Application Security , Cybersecurity , Risk Management

Electric car manufacturer Tesla has updated its firmware after researchers in China demonstrated how they could remotely turn on the windshield wipers, open the trunk and apply the brakes in brand-new Model S sedans.

See Also: Protecting Your Assets Across Applications, Services and Tiers

The researchers, from Tencent's Keen Security Lab, released a video and blog post on Sept. 19 after Tesla had been privately informed of the software. An over-the-air software update was delivered 10 days after Keen notified Tesla. The car maker maintained that the risk to customers was very low.

"We commend the research team behind today's demonstration and plan to reward them under our bug bounty program, which was set up to encourage this type of research," the company says in a statement.

The automotive industry has been under increasing pressure to ensure its software is free of vulnerabilities that could jeopardize safety. Cybersecurity experts have warned for years that the increasing complexity of vehicle computers, combined with network connectivity, poses vast new risks.

A dramatic public demonstration of a vehicle hack last year advanced those concerns. Chris Valasek and Charlie Miller remotely triggered a 2014 Jeep Cherokee's brakes on a California highway. While the demo was criticized for its possible risks to the public, it illustrated that worries about vehicle hacking were already far beyond theoretical (see Creating Cybersecurity Rating Systems for Cars).

That hack was enabled by software vulnerabilities in UConnect, which is a telematics unit used for navigation and entertainment. As a result of the research, Fiat Chrysler recalled 1.4 million vehicles.

To strengthen security, Fiat Chrysler and Tesla launched bug bounty programs this year that reward independent researchers for responsibly reporting security flaws. Vehicle manufacturers have also established the Automotive Information Sharing and Analysis Center (Auto-ISAC) to share information on vehicle-related threats (see Car Hacking Spurs Automakers to Share Threat Information).

Wipers Are On

Keen Research Lab's video shows the effects of the researchers' attacks against two Tesla Model S sedans in a rainy parking lot.

Their blog post says the software problems, uncovered over several months, granted access to the Controller Area Network bus (CANbus), a critical unit that brokers signals from a variety of electronic systems.

The demonstration, while light on technical detail, shows how they were able to open the sunroof, turn on a turn signal, move the driver's seat back and lower the back left window on a white Model S P85 Tesla.

A second attack was directed against a red Model S 75D. Senior researcher Sen Nie asks Keen Security Lab Director Samuel Lv to figure out where the nearest charging station is. Lv sits in the red Tesla for a bit and comes back, saying a charge point is about six miles away. Ling Liu, a Keen researcher, then says, "It is ready."

Lv returns to the vehicle to find that the large, 17-inch touchscreen tablet mounted on the dashboard is unresponsive, and the driver's instrument cluster is also frozen. Both displayed the logo for Keen Security Lab. In a low-speed driving demo, they turn on the windshield wipers, open the trunk, manipulate a right-side mirror and trigger the brakes remotely from 12 miles away.

Tesla's statement indicated the software problems are linked to the touchscreen tablet's web browser.

"The issue demonstrated is only triggered when the web browser is used, and also required the car to be physically near to and connected to a malicious Wi-Fi hotspot," the company says. "Our realistic estimate is that the risk to our customers was very low, but this did not stop us from responding quickly."

Mystery Vulnerabilities

Craig Young, a cybersecurity researcher with Tripwire, says a Wi-Fi attack could only be conducted at a maximum distance of around 900 feet. "I suspect that the attack may have actually been possible by another user on the same cell tower or with a cell site stimulator," Young says. "In this case, I hope that the researchers do release further details to help understand the automotive attack surface better."

Nonetheless, the exercise shows how security holes in an application can be used to gain kinetic control over a vehicle. "Ideally these systems should be completely isolated from one another," Young says.

The up-to-date software is v7.1 2.36.31, and drivers are advised to ensure the patches have been applied.

×Close

Request to Republish Content

Cybersecurity , Data Breach

Don't leap to conclusions on the basis of a new report that suggests Yahoo is preparing to warn the world that it was hacked and lost hundreds of millions of users' account credentials.

See Also: Managing Identity, Security and Device Compliance in an IT World

The data breach report, from technology news site Recode, claims that "Yahoo is poised to confirm a massive data breach of its service" that exposed credentials for hundreds of millions of users.

It says the supposed breach is the same one that came to light in early August, when a hacker known as Peace - a.k.a. Peace_of_mind - began advertising 200 million alleged Yahoo credentials for sale on a darknet marketplace called The Real Deal, as technology news site Motherboard first reported. Peace told the site that the data likely dated from 2012, had already been traded privately for some time, and was now available for 3 bitcoins, worth about $1,800.

