Latest / Cybersecurity Under Pressure. Real Attacks, Real Lessons / Your License Plate Is the Password: What the Kia API Hack Revealed

Transcript

Your License Plate Is the Password: What the Kia API Hack Revealed · Cybersecurity Under Pressure. Real Attacks, Real Lessons

0:47
You know what a Swiss bank and a Nairobi fintech have in common?
0:50
Today we find out. Oh.
0:51
This is going to be good. Because the reality is, I mean,
0:54
they both completely rely on this highly complex, deeply
0:57
interconnected web of secure APIs just to move assets, you
1:02
know, and verify identities without the whole system just
1:05
collapsing into total chaos. And the darkly hilarious or
1:10
maybe just totally terrifying part that is exactly the same
1:14
technology protecting the multi ton kinetic missile currently
1:17
sitting in your driveway, your car.
1:19
Yeah, it forces a completely different perspective, doesn't
1:22
it? When you realize that padding
1:23
the start button on your dashboard is, it's functionally
1:26
identical to executing a high frequency financial trade.
1:28
It's all just data packets and authentication tokens now.
1:31
Good morning. Welcome.
1:32
Cybersecurity under pressure, real attacks, real lessons.
1:35
We are diving deep into automotive cybersecurity today.
1:39
And I have to tell you, parsing through this stack of sources,
1:43
the NIS risk assessments, the upstream reports, the academic
1:47
tear downs of the anonymous cup, it feels less like reading about
1:51
cars and more like, I don't know, reading a post mortem on a
1:55
compromised intelligence agency. The parallel is incredibly
1:59
apartment, honestly, especially because the automotive industry
2:03
is currently experiencing this massive identity crisis.
2:07
I mean, for the last century a car was a mechanical.
2:10
Island a heavy metal box. Exactly.
2:12
You engineer it, you bolt it together, you run it through
2:14
safety crash tests, and once it clues the factory floor, the
2:17
security posture is effectively frozen in amber.
2:21
That was the era of what we call factory gate security.
2:23
Right, which made perfect sense when the primary threat model
2:26
was like a guy with a Slim Jim trying to pop the door lock in a
2:30
grocery store parking lot. The physical metal of the car
2:32
was the security perimeter. Yeah, you don't have to worry
2:35
about someone hacking your carburetor from Russia.
2:37
Exactly. And looking at the history of
2:39
the UNES, WP, but 29 regulations, specifically
2:42
standards like R155 and R156, you can see that legacy mindset
2:46
codified into law. I mean, they were designed to
2:49
ensure that a vehicle was completely secure at the exact
2:51
moment of type approval and then, you know, ship and forget
2:55
it. And they serve their purpose,
2:56
right for a closed ecosystem. But the entire premise of our
2:59
discussion today, and really the blaring siren at the center of
3:02
the EU's NIS Cooperation Group's 2026 security risk assessment of
3:07
connected and automated vehicles, is that this closed
3:10
ecosystem just no longer exists. It's totally gone.
3:13
The NIS report is explicit about this.
3:16
Relying on factory gate validation is dangerously
3:18
inadequate now because the threat landscape has evolved
3:21
from localized physical tampering to remote, scalable
3:24
and highly sophisticated digital warfare.
3:27
We are talking about nation state actors actively targeting
3:30
the kinetic infrastructure of civilian populations.
3:33
Nation state actors, that is wild.
3:36
And that involves malicious over the air updates, right?
3:39
Which fundamentally breaks the old model because the code
3:41
running the car today might not be the code running the car
3:44
tomorrow. So wait, so when I buy a brand
3:48
new top of the line car, is its security architecture already
3:52
obsolete the moment I drive it off the lot?
3:54
If the manufacturer relies solely on that initial factory
3:58
gate perimeter, yes, absolutely. Oh wow.
4:01
Because a static defense cannot protect a dynamic node.
4:05
And that's the exact term the Upstream security report uses to
4:08
describe the modern vehicle, a dynamic digital node.
4:11
Upstream argues that the very concept of a digital perimeter
4:14
around a single vehicle has completely vanished.
4:17
It's gone. Because the vehicle is
4:19
practically inside out at this point, right?
4:20
It's an intelligent connected vehicle, an ICV, which means its
4:23
operations are inextricably linked to external networks.
4:26
I was I was mapping out the architecture based on the
4:30
upstream gate. If you guys listening at the
4:31
sheer volume of telemetry is staggering.
4:33
Walk us through the map you built.
4:34
Where are the connections? Well, OK, first you have the
4:37
mobile app on your phone which is sending biometric or
4:40
tokenized authentication up to a cloud platform, right?
4:43
That cloud platform is managing not just your car, but millions
4:47
of vehicles and it's routed commands back down to the
4:50
vehicles T box or telematics box.
