Karamba is writing software to keep your connected car from getting hacked
With cars becoming more connected and autonomous, cybersecurity is a constant worry for automakers. They dread the likelihood of intrusions into the connected car from hackers, terrorists, extortionists, and thieves (see “Your Future Self-Driving Car Will Be Way More Hackable”)—not to mention the random 12-year-old with mischief in mind.
Apprehensions about automotive cybersecurity came to a head when a pair of white-hat hackers broke into a Jeep Cherokee in 2015, leading to the recall of 1.4 million vehicles by Chrysler Fiat to fix a software bug in the Uconnect infotainment system (see “Carmakers Accelerate Security Efforts after Hacking Stunts”).
Cars represent a fundamentally different sort of security challenge from laptops, servers, or mobile phones, in which corruption or theft of data is the hacker’s objective. A cyber-attack on a moving vehicle may create a deadly safety hazard, and conventional antihacking software could be too slow or ineffective to avert an incident.
“Dealing with consumer safety, and not just with data security, requires different security methods to protect our cars, in contrast to technologies that protect servers and enterprise networks,” says David Barzilai, executive chairman and cofounder of Karamba Security, a two-year-old startup based in Hod HaSharon, Israel, with an office in metropolitan Detroit.
“Using machine learning and artificial intelligence to identify malware after hackers infiltrate the car is too late,” he says. “The approach must be to prevent an attack when hackers attempt to hack.”
The field of automotive cybersecurity is small but expanding rapidly as new threats are discovered to emerging technologies such as vehicle-to-vehicle wireless communication. Harman International, maker of the Uconnect system in the hacked Jeep, acquired TowerSec, an Israeli cybersecurity firm, in early 2016. Argus Cyber Security, another Israeli competitor, recently discovered and demonstrated a way to penetrate a car’s electronics with a “dongle,” an innocent-looking piece of hardware resembling a flash drive that operates software via a car’s USB or other port. Tesla and Fiat Chrysler both offer monetary “bug bounty” rewards for hobbyists and amateur hackers who find and report software vulnerabilities.
Given the skill, motivation, and creativity of hackers, it is unclear that any one approach can comprehensively block their entry to a vehicle’s electronic architecture. “Vulnerabilities will be inadvertently designed into systems,” says Sam Abuelsamid, a senior analyst for Navigant, a marketing research firm based in Boulder, Colorado.
A premium car may come equipped with a hundred or more electronic control units, or ECUs (in actuality, small computers), connected to one another as part of the vehicle’s electronic architecture.
