Modern vehicles are being transformed by the adoption of over-the-air (OTA) technology. However, cybersecurity experts warn that the same technology can also expose connected vehicles to more sophisticated cyber threats as time passes.
By using OTA technology, automakers are able to update software, update security patches, update firmware, and introduce new features remotely, without the need for vehicles to visit service centers.
After being first introduced by Tesla in 2012, this technology has become a standard feature across the automotive industry as a result of its convenience and cost effectiveness.
Modern vehicles have evolved into software-defined platforms that are interconnected with smartphones, cloud services, charging infrastructure, and, in some cases, other vehicles, as well as smartphones.
With OTA, in addition to software updates and remote diagnostics, connected services, artificial intelligence-powered voice assistants, and feature enhancements, cybersecurity is becoming a more critical component of vehicle safety. However, analysts caution that growing connectivity can also increase the vulnerability of cybercriminals and nation-state actors to attack.
A successful compromise of OTA systems can result in attackers affecting vehicle functions, stealing sensitive information, or exploiting weaknesses in transportation infrastructure, according to experts. According to Professor Shaikh, OTA updates have greatly reduced the need for recalls and routine service of vehicles, thereby improving vehicle maintenance.
It is imperative to strengthen security measures, despite these operational benefits, as the reliance on connected systems continues to grow. Security concerns go beyond data privacy, according to cybersecurity analysts.
Access to vehicle control systems by an unauthorised individual could pose a broader national security risk, especially if foreign adversaries exploit vulnerabilities in connected transportation systems.
As part of a recent report authored by the American Enterprise Institute, the Institute recommended strengthening protections for the automotive sector by conducting additional security reviews, restricting foreign hardware and software, and improving transparency around the collection of vehicle data.
A draft amendment to the Central Motor Vehicles Rules in India proposes mandatory cybersecurity and software update management requirements for certain vehicle categories, as part of its efforts to strengthen regulatory oversight. Before connected vehicles can be sold, manufacturers would be required to implement certified cybersecurity management systems and secure software update processes.
During real-world testing, Norwegian public transport operator Ruter discovered that one of its buses could theoretically be remotely disabled by utilizing its mobile-connected control system. Several transportation authorities in the United Kingdom and Denmark conducted investigations into potential vulnerabilities associated with connected vehicles in response to these findings.
Automakers are not the only entity responsible for securing connected vehicles, according to industry experts.
A vehicle's cybersecurity is also affected by vulnerabilities anywhere within its supply chain, including software developers, component suppliers, semiconductor manufacturers, telematics providers, and other technology partners.
As OTA technology is being utilized in buses, rail networks, maritime transportation, drones, industrial machinery, and robotics, experts emphasize that this issue is not limited to a single manufacturer or country.
In addition, cybersecurity experts emphasize the need for a lifecycle approach rather than a one-time compliance approach to safeguard connected vehicles, which has become a more widespread challenge across critical infrastructure sectors.
In order to improve vehicle safety, it becomes increasingly important to develop secure software, authenticate OTA updates, monitor threats continuously, and respond to vulnerabilities quickly, just as it is important to maintain traditional mechanical safety measures.
Governments, automakers, and technology providers must work together to strengthen authentication, encryption, software verification, and continuous monitoring of OTA platforms, according to cybersecurity specialists.
Ensure the security of remote software updates in the era of connected mobility in order to protect both consumers and national transportation systems as the industry standard becomes more prevalent.