4:53
Then inside the cabin you have the in vehicle infotainment
4:56
system, the IVI, which is essentially just a giant Android
4:59
tablet hardwired into the dashboard, and it's constantly
5:02
pulling data via 5G or Wi-Fi. And beneath all of that, beneath
5:06
the screens and the flashy apps, is the real central nervous
5:11
system, the canvas, which connects dozens of electronic
5:14
control units, or ECU's. Exactly.
5:17
And on top of all of that, if you drive an EV, you have the
5:20
charging pile infrastructure to worry about every single time
5:23
you plug in. Your car's negotiating this
5:25
incredibly complex digital handshake with the grid to
5:28
manage voltage, billing, authentication.
5:30
I mean, it's honestly a running joke in my house that my car has
5:32
a better cell data plan than my actual phone.
5:34
Oh, I believe it. It's always online, always
5:36
downloading a map patch or an infotainment update, or just
5:40
silently sending telemetry back to the manufacturing.
5:43
It sits in the garage. It's a great joke, but it
5:46
highlights the core structural vulnerability of the software to
5:49
find vehicle. By extending the car's
5:51
functionality into the cloud to support all those cool features,
5:55
engineers inadvertently extended the attack surface outward.
5:59
The steering column is no longer the most scalable risk.
6:02
The scalable risk sits in the back end.
6:05
AP is because if an attacker compromises the API Gateway in
6:09
the cloud, they don't just get one car, they get the keys to
6:12
the entire complete. OK, let's pull the thread on AP
6:15
is then, because the Cisco blog data we analyzed provides this
6:18
brutal reality check on why automotive AP is are so uniquely
6:22
vulnerable compared to say, enterprise ITAPIS.
6:26
When we talk about AP is Application Programming
6:28
interfaces, we're talking about the digital messengers that take
6:31
a request from your mobile app, validate it, and tell the car's
6:34
internal computers to, you know, unlock the door.
6:36
Yeah, they're the waiters taking the order to the kitchen.
6:38
Exactly. But the problem isn't
6:40
necessarily the API itself, it's what the API is talking to on
6:44
the vehicle side, the ECU's. That's the critical bottleneck
6:48
in a traditional enterprise environment.
6:49
If you want to secure an API endpoint, you just throw massive
6:52
computational power at it. You use AES 256 encryption,
6:56
complex mutual TLS handshakes, continuous token rotation.
7:00
It's heavy cryptography. But an electronic control unit
7:03
in a car is not a server blade in an AWS data center.
7:08
Right. An ECU is a highly specialized,
7:10
deeply constrained micro computer.
7:12
It controls the engine timing, the anti lock brakes, the airbag
7:15
deployment. It's not running a full desktop
7:18
OS. And because it controls kinetic,
7:20
literally life or death functions, it operates on a real
7:22
time operating system. The constraints on these things
7:25
are severe. They have microscopic amounts of
7:26
memory, strict power limitations, and 0 tolerance for
7:30
latency. Because of the physics of
7:31
driving. Exactly.
7:32
If the radar detects an obstacle and tells the braking ECU to
7:36
engage, that ECU cannot pause for 50 milliseconds to pack a
7:39
complex cryptographic certificate.
7:41
It has to act instantaneously or you crash.
7:44
So the engineers are forced into this brutal compromise.
7:47
They can't run heavy security on the internal nodes.
7:50
They physically can't. The Cisco data outlines this
7:52
perfectly. The standard architectural work
7:55
around they use is to designate 1 high complexity ECU, usually
8:00
the telematics unit, to act as the primary gateway to the
8:03
Internet. So that's the bouncer at the
8:05
club. Right, this gateway handles the
8:08
heavy lifting, the TLS encryption, the API
8:11
communication with the cloud, it acts as the shield.
8:14
But here is the massive flaw. Once a signal is verified by
8:18
that gateway and passed into the internal vehicle network like
8:21
the CN bus, the communication between the internal ECU's often
8:25
occurs in completely plain text, completely lacking
8:29
authentication, privacy, or integrity checks.
8:32
It's like, OK, it's like a medieval castle with this
8:34
massive iron front gate, a low Archers on the walls.
8:38
But once you get past that gate and you're inside the courtyard,
8:40
there are literally no locks on the bedroom doors.
8:42
You can just walk into the King's chambers.
8:44
Or actually, it's like an old school party line telephone
8:47
system. Oh, I like that one.
8:49
Right on a party line, every house on the street shares the
8:51
exact same physical phone wire. If you pick up the receiver, you
8:55
can just sit there and hear your neighbors conversation and if
8:58
someone on the line shouts hey the house is on fire, turn on
9:01
the sprinklers. Everyone just assumes the person
9:04
shouting is telling the truth because they are already on this
9:07
trusted line. There's no caller ID, there's no
9:09
voice verification. The internal ECU's operate on
9:13
absolute implicit trust. That is a phenomenal analogy.
