ChatGPT and automotive cybersecurity #1/2: About CSMS from ISO 21434

/in

As promised, I played more with ChatGPT and this time I started to dig a bit into cybersecurity for automotive.

Since I am working these days on CSMS (based on ISO ECE 21434 and TISAX), part of my companies consulting offer for automotive I thought maybe I check what ChatGPT things about them.

Unfortunately, nothing dramatically new, a form of what a google search gives you. However, the model answered something interesting about TISAX, which usually I, as a human would probably answer.  ( No, this post is not written by ChatGPT: 🙂   )

 

Here it is:

 

Query:

Tell me about CSMS from ISO 21434

 

ChatGPT:

CSMS (Cybersecurity Management System) is a framework for managing cybersecurity within an organization, as defined in ISO 21434. ISO 21434 is an international standard for automotive cybersecurity that provides guidelines for the development and implementation of cybersecurity measures in the automotive sector.
CSMS is designed to help organizations manage cybersecurity risks and protect against cyber threats.

It is based on the same principles as other management systems, such as quality management or environmental management, and provides a structured approach to managing cybersecurity.

The framework covers a range of cybersecurity-related activities, including:

  • Threat identification and assessment
  • Risk management
  • Security controls and measures
  • Incident management
  • Continuous improvement

CSMS is designed to be flexible and adaptable, allowing organizations to tailor the framework to meet their specific needs and requirements.

The standard also provides a basis for certification, enabling organizations to demonstrate their commitment to cybersecurity and their ability to effectively manage cybersecurity risks.

In summary, CSMS from ISO 21434 provides a comprehensive framework for managing cybersecurity and is an important aspect of information security for organizations operating in the automotive sector.”

 

This text is not returned by a google search. If I search the exact same terms, google returns me a bunch of links and ads (4 Ads, 9 links, 1 ad) and some Youtube videos.

So, is this text relevant?

Yes, it is a very good summary. I will actually use it in the offerings of my company.

 

 

Part #2 is about “TISAX certification”.

 

The post ChatGPT and automotive cybersecurity #1/2: About CSMS from ISO 21434 first appeared on Sorin Mustaca on Cybersecurity.

A brief history of software vulnerabilities in vehicles (Update 2023)

/in

Updated in 2023:

