Response to Jeep Cherokee hacking attack

Alexandra Willard our director of Global Technology Practice saw this article and video in Wired about hackers getting access to the CAN of an SUV remotely through the Bluetooth interface of the Uconnect entertainment system and this is her response:

“I think we can safely say that this is a problem that the automakers have and THEY should be the ones to develop the solution. Knee-Jerk reactions by governments, no matter how well intentioned, often result in very poor solutions being devised.

We in the connected car software world have been aware of the possibility of vehicle cyber attacks for many years but it has not been possible to get the automakers to collaborate in making their vehicles more cyber-secure. Car manufacturers operate in silos.

It’s time for the automakers to put aside their culture of metal and plastic, and to realize that their biggest challenges now come in bits and bootloaders.

They need to agree a set of short terms actions which will make their vehicles safe even if this means a limitation in functionality – and then develop a joint roadmap to ensure that the digital systems on the car are as safe and secure as the mechanical systems. This test and validation approach is what they know and what they do well – time to ‘go-do it’.

We should not be naive about this Jeep incident though. A Ford Pinto type episode [where the fuel tank placement was proven deadly but Ford was aware of this flaw during the design stage of the Pinto and went ahead with the production regardless] would put the connected car industry back 10 years – and we will all be the losers.

Finally, we should remember to keep a sense of realism. The easier a digital system is to: upgrade, maintain and to connect with, the easier is to hack. That’s a fact of digital life.”

Note: Chrysler has issued a recall for 1.4 million vehicles as a result of Miller and Valasek’s research. The company has also blocked their wireless attack on Sprint’s network to protect vehicles with the vulnerable software.