9:17
The Keen bus is exactly that. It's a broadcast network.
9:19
Every ECU hears every single message on the bus.
9:22
If an attacker can find a way to spoof a message on that party
9:25
line, the receiving ECU, say the steering control module, has
9:29
absolutely no mechanism to verify if the command actually
9:32
came from the Advanced Driver Assistance system or if it came
9:35
from a hacker who compromised the infotainment screen and
9:37
pivoted inward. Which brings us to the open
9:40
season of fall 2022. Because this isn't just
9:43
theoretical modelling anymore, right?
9:44
Security researchers essentially proved that the party line was
9:47
completely exposed. The 2022 open season was a
9:50
massive watershed moment for the industry.
9:52
Independent researchers targeted the back end APIs of several
9:56
major global automakers and found that those high complexity
9:59
gateways, the bouncers at the club, weren't nearly as secure
10:03
as the industry believed. They bypass the cloud level
10:06
authorization entirely. And because the internal network
10:09
lacked those authentication checks, the researchers could
10:12
send remote commands directly to the vehicles they were locking
10:16
and unlocking doors, starting engines, Hawking horns, flashing
10:20
headlights, all from a laptop thousands of miles.
10:23
And the truly terrifying part was a reconnaissance aspect.
10:26
They could globally geolocate these vehicles using nothing but
10:29
a vehicle identification number, a VIN, or in some cases just the
10:34
owner's e-mail address associated with the companion
10:36
app. They demonstrated complete
10:38
administrative takeover. I mean they accessed internal
10:40
dealer applications, executed arbitrary code on back end
10:43
servers and exfiltrated highly sensitive personally
10:46
identifiable information or PII of millions of customers.
10:50
The API's were fundamentally broken.
10:52
And just when you think the industry would have learned its
10:54
lesson and locked down those cloud endpoints, we get hit with
10:58
the September 2024 vulnerability.
11:01
Oh man, the Kia hack. Yes, discovered by Sam Curry,
11:04
Ian Carroll, Naiko Rivera, and their team.
11:08
This one is just. It is an absolute master class
11:11
in broken object level authorization or Bo leeway.
11:15
I want to break down exactly how this worked because it literally
11:18
sounds like a script from a bad cyber thriller.
11:21
They didn't need the owner's e-mail.
11:22
They didn't even need the VIN which is at least stamped on the
11:25
dashboard and you have to walk up to the car to see it.
11:27
They could take control of a vehicle using only the license
11:30
plate number. I literally drive around with a
11:33
giant piece of metal bolted to the outside of my car that
11:36
functioned as a remote control password for hackers.
11:38
I'm going to start covering my license plate in the trash bag
11:40
every time I park just to keep my steering wheel.
11:42
Safe. The absurdity of it is matched
11:44
only by the simplicity of the exploit.
11:47
Here is how the researchers Mac the attack path and it is
11:50
chilling. The Kia dealer portal had an API
11:53
endpoint designed to look up vehicle information.
11:56
If you passed a license plate number to this endpoint, the
11:59
back end system would query a database and return the
12:02
associated VIN. OK, so step one.
12:05
Look at the license plate in traffic, type it in, get the
12:07
VIN. But a VIN isn't inherently
12:10
secret key, right? Anyone can walk up to my
12:11
windshield and read it. How does knowing the VIN
12:15
actually give them control? That leads to Step 2, which is
12:18
where the fatal API flaw existed.
12:21
Kia's mobile app Back End allowed users to register as the
12:24
secondary owner of a vehicle. You know, so a spouse can also
12:27
use the app to start the car. Makes sense.
12:29
To do this, the app sent an HTTP request to an API endpoint
12:33
containing the VIN and the new user's e-mail address.
12:36
The flaw was at the Back end. System completely failed to
12:38
validate the session token of the user making the request
12:41
against the primary owner's permissions.
12:43
Wait wait, what? So the API just assumed that if
12:46
you asked to be a secondary owner, you just automatically
12:49
had the right to be one? It didn't send a push
12:52
notification to my phone asking hey someone is trying to
12:55
register as a driver of your car, do you approve?
12:58
Exactly. Completely lacked object level
13:00
authorization. The researchers could simply
13:03
generate A valid session token for their own fake burner
13:06
account, send a request containing your VIN, and the API
13:10
would quietly bind their account to your vehicle in the back end
13:13
database. No alerts, no checks.
13:16
And once their account is bound to my car.
13:18
They inherit the full permissions of the mobile app.
13:21
They can generate the commands to unlock the doors, start the
13:23
engine and track the GPS coordinates in real time.
