Incident: 'Potential Cybersecurity Threats in Connected Cars Industry'

Published Date: 2016-06-27

Postmortem Analysis
Timeline 1. The software failure incident mentioned in the article happened in 2016. [Article 45024]
System unknown
Responsible Organization unknown
Impacted Organization 1. Cybercriminals attempting to hack vehicles were impacted by the software failure incident as experts claimed to have developed a hack-proof car to counter such attacks [Article 45024].
Software Causes 1. The software causes of the failure incident were related to vulnerabilities in the car's computer systems, allowing hackers to gain control over critical safety systems like braking and steering [45024]. 2. Security experts highlighted the vulnerabilities in the Jeep Cherokee and Cadillac's Escalade, listing them as the most hackable cars due to software weaknesses [45024]. 3. The incident also involved security blunders in self-driving vehicles, where a researcher demonstrated how easy it was to trick the remote sensing technology using basic equipment, indicating software flaws in the system [45024].
Non-software Causes unknown
Impacts unknown
Preventions 1. Implementing a robust security system with firewalls and unique data keys that cannot be cloned to prevent hacking attempts [45024]. 2. Verifying data sent to the car through a triple-check system similar to that used by banks for online banking protection [45024]. 3. Connecting keys to the car's software to obtain a unique code for access, adding an extra layer of security [45024].
Fixes 1. Implementing a 'hack-proof' security system developed by Frazer-Nash Research, which relies on firewalls and unique data keys to prevent cyber attacks [45024].
References 1. Experts from Frazer-Nash Research, specifically Greg Starns, executive director software [Article 45024] 2. Security experts compiling a list of most vulnerable car makes and models [Article 45024] 3. Researcher Jonathan Petit at the University of Cork [Article 45024]

Software Taxonomy of Faults

Category Option Rationale
Recurring unknown The articles do not provide any information about a software failure incident happening again at either one specific organization or multiple organizations.
Phase (Design/Operation) design, operation (a) The article mentions a software security system developed by Frazer-Nash Research that is designed to prevent cybercriminals from hacking into vehicles. The system relies on a series of firewalls and unique data keys that cannot be cloned to keep vehicles from being hacked [45024]. (b) The article discusses how security experts have warned about the potential for hacking connected systems in self-driving cars. For example, a security expert demonstrated how easy it is to fool the remote sensing technology on self-driving vehicles using basic equipment like a laser pointer [45024].
Boundary (Internal/External) within_system (a) within_system: The software failure incident reported in the articles is related to the vulnerability of car systems to hacking attempts originating from within the system itself. The article discusses how cybercriminals have targeted cars with on-board computers controlling various functions like locking, safety systems, auto braking, and power steering. The article highlights the development of a 'hack-proof' security system by Frazer-Nash Research, which includes firewalls, unique data keys, and a triple-check system to prevent hackers from gaining access to the vehicle's computer systems [45024]. This failure is within the system as it involves vulnerabilities in the software and security measures implemented within the car's systems.
Nature (Human/Non-human) non-human_actions, human_actions (a) The articles discuss the potential for software failure incidents related to non-human actions, particularly cybercriminal activities targeting vehicles' on-board computers to control locking and safety systems [45024]. The development of a 'hack-proof' car system by Frazer-Nash Research aims to prevent such incidents by implementing firewalls, unique data keys, and a triple-check system similar to that used by banks to protect against cyber attacks [45024]. (b) The articles also mention software failure incidents that could occur due to human actions. For example, security experts were able to hack into a Jeep Cherokee's computer system via its Wi-Fi connection, demonstrating vulnerabilities in the vehicle's security [45024]. Additionally, a security expert revealed how self-driving vehicles' remote sensing technology could be fooled using basic equipment, highlighting potential security blunders that could result from human actions [45024].
Dimension (Hardware/Software) hardware, software (a) The article discusses a software failure incident related to hardware vulnerabilities in vehicles. It mentions how security experts hacked into a Jeep Cherokee's computer via its Wi-Fi connection, gaining control over critical safety systems like brakes and steering [45024]. This incident highlights how hardware vulnerabilities can lead to software failure incidents in vehicles. (b) The article also addresses software failure incidents related to software vulnerabilities in vehicles. It talks about the need for bolstering security in vehicles to make them impervious to cyber criminals as autonomous vehicles roll out. The new 'hack-proof' security system developed by Frazer-Nash Research relies on firewalls, unique data keys, and a triple-check system to prevent hackers from gaining access to the vehicle's software [45024]. This demonstrates how software vulnerabilities can lead to software failure incidents in vehicles.
Objective (Malicious/Non-malicious) malicious (a) The objective of the software failure incident was malicious, as the article discusses the increasing threat of cybercriminals targeting cars and the need for hack-proof security systems to protect vehicles from malicious hacking attempts. It mentions how security experts have demonstrated vulnerabilities in cars, such as hacking into a Jeep Cherokee's computer system to control critical safety functions like braking and steering [45024].
Intent (Poor/Accidental Decisions) unknown The articles do not provide information about a software failure incident related to poor_decisions or accidental_decisions.
Capability (Incompetence/Accidental) accidental (a) The articles do not mention any software failure incident related to development incompetence. (b) The articles discuss the potential for software failure incidents related to accidental factors, such as cybercriminals targeting cars and vulnerabilities in vehicle systems that could be exploited by hackers [45024].
Duration unknown The articles do not provide information about a specific software failure incident related to either a permanent or temporary duration.
Behaviour other (a) crash: The articles do not mention any specific software crash incidents. (b) omission: The articles do not mention any specific instances of the system omitting to perform its intended functions. (c) timing: The articles do not mention any specific instances of the system performing its intended functions too late or too early. (d) value: The articles do not mention any specific instances of the system performing its intended functions incorrectly. (e) byzantine: The articles do not mention any specific instances of the system behaving erroneously with inconsistent responses and interactions. (f) other: The articles discuss the development of a new 'hack-proof' security system for vehicles to prevent cybercriminals from gaining access to the car's computer systems. This new security system involves a series of firewalls, unique data keys, and a triple-check system similar to that used by banks to protect online banking. This behavior of enhancing security to prevent hacking attempts can be considered as a proactive measure to prevent potential software failures related to security breaches [45024].

IoT System Layer

Layer Option Rationale
Perception None None
Communication None None
Application None None

Other Details

Category Option Rationale
Consequence non-human, theoretical_consequence (a) death: There is no mention of any deaths resulting from the software failure incident in the provided article [45024]. (b) harm: The article does not mention any physical harm caused to individuals due to the software failure incident [45024]. (c) basic: The incident did not impact people's access to food or shelter [45024]. (d) property: The software failure incident did not result in any impact on people's material goods, money, or data [45024]. (e) delay: There is no mention of any activities being postponed due to the software failure incident [45024]. (f) non-human: The software failure incident primarily focused on the potential hacking of vehicles and the development of a hack-proof system to prevent such attacks [45024]. (g) no_consequence: The article does not mention any observed consequences resulting from the software failure incident [45024]. (h) theoretical_consequence: The article discusses the potential consequences of cyber attacks on vehicles, such as gaining control over critical safety systems, but does not report any actual incidents or consequences [45024]. (i) other: The article does not mention any other specific consequences of the software failure incident [45024].
Domain transportation The failed system mentioned in the article is related to the transportation industry. The system was intended to support the security and protection of vehicles, specifically electric Metrocabs, from cybercriminals and hacking attempts [45024]. The system was designed to enhance the safety and security of vehicles, particularly as autonomous vehicles become more prevalent in the transportation sector.

Sources

Back to List