Weekly Automotive Industry Report - April 3-8

1. Hi All, • Please find attached the Weekly Automotive Industry Report covering April 3April 8. • This week’s report includes articles on: • Toyota partnering with Microsoft on a new cloud-based division led by the CIO, • that builds chips for self-driving cars, • Hyundai unveiling its connected vehicle “roadmap,” and, • Toyota planning to open a new autonomous vehicle research center in Michigan. • You can find past reports on site. • Please let me know if you have any questions. Have a great weekend. • Josh Auto-ISAC Monthly Community Call 10 January 2018 1-877-885-1087 Code: 9972152385 TLP Green: May be shared within Auto-ISAC Community.

2. Agenda

3. Welcome Welcome to our community! • Purpose: These monthly Auto-ISAC Community Meetings are an opportunity for you, our Members and connected vehicle ecosystem stakeholders, to: • Stay informed of Auto-ISAC activities • Share information on key vehicle cybersecurity topics • Participants: Auto-ISAC Members, Potential Members, Partners, Academia, Industry Stakeholders, and Government Agencies • Classification Level:TLP Green, and “off the record” • Agenda: Each meeting will have three core segments: • Auto-ISAC Update: Our operations team will overview key activities, outcomes, and intel trends • Featured Speaker: We will invite an industry leader to share relevant topics of interest. Content featured on the Auto-ISAC Community Call is not considered an endorsement. Speakers are selected based on their relevant content and experience for the broader community. • Closing Remarks: An Auto-ISAC leader will open up for comments and sum up key takeaways • How to Connect: For further info, questions, or to add other POCs to the invite, please contact Auto-ISAC Membership Engagement Lead Kim Kalinyak (kimkalinyak@automotiveisac.com)

4. Welcome Expectations for this community • Share • Submit threat intelligence • Send us information on potential vulnerabilities • Contribute incident reports and lessons learned • Provide best practices around mitigation techniques • Participate • Participate in monthly virtual conference calls (1st Wednesday) • If you have a topic of interest, connect with our Program Manager to apply for a speaking opportunity at one of these calls • Join • If your organization is eligible, apply for Auto-ISAC membership • If you aren’t eligible for membership, connect with us as a partner

5. Auto-ISAC Update Our leadership & team

6. Auto-ISAC Update Auto-ISAC overview Mission Scope Serve as an unbiased information broker to provide a central point of coordination and communication for the global automotive industry through the analysis and sharing of trusted and timely cyber threat information. Light- and heavy-duty vehicles, commercial vehicle fleets and carriers. Currently, we are focused on vehicle cyber security, and anticipate expanding into manufacturing and IT cyber related to the vehicle. Membership represents 99% of cars on the road in North America Members from 7 countries on 3 continents 3 Best Practice Guides complete,  4 more planned 23supplier & commercial vehicle members 16 OEM members 200+ media mentions 160+ intel reports 6+ partners 50+ speaking engagements Coordination with 23 critical infrastructure ISACs through the National ISAC Council 200+ active users 900+ community members

7. Auto-ISAC Update Recent activities What we do Highlights of key activities in December • Continued developing Best Practice Guide 4 on Risk Management and shared with the Auto-ISAC Board of Directors • Planned for execution of Best Practice Guide 5 on Security by Design • Held an Auto-ISAC C-Suite Executive-level Member Tabletop Exercise and developed an After-Action Report for Executives • Held our Annual Membership Meeting • Held the Auto-ISAC Summit at Ford in Dearborn, MI

8. Auto-ISAC Update Auto-ISAC Summit Recap 35+ Speakers and Panelists 250+ Attendees 15+ Industry Sponsors $200K+ Money Raised Wednesday, December 13 (Day 1) Thursday, December 14 (Day 2) • There are common challenges for cybersecurity and information sharing, and in order to combat these challenges we must be collaborating as an organization. • Sharing intelligence and collaborating with one another makes the whole of industry and critical infrastructure and operators more resilient. • Modern vehicles continue to evolve incorporating complex software and electronics, which introduces new risks from a cybersecurity perspective. • There are privacy and legal concerns in the changing landscape of autonomous vehicles. • Vehicle hacking can be done through the Data Link Connector Port that is required by California Air Resources Board and US EPA regulations to provide legislated data that reports on the health of the vehicle’s emission control systems. • Automotive companies should implement a strong cybersecurity mindset that involves implementing a security development process and build a holistic, integrated security program. • The automotive industry faces many challenges in building and maintaining a securely authenticated ecosystem, but together as an industry companies can address these challenges.

