A clear, but not yet present, danger
"We can remotely stop the brakes on a car from 1,000 miles away, but it's not a clear and present danger today," Savage explains.
Doing this kind of a hack requires a large investment of time and money. "You need to buy the kind of car you want to hack," says Savage. "You have to be really motivated to do this; it's not something someone will do as a hobby. Because of the time and money involved, I don't think it's an imminent problem."
Although hacking into fleets may not present an immediate danger, manufacturers are taking this research seriously, says Savage. "Every manufacturer we are aware of is putting substantially more research into security than they have in the past. The challenge is they've never had to think about this before at all."
The good news is that car manufacturers can ramp up very quickly by adapting the same techniques as those used with PCs, such as finding latent security vulnerabilities, implementing data execution prevention and other measures, says Savage. "Some things will [require] standardization to make them economically feasible," he says.
The Society for Automotive Engineers (SAE), the industry's premier standardization group, is in the process of trying to set security baselines "based on our work," says Savage. "But it will take a while because there's so many different components involved."
Next steps
Roesner's research pointed to diagnostic tools used by service personnel as a potential source of attacks, she says. "These tools can be used to exploit vulnerabilities in automobiles," so owners need to be careful about who is permitted to access the OBD-II diagnostic ports of their cars, Roesner says.
Beyond individual auto companies, the U.S. Department of Transportation has "shown interest," she explains. The United States Council for Automotive Research (USCAR) and the SAE have both created tasks forces focused on computer security for automobiles.
Now is a good time to look at this and start thinking of possible solutions, when automakers and fleet owners are not in panic mode, says Savage. "We're working with the car industry to get ahead of it. In five to 10 years, it may be more of an issue."
See related stories:
Linda Melone is a freelance writer based in Orange County, Calif. She specializes in consumer topics ranging from health and technology to business. Contact her at Linda@LindaMelone.com.