13:27
From the cars perspective, the command was coming from a
13:29
legitimate authenticated source. The party line trusted the
13:32
caller. That is a chilling breakdown of
13:35
how physical security is entirely dependent on cloud
13:39
software architecture. I mean, your physical locks are
13:41
useless if the cloud just tells them to open and the data proves
13:44
this isn't an isolated coding error.
13:46
We have to look at the massive academic study analyzing the
13:49
anonymous CUP because this study fundamentally rewrites what we
13:52
know about automotive vulnerability distribution.
13:55
The anonymous CUP data is arguably the the most valuable
13:58
empirical data set the industry has seen in years.
14:00
We are looking at a deep, rigorous analysis of 649 real
14:05
world, highly exploitable vulnerabilities discovered
14:08
during a series of eight vulnerability discovery
14:10
competitions held between January 2023 and April 2024.
14:14
And they didn't just test a handful of cars in the lab, they
14:17
tested 48 different vehicle models spanning 19 different
14:20
manufacturers. The methodology is what makes
14:22
this so incredibly robust to me. This wasn't a theoretical
14:25
whiteboard exercise. They used strict black box
14:28
testing. Yes, and black box testing in
14:31
this context means the researchers were placed in the
14:33
exact same position as a real world adversary.
14:36
They were given no source code, no internal network diagrams,
14:40
and no engineering documentation whatsoever.
14:43
They were provided legitimate access to a test vehicle and its
14:46
companion app, and from there they had to completely reverse
14:50
engineer the attack surface. They even utilize social
14:53
engineering, right? They were scraping publicly
14:55
available information from obscure form crumbs, ghetto
14:57
repositories and WeChat mini programs just to piece together
15:00
the back end infrastructure of the OEM's.
15:03
The ultimate test of their exploits was brutal.
15:06
They had to prove their attack on a different vehicle of the
15:08
same make and model, a vehicle they had 0 legitimate access to.
15:12
A true blind validation. It wasn't enough to just hack
15:15
their own test car, and the findings exposed massive,
15:19
glaring blind spots in the existing cybersecurity
15:21
taxonomies used by regulators and engineers.
15:25
The standard literature, which relies heavily on historical
15:28
data and theoretical threat models, simply did not account
15:31
for the sheer creativity of the attackers.
15:34
The researchers identified 13 entirely new vulnerability types
15:38
that had never been officially categorized.
15:40
Let's talk about some of those new types because they really
15:42
show how sophisticated the attacks have become.
15:45
They found vulnerabilities involving cross domain lateral
15:48
movement where an attacker compromises a low security zone.
15:51
Like say the infotainment browser you're using to look at
15:53
the weather and pivots through the gateway directly into the
15:56
high security canvas they found over the air.
15:59
Payload manipulation, where attackers could literally
16:02
intercept an update package midair and downgrade the
16:05
firmware to a vulnerable legacy version.
16:07
They also identified severe misconfigurations in MQTT
16:10
brokers. That's the telemetry transport
16:13
protocol used by many vehicles to send diagnostic data to the
16:16
cloud. Attackers were subscribing to
16:18
wild card topics and intercepting plaintext
16:21
diagnostic data from thousands of vehicles simultaneously.
16:24
Just vacuuming up data and the study also identified a brand
16:27
new primary attack location that previous models had vastly
16:30
underestimated, the T box. The telematics box if the API is
16:34
the gatekeeper in the cloud, the T box is the gatekeeper inside
16:37
the vehicle. It manages the cellular modem,
16:40
the 4G or 5G connection. It runs a complex operating
16:42
system, often a hardened version of Linux, and it acts as the
16:46
vital bridge routing data between the external cloud and
16:48
the internal canvas. So if you compromise the tee
16:51
box, you bypass the cloud entirely and get direct access
16:55
to the internal party line. But here's the statistical twist
16:59
that blew my mind when I was reading the paper.
17:01
The tee box is the critical bridge, but it actually wasn't
17:04
where the vast majority of vulnerabilities were found.
17:07
When you look at the distribution of the 649 of
17:09
vulnerabilities, A staggering 37.8% hit the cloud platform and
17:14
another 32% hit the in vehicle infotainment system.
17:17
That is nearly 70% of all vulnerabilities concentrated in
17:21
just two areas. Why is the infotainment screen
17:24
such a massive target? It really comes down to
17:26
architectural complexity and the surface area of exposed
17:29
interfaces. Let's look at the IVIS.
17:32
The modern infotainment system is not just a radio anymore.
17:34
It is essentially an open computing environment running
17:37
Android Automotive or QNX. It has a massive attack surface
17:40
because it is fundamentally designed for maximum
17:43
connectivity and interactivity. It has a web browser, connects
17:46
to 3rd party app stores, it interfaces with your phone via
17:49
Bluetooth, it has physical USB ports, and it connects to public
17:52
WI networks at coffee shops. Exactly.