9. Auto-ISAC Update Event outlook

10. Featured Speaker Speaker series overview • Why do we feature an outside speaker? • These calls are an opportunity for information exchange • Our goal is to help the vehicle cyber community mature  • What does it mean to be featured? • We try to balance perspectives across our ecosystem—including government, academia, research, industry associations, security solutions providers—to showcase a rich, balanced variety of topics and viewpoints throughout the year • Featured speakers are not endorsed by Auto-ISAC • Featured speakers do not speak on behalf of Auto-ISAC • How can I be featured? • If you have a topic of interest you would like to share with the broader Auto-ISAC Community, then we encourage you to contact our Membership Engagement Lead, Kim Kalinyak (kimkalinyak@automotiveisac.com)

11. Featured Speaker Welcome to today’s speakers Brendan Harris is a cybersecurity specialist in the Advanced Vehicle Technology division at the Volpe National Transportation Systems Center. Brendan researches how new cybersecurity tools, techniques, vulnerabilities, and mitigation technologies apply to modern vehicle electronics and system architectures. The goal of this research is to improve automotive and heavy vehicle cybersecurity best practices and industry standards through stakeholder engagement, technology transfer, and community development. Brendan currently supports the Department of Homeland Security’s Cybersecurity for Government Vehicles program and the National Motor Freight Traffic Association, Inc. with their Heavy Vehicle Cybersecurity program. Graham Watson is a Senior Analyst for Stinger Ghaffarian Technologies assigned to the United States Department of Transportation Volpe National Transportation Systems Center located in Cambridge MA. Mr. Watson has over 30 years at the Volpe Center as both a Federal employee, and contractor, featuring progressive expertise in the design, development, implementation, and management of engineering, information and physical/cyber security systems such as: satellite tracking and messaging systems and networks, non-intrusive detection and identification systems; biometrics; static and portable (i.e. handheld) devices, smart card technology, and digital video systems and other security measures. Since 2012, Graham has done research, analysis, and authored technical papers related to the automotive cybersecurity environment with a focus on vulnerabilities, risks, mitigations and automotive cyber security testing for both NHTSA and DHS. Abstract: The Volpe National Transportation Systems Center supports the National Motor Freight Traffic Association, Inc. with their heavy vehicle cybersecurity program. This briefing details the most recent developments of Volpe’s work in support program, including a summary of recent cybersecurity events applicable to the heavy vehicle industry, a risk assessment of a production telematics unit, and an ongoing risk assessment for heavy vehicle OEMs.

12. DOT/Volpe Research Update Heavy Vehicle Cybersecurity Working Group 11/14/2017 The National Transportation Systems Center U.S. Department of Transportation Office of the Secretary of Transportation John A. Volpe National Transportation Systems Center Advancing transportation innovation for the public good

13. Outline • Who We are Brendan Harris • Our support for NMFTA Brendan Harris • Key findings from bi-monthly report Brendan Harris • Telematics Risk Assessment project Graham Watson • New Project: OEM Risk assessment Brendan Harris TopicSpeaker

14. About Volpe • Background • Volpe established in 1970 • Part of U.S. Department of Transportation (DOT) Office of Research and Technology • Named after former DOT Secretary and MA Governor John A. Volpe • Volpe supports DOT goals • Safety • State of good repair • Economic competitiveness • Livable communities • Environmental sustainability

