On Security in Cars and Smartphones

We all probably came across analogies such as “cars are smartphones on wheels” or “cars are computers on wheels”, however not many, presumably, started to thoroughly compare the security mechanisms implemented in smartphones with the ones in modern vehicles. Gladly, Ma Zhendong, a security engineer at Bosch Engineering GmbH, took on the task and published his findings [1]. This is a short summary of the author’s comparison. It’s nothing “new”, but a good summary of the current state.

Hardware security. The main difference between iPhones and vehicle ECUs is that iPhones have a co-processor called Secure Enclave, which runs on its own microkernel and provides tamper detection, power and clock monitoring. Moreover, not only the Secure Enclave, also the application processor has hardware-based acceleration for AES encryption. Another notable feature is an immutable Boot ROM providing hardware root-of-trust. In comparison, current ECUs may be equipped with Hardware Security Modules (HSMs) to store secret keys and cryptographic operations. HSMs, however, are located outside the main processor. Furthermore, trusted execution environments (TEEs) find their way into the automotive domain and are used to provide a secure execution environment on the main processor.

System and software security. iPhones have many security measures implemented also known from other architectures, such as secure boot, kernel integrity protection, ASLR, execute never (XN) and many more. In this regard, vehicles are behind. However, ECUs get gradually equipped with secure boot to provide software authenticity. Memory protection to restrict read/write access is implemented for safety and runtime manipulation detection supports maintaining runtime memory integrity. The author additionally highlights that many measures in the automotive domain focus on reducing the number of vulnerabilities, e.g., by following secure coding guidelines and perform extensive testing of the ECUs. Furthermore, over-the-air (OTA) updates in vehicles often rely on a master ECU for verify the integrity of the software and forward it to the target ECU, which increases the risk for attacks.

Network security. Both the iPhone and modern vehicles use similar network security technologies; however, the iPhone has the advantage that it runs on a custom designed System-on-Chip (SoC) whereas vehicles consist of several ECUs connected via different bus technologies. Common network security technologies are TLS, VPN, and the implementation of the latest WIFI and Bluetooth standards. Firewalls on the iPhone are implemented to filter the communication for each application, in comparison, vehicles consist of fragmented physical networks where the gateways connecting different busses additionally act as firewall.

In summary, vehicles are different and probably years behind the technology used in iPhones, also partly due to the fact that safety is crucial for automotive systems and thus the focus when designing vehicles. For instance, memory is often statically assigned for each application on ECUs and thus doesn’t allow for ASLR. Nevertheless, the author urges that “the security model of an iPhone from today should be the goal of the cars of tomorrow”. The author also highlights that despite the high security measures implemented in these phones, vulnerabilities are still found – fewer, but still on a regular base.

[1] Ma, Z., 2022. Apples and Cars: a Comparison of Security. arXiv preprint arXiv:2201.02601.

Short News 

• 317 * 106 qubits, please. Researchers investigated the hardware specifications needed for quantum computers to break 256-bit elliptic curve encryption keys used in the Bitcoin network. To break the encryption within 1 hour, which is roughly the time window public keys are vulnerable after the initiation of a transaction, the researchers estimated that it would require 317 * 106 physical qubits. To break the encryption within a day, 13 * 106 qubits would be needed.
• QR codes make our lives easier. But what about security? It is surprising that it took that long until someone figured out to put them on park meters. That’s exactly what happened in Austin in January. Apparently, someone added stickers leading car owners parking their car to a fraudulent website to make the payment.
  But it doesn’t need to be the QR code that’s wrong, sometimes it’s software bugs. A bug in the camera application on Google Pixel phones with Android 12 led users to a slightly different website under certain conditions. This bug could have led to serious attacks exploiting this behaviour, however, the bug was limited to few devices and fixed within a few days by Google.
• Ransomware attacks continue. Emil Frey, a big car dealer in Europe, got hit by a ransomware attack.