Providing Security Updates to Automobile Software
Auto manufacturers are just starting to realize the problems of supporting the software in older models:
Today’s phones are able to receive updates six to eight years after their purchase date. Samsung and Google provide Android OS updates and security updates for seven years. Apple halts servicing products seven years after they stop selling them.
That might not cut it in the auto world, where the average age of cars on US roads is only going up. A recent report found that cars and trucks just reached a new record average age of 12.6 years, up two months from 2023. That means the car software hitting the road today needs to work—and maybe even improve—beyond 2036. The average length of smartphone ownership is just 2.8 years.
I wrote about this in 2018, in Click Here to Kill Everything, talking about patching as a security mechanism:
This won’t work with more durable goods. We might buy a new DVR every 5 or 10 years, and a refrigerator every 25 years. We drive a car we buy today for a decade, sell it to someone else who drives it for another decade, and that person sells it to someone who ships it to a Third World country, where it’s resold yet again and driven for yet another decade or two. Go try to boot up a 1978 Commodore PET computer, or try to run that year’s VisiCalc, and see what happens; we simply don’t know how to maintain 40-year-old [consumer] software.
Consider a car company. It might sell a dozen different types of cars with a dozen different software builds each year. Even assuming that the software gets updated only every two years and the company supports the cars for only two decades, the company needs to maintain the capability to update 20 to 30 different software versions. (For a company like Bosch that supplies automotive parts for many different manufacturers, the number would be more like 200.) The expense and warehouse size for the test vehicles and associated equipment would be enormous. Alternatively, imagine if car companies announced that they would no longer support vehicles older than five, or ten, years. There would be serious environmental consequences.
We really don’t have a good solution here. Agile updates is how we maintain security in a world where new vulnerabilities arise all the time, and we don’t have the economic incentive to secure things properly from the start.
Subscribe to comments on this entry
wiredog • July 30, 2024 8:00 AM
As far as security goes, if data connections are disabled that problem is solved. At least for remote access exploits. As always, if the Bad Guys have physical access they can do what they want. The data connection (an LTE connection on my car, and what happens when LTE goes away?) is used for navigation (I use my cell phone), the OnStar type services (ditto), and OTA software upgrades. The car runs fine if you pull the fuse for the LTE radio, though you do get error messages on some screens.
The easy thing for car manufacturers to do is get rid of the data connection and rely on the owner’s cell phone for any remote connectivity needed. The control bus (CANBUS, IIRC?) should be completely separated from the infotainment system, of course the two systems are getting more tightly integrated all the time.
I have a nasty feeling that this will all fly below the radar until either an update error, or cyberattack, bricks a bunch of cars. Bonus havoc if some of them are driving at freeway speeds when it happens with extra bonus wrongful death lawsuits.