Peace was also the seller behind the stolen LinkedIn, Fling, MySpace and Tumblr credentials, many dating from years ago, as part of what's been a wave of historical mega-breaches belatedly coming to light as the information has been offered for sale via the cybercrime underground.

But some security experts have urged against reading too much into the new report. "I'm skeptical that they're going to say there's been a breach," Sean Sullivan, a security specialist for Finnish security firm F-Secure, tells me. "They might be like: there's a huge cache of verified accounts with verified passwords," he says, meaning that the information may have been obtained via a breach, but not necessarily a breach involving Yahoo.

"The asking price was miniscule, so clearly it's not something they had to pay to exfiltrate," Sullivan says. Hence one possibility, he says, is that the supposed Yahoo data breach is the result of attackers taking email and password combinations from other hacked sites - such as Adobe or Dropbox - and finding ones that worked on Yahoo's site. Sullivan said it would have been easy for attackers to harvest the information, create a script to test it against Yahoo, and then sell it to others.

Rampant Password Reuse

The ease and prevalence of that practice has led some technology firms to scrape public data dumps and proactively test whether the information contains reused passwords that could be used to log into any of the accounts registered with their service. In 2013, Facebook, for one, began reviewing public data dumps and forcing users to reset their passwords if they'd been reused.

Following the report that Peace was offering about 200 million old Yahoo passwords for sale, Yahoo said that it was "aware of a claim" and investigating.

Perhaps not coincidentally, Sullivan notes that since this past summer, he's begun seeing frequent reminders from Yahoo whenever he logs in, encouraging him to change his password. "It's just been my personal experience of Yahoo encouraging the heck out of, 'Hey, update your password," which in my case is complex and unique, and thus I've been waiting to see evidence of if I should, and also just because in my case there's nothing in my [Yahoo] account that's mission critical."

Another possibility is that as part of the $4.8 billion sale of Yahoo's core business to Verizon, it plans to issue a financial disclosure saying that legally speaking, it could face future legal action as the result of compromised credentials.

Sullivan says such a statement would likely read: "We don't know if there was a breach, but our lawyers say we are liable to cover the cost," which might see the company offering to provide identity theft monitoring.

Or another possibility is that a short seller is attempting to manipulate Verizon or Yahoo's stock price.

Halcyon Days

The warning that hundreds of millions of Yahoo accounts may have been compromised is a reminder of how much Yahoo's star has fallen. Initially, the site positioned itself in large part as a portal to the rest of the internet as well as a search engine. But as the portal paradigm faded and Google became the search engine giant, Yahoo suffered.

The news about possible breach at Yahoo! just reminded me I have an account with them. Must see what, if anything, I've been missing :) :)

As Dublin-based information security consultant Brian Honan notes via Twitter, news of the breach may now lead to a spike in the use of Yahoo, if only for lapsed users to remind themselves of what they used to use the service for.

CISO , Education , Governance

A group of cybersecurity policymakers recommends a series of steps the U.S. federal government and the private sector should take to ensure that the nation will have enough cybersecurity specialists in the coming decade.

See Also: Hide & Sneak: Defeat Threat Actors Lurking within Your SSL Traffic

Among those steps are providing student debt forgiveness for those studying cybersecurity, creating internships and mentorship programs as well as moving to centralized recruiting and training for the federal government.

In testimony given Sept. 19 before the presidential Commission on Enhancing National Cybersecurity, witness after witness stated the need for government-backed initiatives to enhance the IT security workforce in government and the private sector.

"This shortage is reflected at every level, from basic entry-level network managers to senior researchers," says Neal Ziring, technical director for capabilities at the National Security Agency. "The technologies of cyberspace will continue to grow and change, and attackers will continue to develop new tradecraft. Without a solid workforce, we will not be able to maintain or improve security in the long term. ... The shortage will continue indefinitely unless we take action to alleviate it."

200,000 Shortfall in Cybersecurity Specialists

The situation is acute in the federal government.

Commerce Secretary Penny Pritzker, in her prepared remarks, points out that the nation faces a shortfall of 200,000 cybersecurity specialists. That gap hits government particularly hard. "Since arriving at Commerce, I have faced a chronic shortage both in quantity and quality of cybersecurity personnel," she says. "Yet I do not have the authority, flexibility or resources to do enough about it. ... The federal government's challenges are compounded by a smaller talent pool, uncompetitive salaries and a cumbersome hiring process."

But even when qualified personnel are identified, getting them on board remains a challenge. "As many of you know, Washington is not Silicon Valley; hiring takes months, not minutes," Pritzker laments. "In all honesty, I feel like Sisyphus here. I meet biweekly with my CIO and often find out that by the time we bring someone new on board, someone else has been lured away by private sector perks or poached by an agency that offers hiring bonuses or higher pay."