15. Infrastructure Systems and Technology Focus • Transportation infrastructure evaluation and engineering • Crash avoidance and electronic systems safety and resilience • Cyber security of the transportation enterprise • Logistics and supply chain analysis • Example projects • Cybersecurity for Government Vehicles – DHS • Electric Vehicles Cybersecurity Workshop – DOE • Cybersecurity for Heavy Vehicles – NMFTA • Maritime Safety and Security Information System (MSSIS) – DoD • Connected vehicles evaluation and safety assessment – ITS JPO, NHTSA • Intelligent Transportation Systems policy and planning – ITS JPO

16. NMFTA Cybersecurity Support • Ongoing - Bi-monthly cybersecurity reports • Understand how commercial vehicle cybersecurity is changing over time • Resource for getting up to date quickly on important issues • 2016 - Heavy Truck Inventory • Document the overall composition of the US heavy trucking industry • Understand the potential scope of a cyber security incident • 2016 -Stakeholders’ Report • Understand how the commercial trucking industry is different from the automotive industry • Identify key industry stakeholders and define their roles and responsibilities are regarding HV cybersecurity • 2017 – OEM Risk Assessment • Use findings from truck inventory to work with OEMS, Tier 1s, Carriers • Identify common ECUs for security research • 2017 – Telematics Risk Assessment • Work with TSP to perform paper risk assessment of production system

17. Bi-monthly Cybersecurity Reports • First released in August 2016, most recent in October • Document high-profile events and news pertinent to heavy truck cybersecurity • Conferences • Academic Research Papers • Newspapers, Magazines and other traditional “press” • Focused on a Variety of areas • Sign up to receive new updates- https://hvcslistservice.nmfta.org/ • Vulnerabilities, Exploits and Payloads • Reverse Engineering and Tools • Policy, Guidelines, and Best Practices • New Security Technology

18. Vulnerabilities, Exploits & Payloads • Vulnerabilities in heavy truck electronics logging devices • Study looked at 3 off-the-shelf ELDs • Each failed to follow even the most rudimentary cybersecurity best practices • Ransomware affected production at an automotive assembly line • First public example of ransomware affecting production in automotive industry • New fundamental vulnerability in CAN standard identified • Can cause ECU to stop transmitting on CAN bus • Uses legitimate CAN functionality, making it hard to stop • Telematics vulnerability in mid-age vehicles • Uses a vulnerability originally used to target iPhone • Exploits older, more insecure 2G network • OEMs are working to deactivate the TCU in the vehicles

19. Reverse Engineering & Tools • New advanced CAN backdoor hardware, “The Bicho” • Debuted at Blackhat • Handy GUI “Car Backdoor Maker” • Allows an attacker to inject arbitrary CAN messages using variety of triggers • GPS location • SMS message • HackKey tool for attacking passive keyless entry • Easy way to perform relay-style attacks on passive entry systems • ESCAR – new security testing tools • Vector published method for automatically generating fuzz testing parameters based on automotive database files • Visual Threat published open source tool for connecting a vehicle to a suite of cloud-hosted test scripts

20. New Cybersecurity Technology • Device Identifier Composition Engine for Embedded Controllers • Uses layered secrets to secure software operations • In use in Microsoft Robust, Resilient, Recoverable IoT platform (RIoT) • Advanced Telematics Systems is using UPTANE security framework • UPTANE is a secure update framework designed for the automotive environment • Example of industry adoption of open source security technology

21. Cybersecurity Policy, Guidelines, & Best Practices • In Europe – • UK - Principles of Cyber Security for Connected and Automated Vehicles • Outline of 8 key steps which automakers can make to improve cybersecurity • UK 5*StarS project • Research project to develop framework for communicating automotive cybersecurity features to customers • In the US • US House - SELF DRIVE Act • Geared towards autonomous vehicles • Provisions for privacy and cybersecurity requirements • US House - IoT Cybersecurity Improvement Act of 2017 • Cybersecurity requirements for all IoT purchased by federal government • Principle 1 - organizational security is owned, governed and promoted at board level • Principle 2 - security risks are assessed and managed appropriately and proportionately, including those specific to the supply chain • Principle 3 - organizations need product aftercare and incident response to ensure systems are secure over their lifetime • Principle 4 - all organizations, including sub-contractors, suppliers and potential 3rd parties, work together to enhance the security of the system • Principle 5 - systems are designed using a defense-in-depth approach • Principle 6 - the security of all software is managed throughout its lifetime • Principle 7 - the storage and transmission of data is secure and can be controlled • Principle 8 - the system is designed to be resilient to attacks and respond appropriately when its defenses or sensors fail

