WASHINGTON – Drivers can talk with each other via Bluetooth phone connections, ask their cars for directions and dial up satellite radio. The same cars use electronic components to signal the gas pedal to accelerate and control stability.
What increasingly worries scientists is that entertainment computers could be manipulated to tell the safety computers what to do.
“There clearly is a vulnerability,” said Adrian Lund, president of the Insurance Institute for Highway Safety, based in Arlington, Va. “All these electronics we’re bringing into cars seem to exacerbate that.”
A National Academy of Sciences panel, including Lund, elevated the concerns in a report Jan. 18 reviewing U.S. regulators’ work in finding the cause of unintended acceleration in Toyota Motor Corp. vehicles.
While safety and entertainment systems are intended to be separate, “it is not evident that this separation has been adequately designed for cybersecurity concerns,” the academy wrote. It agreed with U.S. regulators who said they found no evidence the Toyota incidents were caused by faulty electronics.
Automotive engineers at a conference in Washington last week said they aren’t immediately concerned that a hacker will take over a car and drive it off a bridge. Instead, they said, they want to help automakers spot vulnerabilities while they’re hypothetical and ease fears of consumers who are already familiar with cyberattacks in other areas.
Car thieves could exploit security weaknesses to remotely open and start a car, or a spy could listen to conversations inside a car, Stefan Savage, a University of California-San Diego computer science professor, said in a telephone interview. He co-authored a paper last year after discovering ways to hack into cars.
Any electronic system in a car from brakes to radios is a potential target for hackers, said Andre Weimerskirch, chief executive officer of Escrypt, a closely held security company in Ann Arbor, Mich., with automotive clients. While the risk is hypothetical so far, automakers and regulators ought to address it now, he said in telephone interview.
Savage and co-author Tadayoshi Kohno, from the University of Washington, found vulnerabilities in telematics systems, which make the connections between cars and mobile communications. They also successfully inserted an infected CD into a car’s compact-disc player and directed it to control safety systems. They aren’t aware of any real-world examples of car hacking.
“The issue for the industry and for the government is that you’re one really bad situation away from it becoming a thing that people think about,” Savage said. “Much better to try to address it early.”