Gregory Wilshusen, director of information security issues at the Government Accountability Office, says he doesn't expect the situation in the federal government to improve soon. "Ensuring that the government has a sufficient number of cybersecurity professionals with the right skills and that its overall workforce is aware of information security responsibilities remains an ongoing challenge," Wilshusen says in written testimony.

Continuing Struggle

Studies over the years show the struggle in building an IT security staff. For example, a GAO survey earlier this year of federal agencies' CISOs reveals their difficulties in recruiting, hiring and retaining security personnel. Wilshusen says the problem of maintaining a sufficient security staff makes it more challenging for agencies to effectively carry out their responsibilities.

In building the federal government's cybersecurity workforce, Pritzker suggests the commission consider recommending a centralized system to recruit, train and place federal cybersecurity personnel as well as creating specialized pay scales to compete with the private sector.

"We need to rethink recruitment with bold ideas like debt forgiveness for graduates of certified programs, tuition-free community college in return for federal service and cybersecurity apprenticeships within civilian agencies," the Commerce secretary says.

NSA's Ziring offers similar suggestions for building the IT security workforce, including supporting students pursuing cybersecurity degrees and certificates directly through scholarships and indirectly through internship programs and industry incentives. Ziring cites as an example the National Science Foundation Cybercorps Scholarship for Service Program, which he contends has been successful in drawing talented undergraduate and graduate students into cybersecurity and then placing them in government positions at the start of their careers.

Teaching the Teachers About Cybersecurity

All sectors - not just the government - face challenges in boosting their cybersecurity staffs. A major roadblock is the dearth of qualified educators to train cybersecurity specialists.

"High schools and universities are being challenged to introduce cybersecurity to the nation's next generation in order to create a substantial pipeline of inspired cyber students," says Rick Geritz, CEO of the online learning platform LifeJourney. "The reality is that high schools and teachers lack cybersecurity skills and training."

Geritz suggests in his testimony that mentoring by cybersecurity specialists can play a role in addressing the shortage of qualified educators.

"Evidence informs us that mentoring is critical - to both students and teachers - to imparting up-to-date knowledge about the field, the marketplace needs and career opportunities," Geritz says. Mentoring programs "must be designed to facilitate the spirit of collaboration among all participants committed to the universal goal - to optimize the national - and ultimately the planetary - human capital base."

In his testimony, Geritz cites studies that show significant mentoring relationships help drive individuals into specific careers.

Geritz also recommends offering cybersecurity training for all teachers, irrespective of their background or current assignments. Such training, he says, would enable more educators to inspire students to become part of America's digital economy. He also suggests a "day of cyber," which would expose all students to cybersecurity skills so they'd understand the career opportunities in the field.

Seeking Well-Rounded CIOs

Karen Evans, a former federal CIO who heads the U.S. Cyber Challenge, a program of competitions and encampments aimed to attract young people to cybersecurity workforce, testified about the skills federal agencies' CIOs are lacking.

"Many CIOs argue they don't 'have a seat at the table,'" Evans says. "I would argue that a seat at the table is earned by having the skills and abilities to contribute to the agency's mission - including protecting the agency from threats."

Federal law assigns responsibility for agencies' IT security to their CIOs. Evans points out that CIOs serve as strategic advisers to the heads of federal agencies regarding the use and management of information while managing the risk associated with use of technology to provide the mission services.

Evans says the commission in its findings should urge rigorous enforcement of federal rules that CIOs possess the technical and policy skills needed to serve their agencies.

"The skills set needed by the CIOs includes more than just understanding policy," she says. "CIOs who have technical skills and understanding combined with the good communications and interpersonal skills will be successful."

Commission Mandate

President Obama, in an executive order issued in February, created the Commission on Enhancing National Cybersecurity, requiring it to submit a final report by Dec. 1 with recommendations for how the government and private sector can strengthen cybersecurity over the next decade while protecting privacy, ensuring public safety and economic and national security (see Cybersecurity Commission Includes Former Heads of NSA, NIST).

Exploring ways to strengthen the cybersecurity workforce is only one component of the commission's charter. In developing its recommendations, the commission will identify and study advances in technology, management and IT service delivery that should be developed, widely adopted or further tested throughout the government and private sector.