  • 2023: Sam Curry: Web Hackers vs. The Auto Industry: Critical Vulnerabilities in Ferrari, BMW, Rolls Royce, Porsche, and More
    • Kia, Honda, Infiniti, Nissan, Acura
      • Fully remote lock, unlock, engine start, engine stop, precision locate, flash headlights, and honk vehicles using only the VIN number
      • Fully remote account takeover and PII disclosure via VIN number (name, phone number, email address, physical address)
      • Ability to lock users out of remotely managing their vehicle, change ownership
        • For Kia’s specifically, we could remotely access the 360-view camera and view live images from the car
    • Mercedes-Benz
      • Access to hundreds of mission-critical internal applications via improperly configured SSO, including…
        • Multiple Github instances behind SSO
        • Company-wide internal chat tool, ability to join nearly any channel
        • SonarQube, Jenkins, misc. build servers
        • Internal cloud deployment services for managing AWS instances
        • Internal Vehicle related APIs
      • Remote Code Execution on multiple systems
      • Memory leaks leading to employee/customer PII disclosure, account access
    • Hyundai, Genesis
      • Fully remote lock, unlock, engine start, engine stop, precision locate, flash headlights, and honk vehicles using only the victim email address
      • Fully remote account takeover and PII disclosure via victim email address (name, phone number, email address, physical address)
      • Ability to lock users out of remotely managing their vehicle, change ownership
    • BMW, Rolls Royce
      • Company-wide core SSO vulnerabilities which allowed us to access any employee application as any employee, allowed us to…
        • Access to internal dealer portals where you can query any VIN number to retrieve sales documents for BMW
        • Access any application locked behind SSO on behalf of any employee, including applications used by remote workers and dealerships
    • Ferrari
      • Full zero-interaction account takeover for any Ferrari customer account
      • IDOR to access all Ferrari customer records
      • Lack of access control allowing an attacker to create, modify, delete employee “back office” administrator user accounts and all user accounts with capabilities to modify Ferrari owned web pages through the CMS system
      • Ability to add HTTP routes on api.ferrari.com (rest-connectors) and view all existing rest-connectors and secrets associated with them (authorization headers)
    • Spireon
      • Multiple vulnerabilities, including:
        • Full administrator access to a company-wide administration panel with ability to send arbitrary commands to an estimated 15.5 million vehicles (unlock, start engine, disable starter, etc.), read any device location, and flash/update device firmware
        • Remote code execution on core systems for managing user accounts, devices, and fleets. Ability to access and manage all data across all of Spireon
        • Ability to fully takeover any fleet (this would’ve allowed us to track & shut off starters for police, ambulances, and law enforcement vehicles for a number of different large cities and dispatch commands to those vehicles, e.g. “navigate to this location”)
        • Full administrative access to all Spireon products, […]
        • In total, there were…
          • 15.5 million devices (mostly vehicles)
          • 1.2 million user accounts (end user accounts, fleet managers, etc.)
    • Ford
      • Full memory disclosure on production vehicle Telematics API discloses
        • Discloses customer PII and access tokens for tracking and executing commands on vehicles
        • Discloses configuration credentials used for internal services related to Telematics
        • Ability to authenticate into customer account and access all PII and perform actions against vehicles
      • Customer account takeover via improper URL parsing, allows an attacker to completely access victim account including vehicle portal
    • Reviver
      • Full super administrative access to manage all user accounts and vehicles for all Reviver connected vehicles. An attacker could perform the following:
        • Track the physical GPS location and manage the license plate for all Reviver customers (e.g. changing the slogan at the bottom of the license plate to arbitrary text)
        • Update any vehicle status to “STOLEN” which updates the license plate and informs authorities
        • Access all user records, including what vehicles people owned, their physical address, phone number, and email address
        • Access the fleet management functionality for any company, locate and manage all vehicles in a fleet
    • Porsche
      • Ability to send retrieve vehicle location, send vehicle commands, and retrieve customer information via vulnerabilities affecting the vehicle Telematics service
    • Toyota
      • IDOR on Toyota Financial that discloses the name, phone number, email address, and loan status of any Toyota financial customers
    • Jaguar, Land Rover
      • User account IDOR disclosing password hash, name, phone number, physical address, and vehicle information
    • SiriusXM
      • Leaked AWS keys with full organizational read/write S3 access, ability to retrieve all files including (what appeared to be) user databases, source code, and config files for Sirius

Car Hacking News Timeline 2017-2019 [1]

  • 2019: Hack of an OEM’s automotive cloud via third-party services and tier-1 supplier network
  • 2019: Memory vulnerability at a cloud provider exposed data incl. passwords, API keys, and tokens
  • 2019: A malware infection caused significant production disruption at a car parts manufacturer
  • 2019: Vehicle data exposed during registration allowed for remote denial-of-service attacks on cars
  • 2019: Malware infected the back end, making laptops installed in police cars unusable
  • 2018: An ex-employee breached the company network and downloaded large volumes of personal information
  • 2018: Cloud servers hacked and used for cryptomining
  • 2018: Researchers exploited vulnerabilities of some infotainment systems and gained control of microphones, speakers, and navigation systems
  • 2018: Security issues discovered in 13 car-sharing apps
  • 2018: Researchers demonstrated >10 vulnerabilities in various car models, gaining local and remote access to infotainment, telematics, and CAN buses
  • 2018: EV home chargers could be controlled by accessing the home Wi-Fi network
  • 2017: Rental car companies exposed personal data
  • 2017: Ransomware caused the stop of production across several plants

Car Hacking News Timeline 2002-2015 [2]

 

 

 

Sources:

  1. McKinsey – Cybersecurity in automotive
  2. https://www.iamthecavalry.org/domains/automotive/
  3. https://smart.gi-de.com/automotive/brief-history-car-hacking-2010-present/

Risk Assessment of AWS services used in building a resilient Web App on AWS

/in

We wrote here in the article “Building Resilient Web Applications on AWS: A Comprehensive Approach to Security” how to use certain AWS services to implement a resilient web based application.

The services mentioned require also a brief analysis in respect to Security, Confidentiality, Integrity, Availability and Privacy.

