Jeep Cherokee and Tesla-S Hackers Reveal How They Did It and Teach How to Protect the Internet of Things

At the Savit exhibition that took place recently in Hanover, two "white" hackers presented how they hacked into a car that is a data center on wheels and what hacking into it means for the Internet of Things

In July 2015, two cyber security researchers demonstrated to a WIRED magazine reporter how they could remotely control a Jeep Cherokee after the infotainment systems were hacked in a "zero-day exploit" attack. This led Chrysler to call on 1.4 million vehicles to update their security systems, at a considerable cost to Chrysler's bottom line and also stoked a collective fear of its customers.

Kevin Mahaffey goes on a warning mission so that the case does not happen again. As founder and CTO of cybersecurity software vendor Lookout, Mahaffy and his research partner Mark Rogers of CloudFlare decided to see if not just the Jeep Cherokee could be hacked. In August 2015, they did this on a Tesla Model S in order to explain a key issue in the security of Internet of Things (IOT) devices at the CeBIT conference in Hanover, Germany. Last week, Mahaffy said, “Of all the connected cars, we chose the Model S for one reason: its architecture is completely new; She has no legacy. And besides, cheaper than a car, it's a data center on wheels. "

Kevin Mahaffey, CTO of online security company Lookout, explains how he hacked a Tesla Model S car. "Our hypothesis was that Tesla uses a lot of standards in the car," Mahaffey said. "That's why we thought it was said that even though we tried as hard as we could to hack it, we didn't succeed because they did a good job.'"

As it turned out, Tesla was doing many things right from an IT security perspective, but not enough. The duo gained access to a variety of computerized information systems in the car, and eventually the two caused Tesla to update the embedded software on the Model S.

After Mahaffey and Rogers notified Tesla of their vulnerabilities, the company quickly created software updates, which were sent via the cloud to all Model S vehicles as if it were a routine operation. Customers were not required to bring their cars to garages, Tesla did not have to spend time and money on service, and there was no serious PR fallout from the event.

Three separate servers are embedded in the Tesla Model S car. The Instrument Cluster (IC) and Center Information Display (CID) run Linux;, the computers are powered by the FreeRTOS real-time operating system. That means they all work using open source. Photo courtesy of Tesla Motors.

Mahaffy said there are three essential lessons to be learned from this Tesla Model S hack. These lessons apply to IT systems in general, but especially to the IOT systems that are becoming more common around the world. These lessons are vitally important because the industries developing the IoT "things" have no history in IT or online security. "It is easier to engineer [security] at the beginning of development and then there will be no need to add patches.

Lesson 1: Create a robust update process

Computing devices require updates on a regular basis. The IT providers and their customers understand this; They have established mechanisms in place for software upgrades. IoT devices are not immune to the need for software updates, but the ecosystem for software upgrades is not generally centralized, secure, or structured.

Mahafi insisted in his presentation on the need to engineer the fixes and not add them on top of the system. "Software updates should be distributed frequently, they should be free to the end user ... and require at most one or two clicks to activate," he said. Consumers generally ignore software updates if they are complicated and time-consuming.

Lesson 2: Create a security-proof system

Security was a central issue in the Sevit conference sessions.. a politician participated in one of the meetings. Jan Philipp Albrecht, a member of the European Parliament from Northern Germany from the Green Party, and a harsh critic of digital privacy issues. He advocates a strong role for the government in establishing security standards for the IOT.

"Before developing IOT systems we need to ensure an infrastructure of security and privacy in the design of these products," he said. "To achieve this we need the regulators to do the work first."

"Companies that do business in Europe must adhere to the rules. Europe has the gold standard for data protection. All manufacturers must assume that their devices will be attacked sooner or later. Most newcomers have to engineer to the point of making the device fortified to prevent the attack in advance. Today there are big walls on the outside and nothing protects the inside," Mahafi stated.

To help manufacturers understand the importance of what he calls resilient design, Mahaffy offers the metaphor of the human body. Skin is only the first line of resistance against disease; There is a large system in the body, each part of which has its own method of dealing with infections. IOT security should be achieved on a systemic basis and not by trusting that the external interface is impenetrable. "Total trust will result in the device being completely jailbroken," Mahaffy said. We must create sensors that monitor data transfers between the systems in order to track what happens in the event of a breach.

Lesson 3: Isolate critical components

Returning to the body as a metaphor for IOT. Mahaffy pointed out that the most critical system, the brain, has its own special layer of security - the blood-brain barrier. Car manufacturers and manufacturers of other Internet-connected devices need to create their own blood-brain barrier around the gateway to the system. An example of one industry that applies this is the airline industry.

V-Wi-Fi can't talk to the autopilot," Mahaffy said. “Your brake should not be able to talk to the web browser; More importantly, your web browser should not be able to talk to your brakes. "

The device gate is the most important part of the system, and it will have the strongest protection. You can't just rely on a big wall, Mahaffy pointed out, but a big wall is a good start.