Out of Control in the Driver’s Seat
You’re tooling down the highway when suddenly your car’s A/C turns on to full blast. Then the radio fires up and switches to a Hip-Hop station.
You’re startled when the wipers turn on, wiper fluid obscuring your view of the road for a moment.
You’re frantically trying to turn it all off when your car loses power completely, leaving you stranded on a busy stretch of road with no shoulder, a semi closing in fast from behind you.
That sounds a little a scene from a spy thriller or maybe even the “X-Files,” but it happened to the driver of a 2014 Jeep Cherokee as researchers Charlie Miller and Chris Valasek hacked into and took control of it.
The duo found a way to hack in wirelessly, exploiting a widely used onboard entertainment system to take over a vehicle’s dashboard functions, brakes, steering and transmission.
Miller and Valasek first made headlines in 2013, when they publicized their success hacking into Ford and Toyota models. At that time, they only managed to accomplish the attacks while their PC was plugged into the vehicles’ diagnostic ports.
Only two years later, the duo found a way to hack in wirelessly, exploiting a widely used onboard entertainment system to take over a vehicle’s dashboard functions, brakes, steering and transmission.
They found they could do it from absolutely anywhere, so long as they had an internet connection. Most disturbing of all, they identified a loophole that could be used to attack multiple cars at once — creating a wirelessly controlled automotive botnet encompassing hundreds of thousands of vehicles.
The team published part of the project online and later demonstrated their “progress” at the 2015 Black Hat conference.
Without question, the more technologically sophisticated and connected vehicles become, the more vulnerable they get.
After Miller and Valasek published their results, Fiat Chrysler issued a recall for 1.4 million vehicles affected by the vulnerability exploited by the team. The automotive industry has been on high alert ever since, even while they simultaneously boast about models equipped with more and better technology.
Without question, the more technologically sophisticated and connected vehicles become, the more vulnerable they get. The push toward autonomous vehicles will only increase those vulnerabilities.
“We are a long way from securing the non-autonomous vehicles, let alone the autonomous ones,” said Stefan Savage, a computer science professor at the University of California, San Diego, during an Enigma security conference early this year.
Autonomous isn’t necessarily synonymous with “connected,” however, even for early entrants to the commercial autonomous vehicle space.
Daimler’s Freightliner Inspiration, the world’s first road-ready self-driving truck, “doesn’t rely on ‘connectivity’ or wireless communication to/from the outside world to drive itself,” said Dan Holden, manager of corporate risk and insurance for Daimler Trucks North America.
“Rather, the system is self-contained, meaning it uses production cameras and radars as inputs to determine the vehicle position and keep it centered in its lane. Therefore the Inspiration truck is as secure from a cyber perspective as production vehicles today.”
More Frightening Than Fiction
Until cyber vulnerabilities can be addressed, it doesn’t take a broad stretch of the imagination to see what the future implications could be for this type of attack. Consider a few scenarios:
- The vehicle of a courier transporting sensitive documents is disabled in a remote location, where armed thieves are waiting to steal the documents.
- A high-level executive receives a message alerting him that ransomers have control of his teen daughter’s car — with her in it — and will drive it off of a bridge if he doesn’t pay $10 million in Bitcoin.
- A ring of thieves finds a way into the systems of a trucking fleet’s rigs through its onboard camera system, enabling it to stop the trucks remotely so teams can hijack the cargo.
- An extreme hactivist group decides to “brick” every car in Los Angeles, disrupting businesses and lives until its demands are met.
- An attacker hacking into a commercial truck’s system disables the brakes, sending the truck careening into a school bus in the middle of an intersection.
Keep in mind that even less extreme types of hacking could create vulnerabilities for both individuals and businesses.
Miller and Valasek proved their ability to wirelessly hack a vehicle for surveillance, tracking GPS coordinates, measuring speed, and tracing routes. When a vehicle’s onboard systems are connected to the driver’s smartphone, the smartphone is also at risk for attack, and any data stored in it is fair game, including passwords and credit card information.
Government and Industry Respond
Miller and Valasek’s work is part of what inspired the drafting of an automotive security bill introduced last year. The Security and Privacy In Your Car Act (the SPY Car Act) would require cars sold in the U.S. to meet certain standards of protection against digital attacks and privacy.
The bill’s creators surveyed 20 carmakers and discovered that only seven used independent security testing to check their vehicles’ security, and only two had tools in place to stop a hacker intrusion.
Several Japanese companies are working on automotive cyber security technology.
In March, the FBI, along with the Department of Transportation and the National Highway Traffic and Safety Administration, published an advisory on the realities of hackable vehicles and making recommendations to increase security.
Several Japanese companies are working on automotive cyber security technology. Panasonic is developing a device that can detect unauthorized network signals and cancel them out. Fujitsu Laboratories and a researcher from Yokohama National University are developing technology that detect an attack, notify the driver, and encrypt signals to allow the vehicle to be stopped safely.