 

CloudTrail

AWS CloudTrail records API calls and creates log files, providing visibility into user activity, resource changes, and actions taken within your AWS account.

Risk Assessment

  • Security: Unauthorized modifications to CloudTrail settings or log tampering.
  • Confidentiality: Exposure of sensitive log data.
  • Integrity: Unauthorized access to CloudTrail logs.
  • Availability: Disruptions in CloudTrail could impact auditability.

Mitigation

Implement access controls, enable log file integrity validation, regularly review logs, and use redundant log storage.

Privacy

  • Data Collection: CloudTrail logs AWS account activity, potentially containing sensitive information.
  • Data Storage: Logs include API calls and identity details, stored securely by AWS.
  • Data Retention: AWS retains logs for a limited time and may use aggregated data for service improvement.

 

CloudWatch

CloudWatch is a monitoring service that provides real-time insights into AWS resources and applications, helping you respond quickly to events or changes in your environment.

Risk Assessment

  • Security: Unauthorized access to CloudWatch data.
  • Confidentiality: Exposure of sensitive monitoring data.
  • Integrity: Unauthorized modifications to monitoring configurations.
  • Availability: Relies on underlying infrastructure; disruptions may impact real-time monitoring.

Mitigation

Implement access controls, encrypt sensitive data, conduct regular audits, and employ redundancy for critical components.

Privacy

  • Data Collection: CloudWatch collects and monitors performance and operational data.
  • Data Storage: Metric data and configurations are stored securely by AWS.
  • Data Retention: AWS retains metric data for a limited time and may use aggregated data for service improvement.

 

AWS IAM

IAM is AWS’ cloud-based identity and access management service, providing authentication and authorization for users and devices.

Risk Assessment

  • Security: Unauthorized access to user accounts or directory configurations.
  • Confidentiality: Exposure of sensitive identity information.
  • Integrity: Unauthorized modifications to user attributes or directory settings.
  • Availability: Downtime impacting authentication and access control.

Mitigation

Implement multi-factor authentication, strong password policies, regular security audits.

Privacy

  • Data Collection: AWS IAM collects and manages user authentication and authorization data.
  • Data Storage: User identities, permissions, and access policies are stored securely by AWS.
  • Data Retention: AWS retains user data for service functionality and may use aggregated data for service improvement, but individual user data is not disclosed externally.

AWS Fargate

AWS Fargate is a serverless compute engine for containers that lets you run containers without managing the underlying infrastructure.

Risk Assessment

  • Security: Unauthorized access to containerized applications.
  • Confidentiality: Exposure of sensitive container configurations.
  • Integrity: Unauthorized modifications to container environments.
  • Availability: Downtime impacting containerized application execution.

Mitigation

Implement access controls, encrypt container data, conduct regular security scans, and deploy in a redundant and scalable manner.

Privacy

  • Data Collection: Fargate processes and manages containerized applications.
  • Data Storage: Task and container configurations are stored securely by AWS.
  • Data Retention: AWS retains task and container data for a limited time and may use aggregated data for service improvement.

AWS WAF (Web Application Firewall)

AWS WAF is a web application firewall that helps protect web applications from common web exploits, such as SQL injection, cross-site scripting (XSS), and other malicious attacks.

It allows users to create custom rules or use managed rule sets to filter and block malicious traffic before it reaches applications.

Risk Assessment

  • Security: Unauthorized access to WAF configurations, potential bypassing of WAF rules by sophisticated attackers.
  • Confidentiality: Exposure of sensitive application data due to successful attacks.
  • Integrity: Unauthorized modifications to WAF rules or configurations.
  • Availability: Downtime or service disruption due to misconfigurations or overwhelming attacks.

Mitigation

Implement strong access controls, regularly update and fine-tune WAF rules, use managed rule sets, enable logging for analysis, and deploy redundant WAF instances for increased availability and load distribution.

Privacy

  • Data Collection: WAF collects logs containing information about incoming requests, potential threats, and blocked requests for security analysis.
  • Data Storage: Logs may include IP addresses and request details but are retained for a limited time, following AWS data retention policies.
  • Data Retention: AWS may use aggregated and anonymized data for improving the service but doesn’t share identifiable customer information.