17:55
Every single one of those connections is a potential
17:57
ingress point, and because consumers demand rich graphics
18:00
and complex applications, the IVI contains millions of lines
18:04
of code. The more code you have,
18:07
especially third party code for streaming apps or navigation,
18:10
the higher the statistical probability of a memory
18:12
corruption bug, a buffer overflow, or a simple
18:15
misconfiguration. So you hack the Spotify app on
18:17
the dashboard, escalate privileges to the underlying
18:20
Android operating system, and certainly you are positioned to
18:23
send lateral commands to the vehicle's internal network.
18:27
And OK. There was one specific detail in
18:29
the Anonymous CUP study regarding this that I found
18:31
darkly hilarious. They broke down the
18:33
vulnerabilities by vehicle type, sedans, MP VS and SU VS.
18:38
Yes, the anomaly and the data distribution.
18:40
The SU VS had a significantly higher number of vulnerabilities
18:43
compared to sedans and MP VS. Which means if you're a safety
18:46
conscious parent and you go out and spend $80,000 on a premium
18:50
top of the line family SUV because you want the safest,
18:53
heaviest thing on the road for your kids, you were actually
18:56
purchasing a massive rolling attack surface for hackers.
18:59
It is a very dark irony, yes, but from an automotive
19:03
engineering perspective, the causality is very clear.
19:06
Premium SUVs are almost always the flagship models for
19:09
manufacturers. They are the testing ground for
19:12
the newest, most complex technologies.
19:14
Right, they get the massive pillar to pillar screens, the
19:16
augmented reality heads up displays, the rear seat
19:19
entertainment tablets for the kids, the complex multi zone
19:23
climate controls. And to support all of that,
19:25
premium SUVs often utilize a much more complex internal
19:29
network topology. Instead of a flat canvas
19:31
architecture found in a basic sedan, a luxury SUV might use a
19:35
zone based architecture relying on automotive Ethernet just to
19:39
handle the massive bandwidth required by all those cameras
19:41
and lighter sensors. This means more microprocessors,
19:45
complex routing tables, and inherently more code.
19:48
More features directly correlate to more bugs, particularly in
19:51
that highly exposed infotainment module.
19:53
So the cloud APIs are completely porous, the dashboard screens
19:56
are practically Swiss cheese, and the premium vehicles are the
19:59
most vulnerable of all. But if we pull back and look at
20:02
the macro picture, it actually gets even worse because
20:06
attackers have realized they don't even need to hack the car
20:09
directly. They don't even need to hack the
20:11
OEMs cloud, they can just hack the people.
20:13
Who build the components? We are talking about the supply
20:15
chain now, and the automotive supply chain is arguably the
20:19
most complex, deeply nested manufacturing ecosystem on the
20:24
planet. An automaker, you know, the OEM
20:27
whose badge is on the steering wheel, doesn't build the car
20:29
from scratch. They're essentially systems
20:31
integrators. They rely on Tier 1 suppliers
20:33
for massive preassembled systems like the entire breaking array
20:37
or the complete infotainment head unit.
20:39
But it doesn't stop there. Those Tier 1 suppliers rely on a
20:42
massive web of Tier 2 and Tier 3 suppliers for the microchips,
20:45
the braided circuit boards, and crucially, the open source
20:48
software libraries that get compiled into the final code.
20:51
It is a massive web of transitive trust, and the data
20:54
from the Auto Isaac and Automotive Information Sharing
20:58
and Analysis Center shows that ransomware operators have
21:00
thoroughly mapped this web and are actively exploiting its
21:03
weakest links. The ISAC data explicitly tracks
21:06
the ransomware creep into the sector, noting that highly
21:08
organized, financially motivated threat groups like Leak, Net,
21:11
Lynx, Quillen, Everest and Beast are systematically targeting the
21:14
lower tiers of the supply chain. The blast radius of these
21:17
attacks is incredible. The report details recent
21:20
campaigns that successfully breached 2 different OEMs, but
21:23
more importantly compromise 11 different suppliers, 3 service
21:27
providers and three dealerships. The strategy is obvious.
21:30
Why spend months trying to breach a highly defended, well
21:33
funded OEM network when you can compromise a small Tier 2
21:36
software vendor that provides a single trusted diagnostic tool
21:40
used by that OEM? It is the digital equivalent of
21:43
poisoning the well. If an attacker like the Quelan
21:46
group breaches A Tier 2 supplier, they don't necessarily
21:49
deploy ransomware immediately. They can move laterally through
21:53
the suppliers network, locate the Jenkins build servers where
21:56
the software is compiled, and inject A malicious back door
21:59
into a firmware update before it is even cryptographically
22:02
signed. And then the supplier
22:03
unwittingly sends that poisoned update up the chain to the tier
22:07
one, who integrates it, sends it to the OEM, who then pushes it
22:11
over the air to a million vehicles, and the vehicle
22:14
accepts it without question because it carries the
22:17
legitimate digital signature of the trusted supplier.
