By Cortney L. Bolden, Ph.D.
Faculty Member, School of Science, Technology, Engineering and Math at American Military University
Technology advancement is rapidly improving by leaps and bounds. We are now able to set our alarms for homes without even being physically present. Our cars will parallel park for us with the touch of a few buttons. Our cellphones can detect our heart rates, blood pressure, and tell us how much water we need to drink to stay hydrated. The common phrase for the transformation of technology is “Technology is getting smarter.” The question is how exactly is technology becoming smarter or intelligent? The current means for a ‘smarter’ device is the ability to program, control or transmit information remotely or wirelessly.
For instance, Samsung currently has a refrigerator with an embedded touch screen that connects to the Internet and lets users shop straight from their fridge. Additional features include a washer/dryer manager that allows users to check out how much time is remaining on a load; it also includes a TV by streaming from other TVs in the house; and a convenient grocery manager keeps track of how much food you have and the expiration dates of various products. I can remotely tell my refrigerator to order more groceries. These are some absolutely awesome and relevant features. But with such awesome features comes incredible risks. The potential risk of breaching a smart refrigerator or any other Internet-connected device, is a hacker can steal an owner’s personal identification data like their Social Security number, address, or bank information.
Whether it’s the household appliances, automotive, defense, or the health industry, almost any device which has a computer system or is connected to a computer network is susceptible to possible hacking or cybersecurity attacks. Recently, more than 69,000 medical devices were reported wirelessly hacked. These devices include patient monitors, infusion pumps, ventilators, pacemakers, MRIs, and several medical device software apps ranging from automated diagnosis of disease to medical billing. It is standard that most of these types of devices communicate wirelessly. Can you imagine having your medical diagnoses changed based on falsified information? Potential risks associated with networked medical devices include electromagnetic interference, untested or defective software and firmware, theft or loss of networks medical devices, security and privacy vulnerabilities, unauthorized device setting changes, reprogramming, or infection via malware, denial-of-service attacks, targeting mobile health devices using wireless technology to access patient data, monitoring systems, and implanted medical devices. Several cases have been reported and more vulnerabilities are still being discovered.
Let’s take a look at the automotive industry. Besides the mobile phone industry, the automotive industry is becoming one of the fastest growing areas for ‘smart’ technology. These more intelligent cars have more high-tech comfort, entertainment, and functionalities than ever before. While many cars have partial ‘smart’ or automated components such as intelligent keys for hands-free door lock and un-lock capabilities, eco-fuel systems, adaptive cruise control, digital instrumentation, head-up instrumentation display, some cars can give route information using GPS, sense objects, warn drivers of impending collisions, automatically signal for help in emergencies, keep drivers alert, and in the very near future be able to ultimately take over driving. We are embarking on the age of the completely self-driving car. Google has made significant progress on the self-driving technology over the past 6 years. They have fielded 82 self-driving cars on the highways of Mountain View, CA and Austin, TX. Google cars have driven a total of 1,210,676 miles in autonomous mode. “Autonomous mode” means the software is driving the vehicle, and the test drivers are not touching the manual controls.
But not only is Google developing self-driving cars, so are other automobile manufacturers. Audi AG has the self-driving A7 car, which traveled from California to Nevada, covering 550 miles. The A7 was able to drive by itself below speeds of 70 mph, change lanes, pass vehicles on the road, and change acceleration when needed. Hyundai has a semi-autonomous car called the Equus, which allows self-driving in cities where stop-and-go driving at lower speeds is required. Also, Toyota has the Highway Teammate, which is equipped with sensor’s to help “see” its surroundings, including other vehicles, obstacles, and lanes. Drivers can activate the automated driving feature upon leaving the toll gate and entering the highway on-ramp. The car can then take the wheel all the way up to the off-ramp, where the human driver re-takes control.
Self-driving cars are definitely going to be mainstream technology very soon. But what are some of the security challenges with such intelligent and well-connected technology. One big risk is vulnerability to hackers. Modern automobiles are complex distributed systems in which virtually all functionality—from acceleration and braking to lighting and HVAC—is mediated by computerized controllers. The interconnected nature of these raises obvious security concerns which have demonstrated that vulnerability in any single component may provide the means to compromise the system as a whole. In a 2011 Ted Talk, Avi Rubin of Johns Hopkins University graphically explained that an automobile is a basic target. The modern automobile has several onboard computers which are connected by an internal wired network. There is also a wireless network in the car, which can be reached from many different ways. Some of those ways include Bluetooth, FM and XM radio, actual Wi-Fi, and also sensors in the wheels that wirelessly communicate the tire pressure to a controller on board. These are all potential points of infiltration into the car’s multi-computer system-of-systems.
How exactly will a hacker actually launch an attack on a vehicle? Well, a few researchers decided to investigate and setup a hack to attack on both the wired and wireless networks of an automobile. They had two areas to attack. One was short-range wireless, where one can actually communicate with the device from nearby, either through Bluetooth or Wi-Fi, and the other is long-range, where one can communicate with the car through the cellular network, or through one of the radio stations. Think about it. When a car receives a radio signal, it’s processed by software. The software has to receive and decode the radio signal, and then figure out what to do with it. Even if just music is played on the radio, the software is used to decode it. If there are bugs in it, a vulnerability can be created and used to hack the car. The researchers performed their investigation by reading the software from the computer chips in the car (i.e. CAN bus—CarShark), and using sophisticated reverse engineering tools (i.e. IDA Pro) to figure out the functionality of the software. Then they found vulnerabilities in that software and were able to exploit those vulnerabilities.
