Waymo needs to do more to protect its self-driving vehicles from hackers, according to Martin Hron, a senior researcher at Avast. In a statement provided to AndroidHeadlines, the cybersecurity veteran explained that the company’s current efforts in the segment are likely insufficient, even though the majority of the industry may eventually embrace them in some shape or form. Waymo itself admitted to limiting the Internet access of its vehicles in order to minimize the chances of them being hacked, having done so on numerous occasions, with its last such confirmation coming in late 2017. That approach is insufficient because an online connection is far from the only attack vector that could possibly compromise self-driving cars, whereas the extent of the measure itself is also unclear, Mr. Hron said.
The Avast official explained the former Google unit may be cutting off the Internet access of its vehicles entirely or could simply be preventing a given vendor backend’s remote connectivity, arguing that the former option “isn’t very likely,” whereas the latter is far from perfect. Such a measure also doesn’t prevent other potentially far more vulnerable attack avenues, especially physical access, according to Mr. Hron. Something as simple as a dongle inserted into an infotainment system could be used to compromise a self-driving car, whether one made by Waymo or any other manufacturer, the cybersecurity expert said. Other hardware components of autonomous vehicles are also at risk and could be used to attack such cars in one way or another, with the Avast researcher pointing to wireless sensors like tire pressure detectors as an example of potentially vulnerable components that don’t necessarily have to communicate with the World Wide Web in order to be compromised and affect the system they’re paired with. In some other cases, hackers may be able to get by with proximity alone, without actual physical or Internet access, the cybersecurity researcher warned.
Background: Waymo Chief Executive Officer John Krafcik has been boasting about the company’s approach to vehicle cybersecurity for several years now. In an early 2017 interview with the Financial Times, the 57-year-old explained that the company’s vehicles will be connecting to the Internet “only when they need to” so as to avoid having a potential attack avenue consistently open to hackers. While speaking at this year’s iteration of the SXSW festival, the CEO reiterated that sentiment, going as far as to claim that Waymo’s vehicles cannot be hacked because their crucial systems — i.e. the ones they need to actually navigate roads on their own — are offline and cannot be accessed by an external signal.
However, that approach to vehicle cybersecurity seemingly isn’t compatible with the only truly “driverless” cars Waymo is currently testing; the company has been doing so since late October after it received an official permission from the California Department of Motor Vehicles, yet one of the many requirements of that regulatory green light is that all experimental vehicles must be controllable by technicians who are monitoring them remotely so that they’re able to manually intervene in case of any complications. In other words, their critical systems can not only be accessed remotely but have that functionality implemented as a security feature, not a risk. Naturally, the connection is encrypted and would-be attackers would likely need to have advanced knowledge of Waymo’s systems and transmission mechanisms before hoping to intercept the signal in question, not to mention that they wouldn’t be able to do much with cryptographically secured data, though the design of the system would still allow them to probe the company’s technologies to some degree.
Regardless, the existing regulations and recent trends in the industry suggest there’s little chance of future self-driving vehicles working completely offline, even if only in the context of their crucial systems. The potential consequences of autonomous car hacks are naturally extremely high; such acts could allow criminals to steal cars, hijack passengers, or even provide terrorists with means to weaponize traffic. The reason why self-driving cybersecurity still isn’t the most topical subject in the industry largely comes down to the fact that such transportation solutions remain in their infancy and are unsafe enough as it is. Earlier this year, a Volvo XC90 SUV from Uber’s self-driving fleet killed a woman in Tempe, Arizona, thus being responsible for history’s first autonomous car crash with a pedestrian fatality.
Waymo itself has been responsible for a larger number of autonomous car incidents with smaller consequences; this June, one of the company’s safety drivers reportedly fell asleep and accidentally disengaged the self-driving system of a custom Chrysler Pacifica minivan, consequently crashing into a highway median near the company’s headquarters in Mountain View, California. The vehicle had no way of determining whether the driver was awake, with that oversight being attributed to the project’s management. A late summer report suggested Waymo’s autonomous fleet is still struggling with the very basics of traffic, including T-intersections and unprotected left turns. In overall, the current state of self-driving technologies arguably isn’t developed enough to ensure safe transportation even in an ideal world wherein no hackers are seeking to take advantage of such systems for criminal purposes, which is why cybersecurity still isn’t the industry’s main focus.
Impact: Waymo and the rest of the industry still have a lot of work to do on their quest to improve the security of their self-driving vehicles. While no piece of electronics is completely unhackable, a combination of encryption and conservative Internet use should get the job done in the immediate future, at least until such cars become a more common sight on public roads, hence attracting the attention of a larger pool of malicious individuals. The currently most common proof-of-concept attacks targeting driverless vehicles are those that compromise local bus systems inside cars, though there’s no way of telling whether other attack vectors will become more effective in the long run, Mr. Hron says. One of the most alarming hypothetical scenarios wouldn’t even see driverless cars attacked in traffic and would instead be targeting components of one or more sub-contractors in order to compromise them with backdoors during production, the Avast official explained, concluding that the subject of self-driving security should be approached as carefully as the cybersecurity of medical devices because “lives depend on it.”