As recently as six years ago, the automotive industry didn’t consider cybersecurity an issue and most industry insiders had the unfounded feeling that their automotive-grade car software would be resilient against hacking attempts. As it turned out, this intuition wasn’t shared by security researchers who proved they could bypass existing simple protections to take over remote control of nearly all aspects of a car, including the accelerator, brake, and steering. It’s now a given that cars must build in cybersecurity protection. This is even more the case for electric and self-driving vehicles that are fully dependent on computerization.
At BlackBerry, we provide EV makers (and automakers of all kinds) with the necessary software to ensure the security of their cars and their data communications. Read on to learn how.
Defense in Depth
An electric vehicle (EV) design needs to incorporate cybersecurity during the planning stages. The best practice for a cybersecure design is an approach initially conceived by the NSA called defense in depth. Just like a medieval castle’s security uses several difficult-to-penetrate layers – deep moats, raisable drawbridge, thick stone walls, and archers on turrets – a cybersecurity strategy using defense in depth provides multiple layers of defense against hacking.
Our deep security credentials come into play when safeguarding software as it’s built, protecting communication channels, actively monitoring intrusion attempts, and encrypting key components throughout the manufacturing process. With security products and services at multiple levels, BlackBerry helps EV makers build cars that adhere to a defense-in-depth design.
Rooting Out Vulnerabilities
One of the most important things that software developers can do to ensure their products are secure is to make sure they’re updated with the most recent security patches. When building software for a modern vehicle, that’s far easier said than done. To give an idea of the scope of the problem, there are over 11,000 publicly disclosed vulnerabilities for 2021, as of mid-March. A complex piece of software for an infotainment system may contain hundreds of software third-party modules, and there are dozens of vehicle modules to consider. Failure to check and update each piece of software provides openings for hackers to potentially exploit those vulnerabilities.
That’s precisely the job of BlackBerry® Jarvis®, which uses a constantly-updated cloud-based system to scan and flag software for security vulnerabilities. As a consistent part of the software build process, BlackBerry Jarvis can automatically keep software secure from all known issues. Doing this manually would be exceedingly difficult, impractically long, and error prone – if indeed possible at all.
Another strength of BlackBerry Jarvis is that it scans the compiled binary images, not the human-readable source. This allows it to work despite the complexity of the automotive software development supply chain. An automaker may get their software from several tier one companies, who in turn source software from a host of tier two suppliers and open-source projects. To maintain their intellectual property, most software suppliers don’t provide their software’s source code, a form readable by humans. Because any human-based security scanning is nearly impossible to fully incorporate across all parties and software components, BlackBerry Jarvis fills a much-needed hole.
Detecting Intruders
Active defense is an important part of a cybersecurity strategy. If the system is being tampered with, you don’t want it to sit passively until the hacker’s break-in attempts are finally successful. Intrusion detection and adaptation can be a very successful means of thwarting misuse of any computer system – especially one that’s moving at highway speeds.
Here's where BlackBerry brings BlackBerry® Persona to the EV maker’s rescue. Originally built to ensure enterprise-level security for the thousands of mobile phones deployed by IT departments, BlackBerry Persona has been adapted for the vehicle environment too. By using machine learning to learn a system’s user-unique patterns, it can recognize events that deviate from normal behavior. Once anomalous behavior is recognized, BlackBerry Persona can dynamically modify security policies to introduce roadblocks. And in cases where car applications do not have a safety-critical function – such as streaming music services or third-party apps – BlackBerry Persona can quarantine those applications so they cannot affect the system. Coincidentally, this type of software is one of the more likely vectors of attack.
Authenticating from Plant to Cloud to Car
How does each part of an EV maker’s ecosystem fit together? There are a lot of technologies that are needed to secure data at the manufacturing plant, provide unique part certificates, encrypt data streams, and authenticate cars and cloud-based services. Many EV makers rely on Certicom® by BlackBerry to provide these vital services, helping them manage, track, and protect their assets regardless of where they are in the chain.
A unique challenge introduced by EVs is securing charging stations. Because an EV charging station is a link between the vehicle and the power grid, it is an access point that can be exploited by attackers looking to steal personal data, skim payment information, gain access to home networks, or even manipulate the grid. A vulnerability in one area could expose the whole system. With Certicom technology, these crucial infrastructure pieces can be additionally protected to ensure all parties connected through a charging station are valid, trusted entities.
Always Connected
The modern EV depends on connectivity. It provides many benefits such as vehicle infotainment systems, map updates, and predictive maintenance. It also enables cloud-connectivity for automaker services, news, and media streaming. However, this opens avenues for cellular data attacks.
While connectivity may create a risk of unwelcomed access, it also provides the mechanism to secure against this risk. One of the most fundamental tenants of secure software is that all vulnerabilities must be removed by applying software patches. BlackBerry® QNX® provides custom over-the-air (OTA) solutions for automakers to deploy updates to the car, patching software as soon as new vulnerabilities are detected. This keeps the car safe by removing all known vulnerabilities while minimizing the time malicious actors can exploit uncovered risks.
How can the vehicle keep its connection to the cloud from being tampered with? The connection needs to validate the parties on each end of a discussion are who they say they are. It also needs assurance that messages aren’t tampered with to prevent man-in-the-middle attacks that can inject or modify messages. These features are precisely the point of QNX® Black Channel Communications Technology, which defends against many types of cybersecurity issues that can affect a data channel like corruption, repetition, loss, insertion, resequencing, masquerading, and more. This allows automakers to trust the connection to their cars for secure OTA software updates and vehicle data uploads.
Driving Security Together
Automakers of all types – traditional, new mobility, electric, and ICE – continue to work to strengthen the security-related resilience of their processes and products. As automotive cybersecurity regulations become established worldwide, it will become increasingly important for automakers to work with security companies that understand every piece of the exceedingly complex security domain.
However, it’s also important for successful design and deployment that these security suppliers understand the structure and nuances of the automotive industry. That’s why 23 of the top 25 EV OEMs choose BlackBerry technologies to secure their cars. That’s just one reason – our white paper outlines many more on Why BlackBerry QNX Has Become a Leading EV Automotive Software Supplier.