22:20
Precisely. And while espionage or backdoor
22:22
access is 1 threat, the auto ISAC data emphasizes that
22:26
disruption is equally devastating.
22:28
Which brings up the most bizarre yet perfectly illustrative
22:31
incident from our entire research stack the breathalyzer
22:34
attack. The ignition interlock incident.
22:36
It perfectly encapsulates the fragility of interconnected
22:39
dependencies. According to the ISEC report,
22:42
there was a targeted cyber attack on the back end servers
22:45
of a third party breathalyzer company.
22:48
These are the court mandated interlock devices that wire
22:51
directly into a vehicle's ignition relay.
22:54
You know you have to blow into them to prove you have been
22:56
drinking before the car will start.
22:57
Right. They operate on a fail secure
22:59
physical mechanism. If the device cannot validate
23:02
the breast sample, it physically interrupts the circuit to the
23:05
starter motor. But these modern devices aren't
23:07
stand alone anymore. They phone home.
23:10
They are tethered to the Breathalyzer company's cloud
23:12
infrastructure for logging and compliance reporting to the
23:15
courts. So when a ransomware attack took
23:18
down the back end servers of this third party company, the
23:21
interlock devices in the vehicles lost their connection
23:24
and because they couldn't phone home, they defaulted to a failed
23:28
secure state. The attack caused actual
23:31
physical vehicle immobilizations.
23:33
Out in the real world, innocent people completely unrelated to
23:36
the cyber attack couldn't start their cars because a totally
23:39
separate sauce company got hacked.
23:42
It begs the question, how can an automaker possibly secure a
23:46
vehicle when a third party accessory can just sever the
23:49
ignition wire? They cannot control the third
23:51
party's IT infrastructure, obviously, but they must manage
23:54
the risk of that integration. And the industry recognizes this
23:57
existential threat. Their response to this
24:00
distributed supply chain chaos is a framework pushed heavily by
24:03
the German Association of the Automotive Industry or the
24:05
media. It's called the Cybersecurity
24:08
Interface Agreement, the CSIA. It sounds like a diplomatic
24:11
treaty. What is the actual enforcement
24:13
mechanism behind a CSIA? Because just asking suppliers
24:17
nicely to be secure clearly isn't working.
24:20
It operates through strict contractual enforcement,
24:23
specifically utilizing what's called a RASI matrix.
24:26
RASI responsible, accountable, supported and informed.
24:29
Correct. And this is a crucial adaptation
24:31
from the standard OCI matrix used in standard IT project
24:35
management. In traditional IT, the C stands
24:37
for consulted, but in the physical heavily regulated
24:40
automotive supply chain supported or supplier accurately
24:44
defines the legal and operational burden.
24:47
The OC matrix within the CSIA contractually maps out exactly
24:50
who's responsible for what across the 10 different chapters
24:53
of the ISIS A 21434 standard. So instead of a vague agreement
24:57
to just build secure components, the OEM and the Tier 1 supplier
25:00
sit down and dissect the architecture.
25:02
If we take our breaking ECU example from earlier, the RC
25:05
matrix legally defines that the supplier is like responsible for
25:09
writing the cryptographic codes for the ECU, but the OEM is
25:12
accountable for performing the penetration testing on the
25:14
integrated system. Exactly.
25:16
It eliminates the ambiguity that attackers exploit.
25:19
It ensures that cybersecurity risk is actively managed across
25:22
distributed development projects, not just during the
25:25
initial build, but throughout the entire service life of the
25:27
component. It answers.
25:29
It's a critical question. When a new zero day
25:32
vulnerability is discovered in an open source library three
25:35
years from now, whose legal responsibility is it to write,
25:38
test and deploy the patch? And this framework isn't just
25:42
best practice anymore, it is rapidly becoming a legal
25:45
requirement. Which brings us to the
25:47
regulatory hammer that is finally swinging down on this
25:49
industry. For decades, automotive
25:51
cybersecurity was essentially self governed.
25:54
You tried your best and if you failed, you dealt with APR
25:56
nightmare. But as of July 2024, that era is
25:59
over. It was a monumental shift in
26:02
international law. In July 2024, EU NASA Regulation
26:05
155 type approval became mandatory across 64 contracting
26:08
parties. 64 countries, the entire European Union to Tan,
26:12
South Korea, Australia. If you want to sell a car in any
26:15
of those markets, you must comply.