22. Telematics Risk Analysis Graham Watson

23. Carriers Telematics Risk Analysis-The prequel • Last summer created stakeholders report • Focused on all aspects of trucking industry and unique cybersecurity considerations for: • Carriers • OEMs • Tier 1s • Telematics Providers • Ultimately determined that Telematics was the largest, most varied attack surface, and to focus there Tier 1 TSP Associations OEM DOD

24. Telematics Risk Analysis-The Project • Volpe was tasked by NMFTA to conduct a paper risk analysis of a telematics vendor in conjunction with 3rd party penetration testing • The participating telematics vendor is Peoplenet, Volpe facilitated 3rd party penetration testing of the Peoplenet PMG2 device by Underwriter Laboratories • Peoplenet was provided risk assessment based survey questions derived from the DHS/Volpe developed Cybersecurity Primer for Fleet Managers document based on the NIST SP-800-53 control families • Four areas were deemed highly critical • Protecting Communications Between Devices • Protecting Firmware on Devices • Protecting Actions on Devices • Protecting Integrity of Devices (Vulnerability response and disclosure program)

25. Telematics Risk Analysis-The System • Place holder for Peoplenet diagram

26. Telematics Risk Analysis-HEAVENS • Volvo Car’s Healing Vulnerabilities to Enhance Software Security and Safety (HEAVENS) Risk analysis methodology was applied to determine the level of risk to certain types of attacks • HEAVENS is an attacker-centric type of risk analysis tool • HEAVENS utilizes the Microsoft STRIDE approach for threat enumeration: • Spoofing • Tampering • Repudiation • Information Disclosure • Denial of Service • Elevation of Privilege

27. Telematics Risk Analysis-HEAVENS cont. • HEAVENS derives security levels for threat-asset pairs based on determination of: • Threat level • Attacker Expertise, Knowledge, Equipment, and window of opportunity • Impact level • Safety, Financial, Operational, Privacy and legislation • Security level • Derived from a combination of the Threat level and the Impact level

28. Telematics Risk Analysis-Attacks • Attacks on the in-vehicle telematics device, data transmission, backend systems and data storage were addressed in the HEAVENS risk assessment • 15 various types of attacks were developed covering both technical and Policy issues: • Distributed Denial of Service • Device Clone • Reading Residual Memory • Man in the Middle • Communications Downgrade • Device Data Leakage • Unsecure OTA Update • Poor Cryptography • Elevation of Privilege • Rouge Commands • Unintended Device Communications • Device Theft/Re-Use • Lack of Vulnerability Disclosure Program • Insider Attack • Weak Corporate Infrastructure

29. Telematics Risk Analysis-Attack Table

30. Telematics Risk Analysis-Preliminary Findings • After the HEAVENS risk determinations were made Peoplenet’s responses to the risk analysis questions are being used to pair mitigations against the HEAVENS attacks • The mitigations are being analyzed for effectiveness against the attacks • Preliminary results of the HEAVENS risk assessment show that responsible telematics vendors can produce telematics systems that embrace good cybersecurity practices • Close cooperation on the part of Peoplenet is providing critical data for the risk analysis

31. OEM Risk Assessment Brendan Harris

32. OEM Risk Assessment Prequel - Heavy Truck Inventory • Snapshot of what heavy truck distribution looks like • Class 7 & 8 vehicles • Years, make and models • How homogenous is the heavy trucking industry? • Implications for proliferation of cybersecurity incident • Surveyed Carriers, OEMs, and Telematics Service Providers • 15 Carriers • 2 OEMs • 1 Telematics Service provider • Ultimately, not a large enough sample size through survey data, and used 3rd party data