Believe it or not, this attack was actually carried out in real life. The researchers sought to find out what could happen if an attacker actually got access to the internal network of the car. So just imagine that someone gets into your car and messes around with it, and after they leave, your car starts having trouble. Researchers used a laptop which they connected to the diagnostic unit on the car’s network. They did all kinds of interesting things, such as cause the speedometer to show 140 miles an hour when the car’s in park. Other things they were able to do was disabling the brakes, installing malware that would only trigger if the car was going over 20 miles an hour. The results are astonishing. Basically, they were able to use real commercial cars and take over a bunch of critical computers inside the car: the brakes computer, the lighting computer, the engine, the dash, the radio, etc., using the radio network. Every single one of the pieces of software which controlled the wireless capabilities of the car were compromised. In fact, there have been several investigations where cars have been hacked just using an iPad. According to another recent investigation by a Massachusetts senator, which was air by CBS’s 60 Minutes, technologists at the Defense Advanced Research Projects Agency (DARPA), were able to remotely control the brakes, acceleration and windscreen wipers of a production vehicle.
All of the previously discussed car hacks were implemented successfully on a manned or manually operated car, now what about an unmanned or autonomous car. Can you imagine how many networks this type of car has to possess. There is constant communication from one computer to next on board a self-driving car. In a recent IEEE spectrum magazine article, researchers explained that hackers can easily trick self-driving cars into thinking that another car, a wall or a person is in front of them, potentially paralyzing it or forcing it to take evasive action. This is possible because of the sensor networks onboard a self-driving or autonomous car. The lidar sensor which sits on top of the Google car and other automated cars uses spinning lasers to radar, detecting objects and building a 3D image of the world around the car. But a tool similar to a laser pointer, which costs less than $60, can be used to confuse the lidar. Hackers can use low-power lasers to trick the lidar into detecting echoes of fake objects, such as pedestrians, cyclists, other cars or walls. This type of attack can be carried out from behind, in front or from the side of the car and without alerting the car’s passengers. Because the autonomous car is programmed to be cautious of any objects where it could possibly cause harm, the car can be brought to a stop, tricked into taking evasive action or into turning in a certain direction by placing the ‘spoofed’ objects in their paths. Now this does not sound too farfetched right? Think about your GPS navigation device. When it thinks you have turned on a neighboring street or a certain direction, it will immediately start to re-route you right? This is very similar with self-driving cars.
Now if an unmanned car can have such vulnerabilities because of the wireless networks, can you imagine the risks with an unmanned aerial vehicle (UAV) or drone. On December 4, 2012, Iran allegedly hijacked and navigated a US RQ-170 drone to the ground by manipulating the aircraft’s GPS coordinates. Although, the CIA denies this happening, it is certainly possible with certain vulnerabilities. One of these vulnerabilities is the leak of encrypted GPS signals. A drone can be fed fake GPS coordinates and basically deceive the on board system and therefore hijack the vehicle in a different place for which it is intended to land. The GPS receiver installed on the UAVs works exactly as other GPS devices, observing the signals from a set of satellites and using the relative delays of the signals to solve equations, which determine the position of the vehicle and the time offset of the receiver. In the attack scenario, the UAV uses a GPS localization system and is synchronized to the legitimate satellites. The attacker starts sending different spoofing and jamming signals forcing the UAV to synchronize to the counterfeit signals.
Drones acquire information from using various sensors, GPS systems and cameras. The in-flight communication of UAVs is always wireless and may be divided into direct, line-of-sight (LOS) communication and indirect—mostly satellite communication (SATCOMM). Figure 1 displays the information flow between components of the UAV system. The high interdependence on sensors and communication channels puts the UAV at high risk. The way UAVs are secured is through encryptions. But there is software worth just $26 able to disable encryption of the communication link.
Figure 1. Information flow between UAV components and the ground station
Another unmanned platform susceptible to cybersecurity vulnerabilities are robots. Robots come in many different shapes and sizes and are used for a host of applications. Remember, just like the ‘smart’ refrigerator or television, cars or UAVs, robots communicate over networks and multi-computer systems and require some type of cybersecurity to prevent mishaps. A hacked service robot, could injure a family member, dispense the wrong medication or even provide a hacker with a detailed map of your home. Industrial robots can leak intellectual property. Both domestic and military robotic systems should apply security solutions resistant to hardware for irreversible configuration and tamper detection. Can you imagine if someone intercepted a military robot and reconfigured it to begin collecting information for the enemy?
About the Author
Dr. Cortney Bolden awarded a bachelor’s degree from Southern University and A&M College in Electrical Engineering. She received her Master’s and Doctoral degrees in Electrical Engineering from North Carolina A&T State University with concentrations in Control Theory and Unmanned Systems.Dr. Bolden’s greatest passion is to open the world of math, science, and engineering to students who may be behind in the fundamentals and use robotics and technology to ignite their interest. She has seen students achieve incredible success simply because they were able to see how math and science relates to building a robot.
Comments are closed.