More and more cars are connected to the internet, which is necessary to offer all kinds of services to users. However, this internet connection also poses security risks, as the vehicles can be attacked by cyber criminals via the internet. This makes it vital that the software in cars is secure and does not contain vulnerabilities that can be exploited by cyber criminals. The software BlackBerry Jarvis helps car manufacturers check the software in connected cars for such vulnerabilities.
The presence of an internet connection in a car provides all kinds of useful options for motorists. These include the ability to retrieve up-to-date traffic information from the internet and listen to music on streaming music services via the built-in entertainment system, but also the transmission of information about vehicle usage to enable preventive maintenance. Car manufacturers are therefore equipping vehicles with internet connectivity on a large scale. Such cars are also known as 'connected cars'.
Complex software
"Connected and autonomous vehicles require some of the most complex software ever developed, posing a significant risk to car manufacturers who must ensure that code complies with industry- and manufacturer-specific standards while securing a very large and attractive attack surface for cybercriminals," explained John Chen, BlackBerry's chairman and CEO.
That connected vehicles can become targets of cyber attacks has been clear for some time. Several security researchers have already shown that it is possible to remotely affect all kinds of systems in vehicles, which can in some cases compromise the safety of motorists. Security researchers Charlie Miller and Chris Valasek demonstrated to Wired in 2015 how they could remotely stop a moving Jeep Cherokee by breaking into the computer system in the vehicle. Researchers from Chinese company Tencent additionally managed to remotely access the computer system of a Tesla S in 2016, which, among other things, allowed them to remotely activate the brakes or open the boot of a moving Tesla. Both car manufacturers have fixed these security problems. In the video below, Tencent researchers demonstrate their findings.
Millions of lines of code
Such attacks exploit security vulnerabilities in software. The source code of software usually consists of millions of lines of code, most of which are written by hand. In addition, the software usually consists of multiple software components, written by different third-party software developers. Due to the large size of source code and the involvement of a large number of developers in writing this code, it is almost impossible to prevent errors from entering the source code of software. These errors lead to weaknesses in the software and can be exploited by malicious parties.
"A modern car contains more than 100 million lines of software. As the software in a car grows, the attack surface also increases, making it more vulnerable to cyber attacks. Every poorly written piece of software represents a potential vulnerability that can be exploited by attackers," BlackBerry explains on its website. BlackBerry stresses that manually inspecting software source code - if the OEM has access to it at all - is very time-consuming. It would require thousands of engineers and years of work to manually inspect 100 million lines of code, according to the company. Also, OEMs do not always have access to the source code of software components provided by third parties.
Detecting weaknesses
BlackBerry Jarvis helps detect errors in software automatically and quickly by scanning the software, targeting weaknesses that can be exploited by attackers. This without the need to have the source code of all components available. "Jarvis is a game-changer for Original Equipment Manufacturers (OEMs), as for the first time they have complete, consistent and near real-time visibility into the security status of a vehicle's entire codebase, with insights and details needed to predict and fix vulnerabilities, ensure compliance and stay one step ahead of malicious actors," Chen said.
Jarvis is offered from the cloud. Users do not have to purchase a licence for the software and pay for its use. The software is tailored to the needs of an OEM and their entire software supply chain. The solution allows OEMs to scan the software for security issues at any time during development. Afterwards, the results of this scan are immediately visible via an online dashboard, showing warnings for vulnerabilities and providing advice on how to strengthen these vulnerabilities.
Source: BlackBerry
Source: Tencent
Source: Wired
Source Photo: Pixabay / jan2575