26:17
But what does mandatory type approval actually mean in the
26:19
mechanical sense? Type approval is the process by
26:22
which a regulatory authority certifies that a vehicle model
26:25
meets all statutory safety and environmental requirements.
26:29
Before, R155, type approval focused on emissions, crash
26:33
safety and lighting. Now it includes A comprehensive
26:37
cybersecurity audit. If an OEM cannot prove their
26:40
cybersecurity posture meets the R 155 standard, the authority
26:44
will literally withhold the type approval certificate.
26:47
Without that piece of paper, it is illegal to register or sell
26:50
that vehicle in those 64 countries.
26:52
The grace period for legacy architectures has officially
26:55
expired. It is a hard stop.
26:57
That is immense leverage. We mentioned both R155 and R156
27:01
earlier. How do they divide the
27:03
regulatory burden? They act as twin pillars
27:05
addressing different phases of the vehicle life cycle.
27:07
Regulation 155 mandates the implementation of a
27:10
cybersecurity management system or CSMS. This focuses on
27:13
organizational governance, risk assessment, and incident
27:16
response throughout the development and production
27:18
phases. Regulation 156 mandates a
27:21
Software Update Management system, or SUMS. Right, because
27:24
fixing the vulnerabilities is just as risky as the
27:26
vulnerabilities themselves. Precisely.
27:29
R156 ensures that the process of pushing an over the R update is
27:33
cryptographically secure, that it won't inadvertently brick the
27:36
vehicle's safety systems mid drive, and that the OEM
27:39
maintains A rigorous audit trail of every software version
27:43
running on every single component of every car in the
27:45
fleet. OK, but I have to play devil's
27:47
advocate here for a second. We both know how corporate
27:50
compliance often works in practice.
27:52
You hire an army of consultants, you generate thousands of pages
27:55
of policy documents, you build a beautiful Rossi matrix, you pass
27:58
the audit, get the certificate, and then everyone goes right
28:01
back to building vulnerable systems.
28:03
Is passing this R155 audit actually going to stop a
28:06
dedicated ransomware group? The regulators anticipated the
28:09
paper compliance loophole and the brilliance of the R155
28:12
framework lies and how it links organizational process to hard
28:15
technical evidence. Process compliance is achieved
28:18
by following the ISIS a 21434 standard that gets your CSMS
28:22
certified, but R155 includes a specific mechanism called Annex
28:26
5. Annex 5.
28:27
It sounds like a classified military document.
28:29
It is essentially A rigid non negotiable threat catalyst.
28:33
Annex 5 lists 69 specific threat scenarios that an OEM must
28:38
address. An OEM cannot just present a
28:40
policy document and say we have a strong security culture.
28:43
They must rigorously map every single threat in Annex 5 to a
28:47
traceable deployed technical mitigation.
28:50
So if Annex 5 says threat spoofing of messages on internal
28:53
vehicle networks, the OEM has to point to the exact lines of code
28:57
or the specific hardware module that prevents spoofing.
29:00
And if they claim a threat is not applicable to their vehicle,
29:04
the independent Technical Services auditors will demand
29:06
mathematical proof as to why they can't just peep her over
29:09
the cracks. Exactly, and the most common
29:11
technical mitigation auditors look for to satisfy that
29:14
specific internal spoofing threat is Coc secure on board
29:18
communication. Right, let's dig into Coc,
29:20
because this is the lock on the bedroom doors inside our party
29:23
line analogy. How does Coc actually secure the
29:25
canvas despite the massive computational constraints of the
29:29
ECU's? It is a fascinating piece of
29:31
cryptographic engineering designed specifically for real
29:34
time systems. SEC OC doesn't encrypt the data
29:37
payload itself. Encrypting and decrypting data
29:40
takes too long and would delay critical breaking signals.
29:43
Instead it focuses on authentication and integrity.
29:47
It appends a message authentication code a Masai to
29:50
the data packet. So it's essentially a digital
29:52
signature attached to the plain text message.
29:55
The breaking ECU sees the command apply breaks, checks the
29:58
MC, and if the MC matches the shared cryptographic key, it
30:02
knows the command genuinely came from the collision avoidance
30:05
system. Correct, but a maxi alone isn't
30:08
enough because of replay attacks.
30:09
If an attacker records the legitimate unlocked doors
30:12
message with its valid Ms., they could just play that exact same
30:15
message back onto the CAN bus an hour later and the doors would
30:18
open. Right, because the cryptographic
30:20
signature is technically valid. The lock thinks it's a real key.
30:24
So how does Seki stop a replay attack?
30:26
By utilizing freshness values, typically implemented as
30:29
monotonic counters. Monotonic, meaning a counter
30:32
that only ever goes up. It never resets or goes
30:34
backward. Exactly every time the sending
30:37
ECU transmits a message, it increments the counter.
