerged here and there of worrying failures, from hijack demonstrations to hacking and embarrassing failures.
Security of connected devices, from a smart phone to a supertanker or a satellite, is paramount if people, businesses and industries are to adopt them. It is pointless having some new, game-changing capability available if the adoption of such could threaten your entire organisation’s survival if a “catastrophic failure” resulted that was shown to be due to a catastrophically poor implementation of security.
And the thing is, this is not that hard — mobile device management and the kind of security required have been in development and use by the logistics and aeronautics industry for some years.
While many of the major automotive manufacturers have already shown a willingness to work with specialists in the area, our own Cubic Telecom and its work with Audi being a case in point, those partnerships need to extend beyond mere connectivity and go right into information security, data and identity protection and hacking defence.
It is one thing to allow someone to hack a phone and get sensitive personal information, it is an altogether different prospect to allow someone to gain control of a vehicle through poor security implementation, as the potential for destruction with a vehicle has been tragically demonstrated too often already.
Baked-in, security by design has to be the first and only policy for connected cars, but also for the industrial IoT, as well as every other manifestation of it, as the alternative is simply not worth contemplating.
While that old movie “Maximum Overdrive” comes to mind, the recent IoT device botnet attacks, the German foundry attack, as well as the original Stuxnet effect, clearly show that the real world is all too vulnerable to cyber-influence and consequently, the addition of vehicles, light bulbs, household appliances and industrial plant machinery to the connected world must be done with the utmost consideration for security unless we hobble it from the off, or worse still, engineer some kind of technological doom into the bargain.
Ltd
