BMW security loophole highlights aftermarket’s call for “interoperable” telematics platform
Security loopholes found in BMW’s Connected Drive telematics system support the IAAF & FIGIEFA’s proposal for the creation of an interoperable and secure telematics platform for connected vehicles, which incorporates state-of-the-art technology and addresses the competition challenge created by closed proprietary systems.
ADAC, the German motorist association, identified a flaw in BMW’s Connected Drive software, which uses an on-board SIM card and can operate door locks, air-conditioning and traffic updates, but no driving systems such as brakes or steering.
Researchers found that the cars would try to communicate via a spoofed phone network, leaving potential hackers able to control anything activated by the SIM and thieves able to unlock doors and track car data through a mobile phone without leaving a trace.
While BMW announced that these security loopholes were closed by the end of January 2015, the incident exemplifies the deficiencies in vehicle manufacturers’ arguments in current debates in Brussels that only vehicle manufacturers’ closed proprietary systems are truly secure.
The IAAF & FIGIEFA, together with a wide alliance of consumer, automotive aftermarket, insurance and leasing company federations, has long advocated for secure, interoperable networks for vehicle connectivity. This proposal has been taken up as a principle by the new European eCall Regulation, which is particularly pertinent, as it makes the installation of the automatic new emergency call mandatory by 2018.
The platform would allow drivers to choose to whom they send their vehicle data, and under what terms and conditions, whilst maintaining the highest – constantly updated, state of the art – security standards for both communication to and from the vehicle, as well as within the vehicle. The required levels of safety and security would be further strengthened through the validation of applications by an independent authority prior to them being implemented. Together, these measures would provide a complete safety and security structure whenever communicating or exchanging data with the vehicle.
Currently, independent operators, such as e.g. repairers, road-patrols or leasing companies do not get the same wireless access to the vehicle’s technical data as vehicle manufacturers enjoy. This allows vehicle manufacturers to choose which companies eventually receive the data, under what conditions and timescales, and what services are allowed to be offered to consumers – thereby giving them an exclusive control over their vehicles’ data.
As a result, there is the threat of a monopolisation over the important ‘online’ data, crucial to ascertain the ‘health status’ of the vehicle when it is being driven and vital for the independent sector to continue to provide competitive, new and innovative services.