Over-the-air updates: convenience or a new threat?
Wireless update systems (OTA) for cars are often hailed as a sign of the future, yet many fear they create a new security problem. Virtually all modern cars are connected to the internet, and cybersecurity experts are not thrilled about it. What would happen if malicious actors hacked these systems? It’s a good question, but for now, the answer is far more complex than ‘hackers can take control of your car while you’re driving.’
This technology has become one of the biggest shifts in the automotive industry over the last decade. Once primarily a ‘feature’ of Tesla, it now allows manufacturers to fix bugs, improve features, and add new capabilities without needing to visit a dealership. Furthermore, it gives automakers a quick way to patch security holes, which is even more important than convenience.
Where the real danger lies
A new CNBC report largely focuses on potential vulnerabilities. Indeed, it is technically possible that connected vehicles could become targets for hackers or even hostile governments. One Norwegian investigation into Chinese electric buses found that manufacturers had retained remote access to certain vehicle systems via a cellular connection, prompting additional checks in the UK and Denmark.
Security analysts also warn that internet-connected cars are becoming an increasingly attractive target for espionage and large-scale cyberattacks. These concerns deserve attention, but they are also easily misinterpreted.
Hollywood vs. Reality
The image that pops into many of our minds when thinking of a hacker and a modern car is quite alarming. A malicious actor sits at a computer, gains access to your car, and steers it into a ditch or a wall. Modern cars simply aren’t constructed that way. Yes, they are connected to the internet and filled with electronic control units (ECUs) that control everything from the steering to the brakes and acceleration. But there are several reasons why a hacker can’t just take over the controls.
This doesn’t mean connected cars cannot be hacked. It simply means that a malicious actor would likely have to overcome several layers of protection before getting to the critical safety systems. Even if that happens, it’s unlikely the hacker could control the car like a real driver. The real danger here lies in the scale and potential incapacitation.
The bigger threat — the ‘kill switch’
The aforementioned Norwegian investigation demonstrates this perfectly. The authorities weren’t afraid that a Chinese business or state agency would take control of the buses and start steering them. They were worried that a foreign entity could disable them at will. Imagine police cars or public buses that suddenly refuse to start, delivery fleets that become inoperable, electric vehicles that can’t charge, or critical data being quietly stolen from millions of connected cars.
Such attacks could cause economic chaos without even touching the steering wheel of a moving vehicle. On the positive side, the same OTA channel used for hacking also allows automakers to ‘lock the doors’ by sending fixes to millions of cars overnight. The problem is that this is an arms race without a finish line. Every new connected feature is another door that needs guarding, and automakers only need to leave one unlocked.
In reality, the most realistic cyber threats to cars today are not so much remote control while driving, but rather the large-scale incapacitation of entire fleets or data theft. It is these scenarios that could have serious economic and social consequences, and it is on these that manufacturers and regulators should focus their attention. OTA systems, while creating new attack vectors, are also the most effective tool for rapid response, making this technology an essential element of modern automotive safety.