The security expert at BootstrapLabs’ Google Launchpad event had just delivered a litany of reasons to fear our fast-approaching sci-fi future. The question from the floor: what will be some of the first car hacks? “I could be snarky, and say that I’d tell you but I’m going to have to shoot you!” taunted Dr. Allan Steinhardt, Chief Engineer of the autonomous car startup AEye, pointedly adding: “The first error you’re making is assuming it’s a future tense.”
The guy in the audience pushed back: “How about the second hack?”
Look to cybersecurity for answers, said Steinhardt. Hacks won’t be about trying to “inflict bodily harm” or to deny service, “but for theft.” Cars will be weaponized. Cars will grant hackers access, long a key motive. But here’s where it gets curious and a bit scary. The car hack may be about “using vehicles as ways of getting into places you shouldn’t be in.”
The provocative evening of presentations last week was produced by BootstrapLabs, the AI-focused venture firm, and hosted by Google. The event featured Steinhardt, followed by Tilly Chang, Executive Director of the San Francisco County Transportation Authority, and Chad Partridge, CEO of the autonomous systems simulation shop Metamoto. Ben Levy, Co-Founder of BootstrapLabs, set the tone for the night by showing the 200-strong crowd a scenario that might have you feeling vulnerable the next time you’re on the sidewalk. “Cars can soon drive themselves,” he said, asking with a smile, “What’s the worst case scenario?”
Carmageddon
Ben hit play, and up on the screen, a blonde ice princess hacker hit some keys, and then cars all over the city went haywire, smashing into each other, flying off the decks of parking garages, exploding in piles of flaming, tangled steel. The apocalyptic vision was a trailer from Fast and Furious 8: Hollywood stoking our fears by imagining the terrifying consequences of putting cars in the control of AI.
The crowd at Launchpad roared with laughter at the over-the-top vision of an automotive Armageddon. While Steinhardt acknowledged that a factor limiting a large-scale car hack may be the lack of standardization among automotive manufacturers, today businesses everywhere are being hacked. Why should autonomous cars, which of course will run on AI-enabled software, be any different? Equifax’s recent mega-hack hit 143 million consumers – just about everyone in the US who has credit – compromising Social Security numbers, birth dates, addresses, drivers’ license numbers, and other account information. The day of the Bootstrap event, the news came out that some three billion Yahoo user accounts had been breached more than two years before, likely by a “state-sponsored actor.” Target, JPMorgan Chase, eBay and other retailers and financial firms have had millions of credit card or consumer records hacked in the past few years. And of course, many hacks are covered up for years.
During Steinhardt’s talk he gave a brief history of DARPA, traditional network security, and the progression to wireless networks and IoT device loopholes. What struck me was that we haven’t fully grasped the tremendous structural shift about to take place as computers, often enabled by AI code, are increasingly powering our things – including speeding cars and trucks.
Chad Partridge, CEO of Metamoto
Hacking for Access
If cars are going to drive themselves, maybe we need to understand the motivations of the hackers who might grab the wheel. Back in the early to mid 90s, I chronicled some of the world’s most notorious hackers in a couple of books. Kevin Mitnick and Kevin Poulsen were part of a generation of phreaks and hackers who began by exploring and exploiting the phone networks, mostly for fun, occasionally for a little cash and free prizes (Poulsen “won” two Porsches from radio giveaways by taking control of all the phone lines going into the station). Mitnick’s “social engineering” talents, technical aptitude, and brazenness earned him the source code of every major cell phone maker in the world. Both got a thrill out of gaining extraordinary access. Mitnick secretly cracked people’s email accounts – including mine – and covered his tracks by keeping electronic tabs on the FBI agents on his trail. Today, he’s an in-demand public speaker on computer security and a white hat hacker running his own firm.
In 2017, joyriding phone networks for kicks or prizes seems a quaint, distant past. Hackers aren’t just seeking access or fun. They manipulate elections. They steal millions through fraud. Hackers are sure to be probing autonomous cars. So what’s the best way to prevent disaster?
Steinhardt suggested security might lie in creating a technical foundation radically different from the open Internet. Engineers “like to have very easy-to-understand networks and systems, but the more opaque and byzantine the [car] network, the harder it is to do coordinated attacks,” said Steinhardt. “You can do individual attacks but you can’t really do coordinated attacks.”
That means that the deadly Fast and Furious mass-pile-up scene might be far-fetched. Cars aren’t smartphones or laptops. They’re unlikely to all run the automotive equivalent of Windows, iOS or Android, and blonde hackers can’t punch a few keys to unfurl chaos. The surprising “good news” said Steinhardt, is that “cars are so screwed up in terms of their digital backbone that they’re byzantine before you even start.”
But what about software updates for vehicles? It’s another Catch-22 that autonomous car makers will have to resolve. “I can’t imagine that you would want to drive a car around without first updating to the most current version,” said a participant. “Are there evolving best practices for updating cars and security?”
“It’s a risk posture,” replied Steinhardt. “The classic risk is that if you don’t do anything, you maintain vulnerabilities.”
Physical Safeguards
Henry Wang, Director of Programs at a major autonomous electric vehicle startup believes that there will be a classic hacker cat-and-mouse game, but it won’t be full-blown like in the Fast and Furious flick. “There are a lot of safeguards built into cars,” said Wang. “There’s a ton of complex hardware and software, and there’s a self-contained vehicle network designed for security. There are a lot of things you can’t hack unless you have physical access to the car.”
Wang noted another element that might make hackers think twice. At his previous employer, Tesla, he saw how car thieves would be detected and quickly GPS-tracked, and it wouldn’t be long before Tesla would flash a message to the driver’s console that the cops were in pursuit, and the stolen vehicle would be shut down remotely in minutes. The company also offers a $10,000 bounty for hackers who find a vulnerability.
It’s going to be an interesting game. As Charlize Theron, the villainous hacker who presses the keys that wreak havoc in Fast and Furious 8, put it: “One thing I can guarantee. No one’s ready for this.”
For more Artificial Intelligence news and trends, read on.