 

 

AWS Lambda

A serverless stack based on AWS Lambda allows developers to build and deploy applications without managing servers, handling scalability automatically.

Risk Assessment

  • Security: Unauthorized access to serverless functions and configurations.
  • Confidentiality: Exposure of sensitive code and data processed by Lambdas.
  • Integrity: Unauthorized modifications to serverless function code.
  • Availability: Downtime impacting serverless function execution.

Mitigation

Implement access controls, encrypt sensitive data, conduct regular security scans, deploy in a redundant manner, and monitor for anomalies.

Privacy

  • Data Collection: Lambda functions process and execute code, potentially handling sensitive data.
  • Data Storage: Function configurations and logs may include details about processed data.
  • Data Retention: AWS retains logs for a limited time and may use aggregated data for service improvement.

AWS Secrets Manager

AWS Secrets Manager helps you protect access to your applications, services, and IT resources without upfront investment and on-going maintenance costs.

Risk Assessment

  • Security: Unauthorized access to stored secrets.
  • Confidentiality: Exposure of sensitive credentials and configuration details.
  • Integrity: Unauthorized modifications to stored secrets.
  • Availability: Downtime impacting applications relying on stored secrets.

Mitigation

Implement access controls, regularly rotate secrets, encrypt stored secrets, conduct regular audits, and use redundant Secrets Manager configurations.

Privacy

  • Data Collection: Secrets Manager stores sensitive configuration and credential data.
  • Data Storage: Secret configurations and access logs may include details about stored data.
  • Data Retention: AWS retains access logs for a limited time and may use aggregated data for service improvement.

CloudFront

Amazon CloudFront is a content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency and high transfer speeds.

It integrates with other Amazon Web Services products to give developers and businesses an easy way to distribute content to end-users.

 

Risk Assessment

  • Security: Unauthorized access to cached content or configurations, potential for content tampering during distribution.
  • Confidentiality: Exposure of sensitive content during distribution.
  • Integrity: Unauthorized modifications to distribution settings or cached content.
  • Availability: Downtime impacting content delivery due to misconfigurations or attacks.

Privacy

  • Data Collection: CloudFront collects logs that include IP addresses, user-agents, and request details for analytics and troubleshooting.
  • Data Storage: Logs may contain user-related information, but Amazon retains them for a limited period and follows privacy regulations.
  • Data Retention: Amazon may share aggregated and anonymized data for service improvement but doesn’t disclose individual customer data.

AWS S3

Amazon S3 is a scalable object storage service designed to store and retrieve any amount of data at any time.

Risk Assessment

  • Security: Unauthorized access to stored objects or bucket configurations.
  • Confidentiality: Exposure of sensitive data stored in S3.
  • Integrity: Unauthorized modifications to stored objects.
  • Availability: Downtime impacting data storage and retrieval.

 

Mitigation

Implement access controls, encrypt data at rest, conduct regular audits, use versioning, and deploy redundant S3 configurations.

 

Privacy

  • Data Collection: S3 stores object data, potentially including sensitive information.
  • Data Storage: Bucket configurations and access logs may include details about stored data.
  • Data Retention: AWS retains access logs for a limited time and may use aggregated data for service improvement.

EC2 (Elastic Compute Cloud)

AWS EC2 provides resizable compute capacity in the cloud, allowing users to run virtual servers for various applications and workloads.

Risk Assessment

  • Security: Unauthorized access to EC2 instances.
  • Confidentiality: Exposure of sensitive data processed by EC2 instances.
  • Integrity: Unauthorized modifications to instance configurations.
  • Availability: Downtime impacting applications hosted on EC2.

Mitigation

Implement access controls, regularly patch and update instances, encrypt sensitive data, deploy in a redundant manner, and use Auto Scaling for increased availability.

Privacy

  • Data Collection: EC2 instances may process and store data, potentially including sensitive information.
  • Data Storage: Instance configurations and logs may contain details about processed data.
  • Data Retention: AWS retains logs for a limited time and may use aggregated data for service improvement.

The post Risk Assessment of AWS services used in building a resilient Web App on AWS first appeared on Sorin Mustaca on Cybersecurity.