Cybersecurity , Fraud , Technology

Presented by SAS     60 Minutes     How Has Enterprise Mobility Forever Changed the Way Your Enterprise Conducts - and Secures - Business? Only 34 percent of surveyed security leaders say they have high confidence in their organization's ability to detect and prevent fraud before it results in serious business impact. Among the reasons why they lack confidence: Today's fraud schemes are too sophisticated and evolve too quickly (56 percent of respondents) Customers and/or partners lack sufficient awareness to protect themselves from socially-engineered schemes (56 percent) Employees lack that same awareness (52 percent) These are among the results of the 2016 Faces of Fraud Survey, sponsored by SAS and focused on The Analytics Approach to Fraud Prevention. Attend this session to learn: The top forms of fraud afflicting financial and government organizations in 2016 Biggest gaps in organizations' efforts to detect and prevent fraud How organizations are leveraging new data analytics tools to improve their abilities to spot and then stop today's top scams ISMG has conducted the Faces of Fraud Survey for seven years now, but this is the first time under SAS sponsorship and with a focus on - as the title says - the Analytics Approach to Fraud Prevention. Some statistics that jump out from this study: 67 percent of respondents say it takes one day or more to uncover a fraud incident once it occurs 56 percent say customers and/or partners lack sufficient awareness to protect themselves from socially-engineered schemes 54 percent are not currently deploying advanced data analytics tools Encouraging news from the survey results? Forty-six percent of respondents say they actively deploy advanced data analytics to monitor transaction/program activity and predict the likelihood of fraud. But there is also concerning news: Forty-two percent say they lack the staff expertise to successfully deploy advanced data analytics tools; and 45 percent say their current systems allow for only limited analytics. Register for this session for a detailed look at the forms of fraud afflicting financial and government organizations; their current security controls - and gaps; and where they plan their biggest anti-fraud investments for 2017. You might also be interested in … Clinic Reports Security Incident Involving HIE Access

Privacy , Risk Management

Cover up your webcam.

See Also: Protecting Your Assets Across Applications, Services and Tiers

So says FBI Director James Comey, who argues that it's a no-brainer to cover up "the little camera things that sit on top of the screen," also known as a webcam.

"You go into any government office and we all have the little camera things that sit on top of the screen," Comey said earlier this month at a Center for Strategic and International Studies conference, The Hill reports. "They all have a little lid that closes down on them. "You do that so that people who don't have authority don't look at you. I think that's a good thing."

Equating it to locking your car or your house doors at night, or activating your home alarm system, Comey said covering up webcams was likewise prudent.

"There're some sensible things you should be doing, and that's one of them," he said.

Comey's move to cover up his personal laptop's webcam has drawn comment from some privacy advocates, who contend that it represents a double standard from the man who wants the likes of Apple to only employ weak crypto to help law enforcement agencies intercept communications and data, with a court order, during the course of an investigation.

But the advice is sound. As with so many things relating to prudent internet security, Mikko Hypponen, chief research officer at Finnish security firm F-Secure, has also long espoused covering up your webcam. He employs a Band-Aid for the purpose.

My webcam band-aid made it to the Sydney Morning Herald: http://t.co/ysWwzaihJp

Social Network King's Cover-Up

Beyond information security cognoscenti circles, the practice of covering your webcam exploded into the limelight earlier this year, when a picture of Facebook CEO Mark Zuckerberg at work revealed that his laptop's webcam and microphone were covered with tape.

3 things about this photo of Zuck:

Camera covered with tape
Mic jack covered with tape
Email client is Thunderbird pic.twitter.com/vdQlF7RjQt

For the head of a company recently valued at $350 billion, and which acquired WhatsApp for $19 billion, being the target of advanced surveillance - by nation-states, or unscrupulous competitors or traders - seems a likely possibility.

Sextortion Concerns

But as Comey has suggested, the practice of covering up your webcam shouldn't be restricted to the domains of social networking kings or ponytailed cybersecurity gurus.

For years, many types of malware have included the ability to not just find and exfiltrate financial data, but also to log keystrokes, capture screenshots and more important for this discussion, remotely activate microphones and webcams, while disabling any notification light indicating that the webcam might be active.

Sextortionists have also been known to hack into webcams, especially targeting women and children. In 2013, one Finnish hacker told the BBC that the going rate for selling access to a woman's webcam was just $1.

This access could then be used to attempt to blackmail victims into sharing more explicit images, for example, by attackers threatening to release what they've already captured to victims' friends and family. But as the BBC notes, some people also trade in these images and videos via website forums devoted to "female slaves."

Low-Cost Security Defense

But there's a simple defense. And as Hypponen and Zuckerberg's approaches reveal, covering up your webcam needn't be an expensive proposition, although you can always splash out for custom-made gizmos that promise additional color or excitement.

For do-it-yourself types, however, a Band-Aid with its non-sticky middle - or something similar, made from electrical tape - works just as well. Either approach won't gunk up the webcam lens and for laptop users, should ensure that your screen can still close.