33. Heavy Truck Inventory Key Findings • Heavy-vehicle sector is extremely homogenous • ~80% of vehicles manufactured by 4 OEMS • ~60% of vehicles come from 7 model years • Most common Make & Model Year accounts for 1 in 30 vehicles • A vulnerability in a common electronic control unit (ECU) could impact many vehicles • Recommendations: • Analyze vehicles to determine common ECUs shared across makes and model years to understand risk profile • Use this risk profile to perform security assessments of common parts

34. New Project- Risk Assessment for OEMs • We cannot test every ECU for vulnerabilities • In order to determine highest value research targets, we need input from YOU • OEMs • Tier 1s • Carriers • Can use input to guide security research and work smarter • Goal is to complete this analysis in time for May HVCS meeting

35. Sample Survey Questions

36. Risk Assessment Final Thoughts • More responses = Better outcomes • Quality and usefulness of the report is a directly proportional with stakeholder participation • Questions can be altered to make them “easier” to answer • Ultimately is going to be used to determine which parts to continue cybersecurity research on • Talk to me or one of my colleagues at the break to get involved

37. Contact Information Kevin Harnett Cybersecurity Program Manager U.S. Department of Transportation Office of Research and Technology John A. Volpe National Transportation Systems Center (Volpe Center) Email: kevin.harnett@dot.gov Phone: 617-699-7086 Brendan Harris IT Specialist (Information Systems Security) Advanced Vehicle Technology DOT, OST-R, Volpe Center Email: Brendan.Harris@dot.gov Phone:617-494-2833 Graham Watson Sr. Engineer Stinger Ghaffarian Technologies assigned to: Department of Transportation John A. Volpe National Transportation Systems Center (Volpe Center) Email: graham.watson.ctr@dot.gov Phone: 508-378-7167

38. Around the Room Open discussion What questions or topics would you like to address?

39. Closing Remarks How to get involved: Membership If you are an OEM, supplier or commercial vehicle company, now is a great time to join Auto-ISAC. Key benefits this year include: • Real-time Intelligence Sharing • Intelligence Summaries • Crisis Notifications • Member Contact Directory • Development of Best Practice Guides • Exchanges and Workshops • Webinars and Presentations • Annual Auto-ISAC Summit Event • To learn more about Auto-ISAC Membership, • please contact Kim Kalinyak (kimkalinyak@automotiveisac.com).

40. Closing Remarks How to get involved: Partners If you are not currently eligible for Auto-ISAC Membership, we encourage you to consider getting involved in Auto-ISAC as a Strategic Partner. Vendors For-profit companies that sell cybersecurity-related connected vehicle products & services. Examples: Kaspersky, SANS Associations Industry associations related to the connected vehicle ecosystem. Examples: Auto Alliance, NAFA Other Government, academia, research, non-profit orgs with complementary missions to Auto-ISAC. Examples: UMTRI, NHTSA • “Strategic Partner” • Paid Partnership • Contractual agreement • Commitment to engage in at least one activity (see next slide) and/or 15K investment • “Navigator” • Support Partnership • Mutually-supportive agreement • Annual definition of activity commitments and expected outcomes (see next slide) • “Collaborator” • Coordination Partnership • May not require a formal agreement • Information exchanges and coordination activities

41. Our contact info Faye Francy Executive Director Booz Allen Hamilton Inc. 20 M Street SE Washington, DC 20001 703-861-5417 fayefrancy@automotiveisac.com Jacqueline Bress Business Administrator Booz Allen Hamilton Inc. 20 M Street SE Washington, DC 20001 404-966-8510 jacquelinebress@automotiveisac.com Kim Kalinyak Membership Engagement Lead Booz Allen Hamilton Inc. 20 M Street SE Washington, DC 20001 240-422-9008 kimkalinyak@automotiveisac.com

42. Our contact info Meredith Shaw Intel Coordinator Booz Allen Hamilton Inc. 901 15th Street Northwest Washington, DC 20005 703-377-9853 analyst@automotiveisac.com Keri Barber Operations Manager Booz Allen Hamilton Inc. 901 15th Street Northwest Washington, DC 20005 202-340-8308 heckler_alexandra@bah.com