30:40
It includes this counter value in the calculation of the MC.
30:44
When the receiving ECU gets the message, it checks the counter.
30:48
If the received counter value is lower than or equal to the last
30:51
message it received, it immediately rejects it as a
30:54
replay attack. It guarantees the message is not
30:57
only cryptographically authentic, but that it was
30:59
generated right this millisecond.
31:01
It adds an expiration date to the data.
31:04
That is brilliant engineering. But even if we lock down the
31:06
internal network with Secosi and we secure the cloud, AP is when
31:09
we vet the supply chain. We still have the aftermarket to
31:13
deal with. I can go online right now, buy a
31:15
cheap OBD 2 diagnostic dongle for 20 bucks, plug it directly
31:19
into the physical port under my steering wheel and link it to a
31:22
sketchy app on my phone. Does R155 cover that?
31:25
R155 strictly covers the type approval of the motor vehicle
31:28
itself. It does not cover aftermarket
31:30
accessories. However, the European Union
31:32
recognize this massive loophole and is closing it with the Cyber
31:35
Resilience Act, the CRA. So the net is widening.
31:38
The CRA introduces horizontal cybersecurity requirements for
31:42
all products with digital elements sold in the EU.
31:45
This means if a third party vendor sells an aftermarket
31:47
telematics dongle, a smart charging cable or a standalone
31:51
fleet management software package, it must legally meet
31:54
strict cybersecurity baseline standards, provide security
31:58
updates for a defined period, and report exploited
32:01
vulnerabilities to authorities. So we are attempting to regulate
32:04
every single node in the ecosystem, the car, the updates,
32:08
the supply chain, the aftermarket dongles.
32:10
But I still have to challenge the fundamental premise of all
32:12
this regulation. The ink on R155 is barely dry.
32:15
And yet, as we saw in the Anonymous Cup, hackers are
32:18
already exploiting 13 entirely new vulnerability types that
32:21
aren't specifically categorized in the Annex 5 threat catalog.
32:25
Can a static regulation, a piece of paper written in a committee
32:28
room, ever truly outpace A dynamic adversary?
32:31
Who is inventing new Zero Day X splits this morning?
32:33
You've hit on the central existential tension in
32:36
cybersecurity. The honest answer is no.
32:38
A static regulation can never outpace A dynamic adversary.
32:42
Compliance is a trailing indicator of security.
32:44
So what is the solution? If factory gate security is dead
32:48
and compliance isn't enough, how do we actually protect these
32:51
networks? The philosophy of the industry
32:53
has to undergo a fundamental evolution which is perfectly
32:56
articulated in the conclusions of the Upstream Security Report.
33:00
The industry must move away from a set it and forget it
33:03
compliance mindset. Passing the R155 audit is the
33:07
floor. It is not the ceiling.
33:09
The future of automotive security requires building
33:12
agentic resilient transportation networks.
33:14
Let's define agentic in this context.
33:17
It sounds like you were describing the security system
33:19
as a living entity. In a way, yes.
33:21
An agentic system isn't a passive wall waiting to be hit.
33:24
It has agency. It is actively monitoring,
33:27
actively hunting for anomalies, and capable of autonomous
33:30
defensive actions. It requires total fleet wide
33:34
situational awareness. So it's essentially an AI driven
33:37
security operation center SSC specifically for vehicles.
33:40
Precisely, you have to centralized the telemetry data
33:44
from the vehicles internal ECU's, the supply chain AP is
33:47
the cloud back end and the charging infrastructure and
33:49
continuously analyze it in real time.
33:52
If an attacker discovers a new zero day exploit and attempts to
33:55
use it on a single fleet vehicle in Nairobi, the agentic security
33:59
system needs the situational awareness to instantly identify
34:02
the anomalous behavior, generate A defensive signature, and push
34:05
that updated security posture to a vehicle in Switzerland before
34:09
the attack can even attempt to scale the exploit.
34:12
It's not about building an unbreakable car anymore.
34:14
The fortress mentality is gone. It's about building a car that
34:17
can take a punch, recognize exactly how it was hit, and
34:21
dynamically adapt its defenses before the second punch lands.
34:25
Resilience over absolute prevention Because in a hyper
34:28
connected world where a vulnerability in a third party
34:31
breathalyzer API can paralyze a fleet, the illusion of absolute
34:34
prevention is the greatest. Vulnerability of all security
34:40
under pressure. Real attacks, real essence.
34:43
It is genuinely terrifying to realize that the two ton machine
34:46
we strap our families into is just another note on a massive,
34:50
shifting digital network fighting off the exact same
34:53
invisible wars as our bank accounts.
34:55
See you in the next chapter.