Eugene Kaspersky

Kaspersky has come up with four recommendation for connected car users to protect themselves from cyber-interference:

· Don’t root your Android device as this will open almost unlimited capabilities to malicious apps
· Disable the ability to install applications from sources other than official app stores
· Keep the OS version of your device up to date in order to reduce vulnerabilities in the software and lower the risk of attack
· Install a proven security solution in order to protect your device from cyberattacks.

Kaspersky tested seven remote car control applications developed by major car manufacturers which have been downloaded tens of thousands, and in some cases, up to five million times.

The research discovered that each of the examined apps contained several security issues:

· No defence against application reverse engineering. As a result, malicious users can understand how the app works and find a vulnerability that would allow them to obtain access to server-side infrastructure or to the car’s multimedia system
· No code integrity check, which is important because it enables criminals to incorporate their own code in the app and replace the original program with a fake one
· No rooting detection techniques. Root rights provide Trojans with almost endless capabilities and leave the app defenceless
· Lack of protection against app overlaying techniques. This helps malicious apps to show phishing windows and steal users’ credentials

· Storage of logins and passwords in plain text. Using this weakness, a criminal cansteal users’ data relatively easily.

Successful exploitation of these vulnerabilities allows attackers to can gain control over the car, unlock the doors, turn off the security alarm and, theoretically, steal the vehicle.

“The main conclusion of our research is that, in their current state, applications for connected cars are not ready to withstand malware attacks,” says Kaspersky’s Victor Chebyshev, “thinking about the security of the connected car, one should not only consider the security of server-side infrastructure. We expect that car manufacturers will have to go down the same road that banks have already gone down with their applications. Initially, apps for online banking did not have all the security features listed in our research. Now, after multiple cases of attacks against banking apps, many banks have improved the security of their products. Luckily, we have not yet detected any cases of attacks against car applications, which means that car vendors still have time to do things right. How much time they have exactly is unknown. Modern Trojans are very flexible – one day they can act like normal adware, and the next day they can easily download a new configuration making it possible to target new apps. The attack surface is really vast here.”