Abusing the Internet of Things

(Rick Simeone) #1

The issue of pollution and its negative effects on our climate is unquestionable, and this
has led to the public promotion and enhanced understanding of the importance of hybrid cars
such as the Toyota Prius and the Tesla Model S, which is fully electric. Owning a car may be a
luxury to some and a matter of livelihood to others, but it’s a matter of concern for the climate
to the collective human race.
In the past few years, cars have started to become increasingly connected to serve their
drivers and passengers. Safety- and entertainment-related features that rely on wireless com-
munications are not only becoming popular but are expected by new car buyers. Car manufac-
turers are also increasingly working to reduce emissions, to comply with regulations and
appease customers who are genuinely concerned for the environment (and those who want to
save gas money).
In this chapter we will take a look at what it means for car to be a thing that is accessible
and controllable remotely. Unlike with many other devices, the interconnectedness of the car
can serve important safety functions—yet at the same time, security vulnerabilities can lead to
the loss of lives. In our analysis of the connected car we will first examine a low-range wireless
system, and then review the extensive research that has been performed by leading experts in
academia. Lastly, we will analyze and discuss features that can be found in the Tesla Model S
sedan, including a look at at possible ways the security of the car can be improved.


The Tire Pressure Monitoring System (TPMS)


The Ford Explorer was first put on sale in March 1990. It is alleged that Ford engineers rec-
ommended changes to the design of the car because it rolled over in tests before mass produc-
tion. These cars were equipped with tires manufactured by Firestone. The Firestone-equipped
Explorers ultimately caused accidents involving 174 deaths and more than 700 injuries; in
response, Firestone recalled its tires. This resulted in a blame game: Ford was accused of
releasing a product with known safety issues, while Ford accused Firestone of manufacturing
defective tires (the defect involved “tread separation,” which caused the tires to disintegrate,
resulting in decreased stability of the vehicle).
This controversy resulted in the federal law enacted in 2000 called the Transportation
Recall Enhancement, Accountability and Documentation (TREAD) act. The act mandated the
use of a suitable tire pressure monitoring system (TPMS) designed to monitor the air pres-
sure inside the tires and report any issues—such as low tire pressure—to the driver.
The Ford/Firestone situation caused nearly two hundred deaths. From that, we can easily
extrapolate the high number of deaths that are caused on a daily basis by improper tire pres-
sure. So clearly, well-designed TPMSs are extremely important. The system should be able to
report low tire pressure to the driver, and it should not be vulnerable to other actors who
could, for example, influence the system to show a low-tire-pressure warning when in fact the
tire pressures are in the correct range. Otherwise, highway robbers within the vicinity of a car
could make the driver stop in a remote area by activating the low-pressure warning. Research-


CHAPTER 6: CONNECTED CAR SECURITY ANALYSIS—FROM GAS TO FULLY

(^158) ELECTRIC

Free download pdf