Page 52 - Cyber Defense eMagazine December 2023

Moreover, embedded LTE connectivity has been integrated into vehicles since 2014, allowing
manufacturers to collect performance data and implement remote controls, such as lock/unlock and
remote start functions.

However, this technological leap has its own set of challenges. With an extensive codebase, the risk of
code leakage becomes a pressing concern. Unlike a software company, where an exposed AWS API
key may result in unauthorized access to vital AWS resources, the stakes are much higher in the
automotive world. Imagine hurtling down the highway at 70 miles per hour and losing control of your
vehicle remotely. This isn't just about data, it's about the lives of every individual in and around the vehicle.
This underscores the reality that automobiles have evolved into valuable assets susceptible to threats
from both physical and remote adversaries.

The Era of the Software-Defined Vehicle (SDV)

The SDV market is projected to grow significantly, from a $43 billion market size in 2023 to a potential
$150 billion by 2030. Pioneered by Tesla, automotive companies are shifting towards becoming software-
first entities. Ford's recent launches of electric vehicles, the F-150 Lightning and Mustang Mach-E SUV,
underscore this transformation. However, it's imperative to recognize that code security practices must
evolve in tandem as technology progresses.

Beyond flashy infotainment systems and seamless navigation experiences, the bedrock of any vehicle's
security lies in its underlying security infrastructure. For instance, in-vehicle infotainment (IVI) systems,
which operate on embedded Linux, store sensitive information like personally identifying information (PII).
These systems are often interconnected with vital subsystems, like the engine, brakes, and sensors,
which create a broad attack surface in conjunction with the embedded LTE connection, This implies that
if hackers target the infotainment system, they might gain access to sensitive information and potentially
gain control over vital vehicle functions. Robust security measures here are non-negotiable.

The Grim Reality of Source Code and Secrets Leaks

One of the most critical concerns revolves around the leakage of hardcoded credentials. Unlike traditional
attacks, where bad actors must identify and exploit vulnerabilities, hardcoded secrets can be exploited
with minimal effort. This can lead to customer data breaches, intellectual property theft, company-wide
systems manipulation, and even unauthorized access to mobile apps for controlling vehicles.

Manufacturers accumulate vast data lakes containing a wealth of information on consumer behavior.
While this data is invaluable for refining products and enhancing user experiences, it poses a significant
security risk. Any breach in these data lakes could have far-reaching consequences, affecting individual
drivers and entire user bases.

Cyber Defense eMagazine – December 2023 Edition 52
Copyright © 2023, Cyber Defense Magazine. All rights reserved worldwide.