For the past few weeks I have been in various events in the car sector And I wanted to tell you one of them that I thought particularly interesting, Automotive CyberSecurity Summit 2018 organized by the SANS Institute Chicago.

In this event they have become some general concerns of the car sector but the most interesting thing has been the American view since They do have autonomous cars running in some cities., so they see the future something closer than we Europeans… they already speak for example of smart cities connected to cars and sharing data in real time about traffic or weather to adapt traffic lights and car browsers, talk about smart self-employed buses capable of going to other lines with higher demand to meet

specific requirements and (this is going to love the electric car owners who suffer the problem every day) talk about standard recharge points capable of identifying the vehicle to then issue the invoice or be able to pay on it with a standard method (named Apple Pay, which we talked about a few months ago) without the owner having to carry hundreds of different cards.

Post-accident or post-crime forensic analysis

Already entering the most technical part, the people of Berla presented a hardware device that connects to CANBUS and infotainment of the car to perform a post-accident or post-crime forensic analysis to know where that car has gone and what actions it has taken. The device is able to collect information from a lot of car and browser sensors and then correct all that information and give a detailed report of the type ‘At 20: 00 has been set up, has gone 14 kilometers to stop at the gas station not even?

No gas has been put in but the door of the escort has been opened and someone has been picked up because the seat has detected the weight change and carried for 10 kilometres until the door of the companion has been reopened. He has been detained for X minutes and then followed the march to point B ‘. It may be very interesting for such cases of use.

What about legal compliance?

The point is, after this talk, I had a lot left. doubts about the storage of data in the car. Do you think it will be?GDPR compliant‘that our car’s browser stores all that unencrypted information? In fact, it’s not just that I store all that information, it’s that if our mobile is connected by Bluetooth the browser generates a copy of our connections that it stores in local, without any protection… and if our mobile is able to connect by

intl / es _ es / auto / «rel =» noopener «target =» _ blank «> Android Auto or Apple CarPlay (i.e. that it is fully integrated with the vehicle for example to read to us the messages that arrive in real time and to be able to answer them with the voice), the system stores a copy of all those messages received and sent… It’s not that cool, is it?

If you think it’s your own car and that access to it is limited, you may sleep a little bit quieter that night… but… What if it’s a rental or rental car you’re going to return? No. There should be a rigid way to encrypt those data so that no forensic analysis could be done or that they could be deleted in a SAFE way when you are no longer using that vehicle.? Well, it’s not like that at the moment…

Same usual attacks

Besides the forensic analysis that I found more innovative, the other technical talks did not surprise too much. People of GRIMM, despite having an environment mounted the sea of painted with several ECU connected, they showed the always known attacks of denial of service (do you remember what a DoS denial of service is? We talked about it some time ago in this entrance.) and injection of men

seages in CANBUS:

So nothing new under the sun, no new to highlight… I hope in the Black Hat of August in Las Vegas something new will come up, I will tell you because I will also be there;)