However these technologies are still five years away from commercial availability, as are fully encrypted next-generation automotive networks.
Transportation companies, their clients and every organization with a fleet of its own should be asking questions about the security of the vehicles that are used in the course of their daily operations — and whether they have cover that will respond if their vehicles fall prey to cyber tampering.
“Having insurance coverage in place that would address bodily injury and property damage is something companies should seriously consider as this risk matures,” said William A. Boeck, senior vice president. and insurance and claims counsel for Lockton’s cyber risk practice.
Kick-Off With a Bang
The opening reception of RIMS 2016 on 5th Avenue in San Diego’s Gaslamp Quarter included an unfortunate twist when some attendees were injured toward the end of the festivities.
A fireworks display, lit from a roof near Dick’s Last Resort, went awry, and a few fireworks were misdirected into the crowd.
An errant firework landed in the crowd near Safety National employees. One was treated and released while two others suffered burned clothing. Those in the immediate vicinity were understandably shaken up.
— Share911 (@Share911) April 11, 2016
“It’s unfortunate when things like this happen at events and I am sure there will be a lot of review of how things like this can be prevented in the future,” said Mark Walls, VP of communications and strategic analysis at Safety National. “This is a good example of how risk management will respond in terms of making sure this doesn’t happen again.”
Additionally, witnesses say a risk management student suffered burns and stayed the night in a hospital.
RIMS is currently working with the fire marshal, which is investigating the incident.
RIMS could not yet offer official comment. But given the savvy of the professionals involved, there’s little question that the proper contracts and policies are in place to protect people and property and ensure that any damage is addressed swiftly.
Executives Focus on the Next Generation
As you might expect, cyber, new technologies and the M&A environment dominated the conversation at the Senior Executive Forum on Tuesday morning at RIMS 2016 in San Diego, led by the CEOs of four major brokerages and four major carriers.
But the industry’s ability to replenish itself through the infusion of young talent took a prominent place with both panels.
Executives spoke at length about the challenges of recruiting and retaining millennials, often speaking directly to the millennials in attendance – members of Gamma Iota Sigma, the international collegiate professional fraternity for students pursuing careers in risk management, insurance and actuarial science.
CEOs said the industry is working hard to replenish itself but acknowledged that there’s a lot more work to be done. One sobering figure cited suggested that for every young person entering the industry, there are three retiring.
Todd Jones, co-head of North America for Willis Towers Watson, said that the university-level environment is on a growth trajectory, adding that “our business is becoming more analytical and more quantitative” and that educational institutions are doing a very good job of responding to that.
“We have a lot of work to do to see people through the life cycle of the industry.”—Todd Jones, co-head North America, Willis Towers Watson
Recruiting is only part of the challenge. Steven McGill, group president, Aon plc, cited a jarring statistic that 60 percent of those coming into the industry are leaving after two years.
“We have a lot of work to do to see people through the lifecycle of the industry,” said Jones.
The industry has a great deal to offer young professionals, executives said.
“This is the best business on the planet,” said J. Patrick Gallagher, chairman, president and CEO, Arthur J. Gallagher, echoing the feeling of executives on both panels.
“It is one of the most extraordinary industries,” agreed McGill, noting that the insurance industry makes a “phenomenal impact” on both individuals and society.
However, Jones noted that a significant number of young professionals coming into the industry are leaving in their late 20s, in some cases to work for nonprofits, gravitating toward work they perceive as more fulfilling.
So there is a discrepancy of perception that the industry still needs to overcome, and it needs to carry the message about how insurance serves communities through company recruiting, training and retention.
Co-moderator Noelle Codispoti, executive director of Gamma iota Sigma, interjected that the industry as a whole would be well served by putting a greater emphasis on internship opportunities, allowing companies to shape student perceptions of the industry early. That also creates ambassadors who can then help change the perceptions of their fellow students.
“Recruiting practices do need to change,” she said, noting that only 60 percent of graduating Gamma Iota Sigma seniors had been afforded an opportunity to learn about the industry through an internship experience.
Executives discussed other ways to reshape the onboarding process in order to better connect with a millennial population.
“We need a 20th century approach,” said Donald Bailey, president, global sales, Marsh, explaining that organizations can no longer rely strictly on traditional classroom or seminar-style approaches and expect that it will work magically “like pixie dust.”
A more modular and interactive approach is needed: one that is portable and that young people can access from anywhere, he said.
Other executives noted the need to leverage millennials’ affinity for work in team settings.
Executives reflected on the enormous value of the training they received themselves when they were starting out.
“I would not be sitting here today,” said Bailey, had it not been for his experience with Chubb at the beginning of his career.
“Thank God Chubb hired me and put me in a training program.”