Tesla's response to hacked car offers a road map for fast fixes

[WASHINGTON] Cybersecurity researchers on Friday are publicising software flaws in the Tesla Model S that could allow remote hackers to shut down a moving car's engine.

But owners of the high-tech luxury sedan had little need to worry. The electric-car maker quickly deployed a fix over the Internet. As cars loaded with on-board computers increasingly add wireless connections they are becoming more vulnerable to hackers, as seen recently with a Jeep Cherokee. Tesla's response offers a model for how other automakers can address the increasing threat of computer attacks. Tesla owners get prompted on their cars' infotainment screens to download software updates, the same way smartphone users do.

The consultants who found the Model S flaws - Kevin Mahaffey, co-founder and chief technology officer of Lookout, and Marc Rogers, principal security researcher for CloudFlare - revealed the vulnerabilities earlier this week ahead of a presentation Friday at the DefCon hacker conference in Las Vegas. The pair discovered six key weaknesses in the vehicle, alerted Tesla Motors Inc. and coordinated their disclosure with a fix from the automaker to reduce the risk to owners of the car, which starts at US$70,000.

Two-Edged Sword Such responsible disclosure, as the process is known in the cybersecurity community, is common in the computer industry. Tesla is unusual in the automotive industry for its ability to update owners vehicles quickly over the Internet. That ability cuts both ways, however; if an automaker can gain access to vehicle electronics from afar, so, too, could a malicious hacker.

Fiat Chrysler Automobiles NV was told to recall about 1.4 million vehicles last month to update software after researchers remotely hacked a Jeep Cherokee traveling at 70 miles per hour and caused it to run off a freeway in a demonstration for Wired. The automaker patched its software by mailing out USB drives to be plugged into vehicles.

That hack, which worked by scanning a cellular network to locate and disable Jeeps, showed that wireless connections are the weak underbelly of high-tech cars. Such attacks are potentially more dangerous than the method in the Tesla hack, in which the researchers had to have physical access to tamper with the car's electronics.

Software Vulnerability Tesla's ability to to send a fix quickly over the Internet should be a model for other automakers, Mahaffey wrote in a blog post.

"In order to realistically patch vulnerabilities at the frequency they are discovered, manufacturers must implement an over-the-air patching system into every connected car," he wrote. "When a manufacturer realizes that a software vulnerability affects their vehicles, they can deploy a patch immediately in a matter of days without the owner having to return to a dealership, receive a USB drive in the mail, or have their car completely recalled."

Tesla works closely with security researchers and emphasized that the vulnerabilities revealed this week required physical access to the car, a more difficult scenario than hacking over the airwaves, the Palo Alto, California-based company said in a statement. Chris Evans, head of security for Google Inc.'s Chrome browser, said recently that he is joining Tesla to lead security efforts.

While Tesla's quick response to the hack was reassuring for its customers, cybersecurity experts said the industry has a long way to go.

Automakers need to start thinking about how to compartmentalize vehicle electronics so that if hackers penetrate an infotainment system they can't also gain access to the engine or steering system, said Ulf Lindqvist, a programme director with SRI International, a technology research firm.

"We've been doing 'penetrate and patch' for years," said Mr Lindqvist, who is working with the US Department of Homeland Security on researching new technologies for automotive security. "Once they get in somewhere, you are kind of doomed. We need to build systems that are more resilient. When you have systems that human lives depend on, 'penetrate and patch' is not enough."

BLOOMBERG