Why cyberattack risks rise as cars become more connected

Automakers and governments globally are making strides to address the issue of cybersecurity, given the inherent vulnerabilities that come with having highly connected vehicles, many of which will be fully electric, making them reliant on an expanding network of highly connected chargers.

With more connectivity comes a greater risk of ransom attacks.

Ransomware as a service is expected to be one of the fastest-growing cybercriminal activities over the next decade, according to a November report from BMI FitchSolutions.

The industry is taking action as they race to comply with United Nations regulations that aim to ensure all connected vehicles are protected against cyberattacks.

The new rules on cybersecurity and software updates went into effect for all new vehicle types in July 2022 and will become mandatory for all new vehicles produced starting July 2024.

The rules have already been adopted by the EU, South Korea, Japan and Australia, while India is creating a similar standard for cars made in the country. The U.S., however, remains an outlier among major economies on adopting automotive cybersecurity standards.

The rules have already had an effect on the market, serving as a contributing factor to the discontinuation of a low-cost electric minicar and a premium SUV.

This month Porsche said it would stop sales of the Macan in the European Union in  the spring -- which is earlier than planned  -- because the compact SUV does not meet new rules on cybersecurity regulations.

The Macan was developed before the exact requirements of the cybersecurity regulations were known and it would be too costly to update the SUV to meet the rules, a spokesperson told Automotive News Europe’s German sister publication, Automobilwoche.

Earlier this year, Volkswagen brand CEO Thomas Schaefer told Automobilwoche that production on the e-Up would end in mid-2024 because of the new rules for cybersecurity.

The e-Up full-electric minicar is VW brand's entry EV, starting at 29,995 euros in Germany.

As vehicles become increasingly connected and complicated a big investment in cybersecurity and IT professionals will be required. The average vehicle has 100 million lines of code, compared to less than 7 million for a Boeing Dreamliner, according to Continental.

Tractors included

India’s regulations, which are expected to roll out by mid-2024, include comprehensive provisions for passenger vehicles, commercial vehicles, electric vehicles, EV charging infrastructure, and even tractors equipped with electronic control units.

The initiative requires automakers to integrate cybersecurity management devices or systems into vehicles and furnish a compliance certificate to the government. The move is prompted by the increasing risks of cyberattacks targeting vehicles, particularly those using charge points, many of which lack heavy strong cybersecurity.

These vulnerabilities pose potential threats to power grids, automotive operating systems, and could even affect automakers through compromised communication protocols.

An attack on a vehicle's operating system can make it unresponsive to prompts given by the driver. An attack could also give hackers a backdoor into an automaker -- or a utility – leaving them vulnerable to corporate espionage.

BMI FitchSolutions projects that the implementation of robust cybersecurity measures is likely to raise manufacturing costs in India and spark higher demand for semiconductors for vehicles.

Despite these challenges, the Fitch estimates an average annual growth of 11.3 percent in India's vehicle production (both passenger and commercial vehicles) from 2024 to 2032, a trajectory putting India on the path to become the world's second-largest vehicle producer after China.

"This highlights how crucial early implementation of strong cybersecurity regulations will be for the Indian automotive industry," the report noted.

A May report from Israel's Argus Cyber Security revealed that 38 percent of suppliers and 17 percent of automakers ranked budget issues as the biggest challenge in complying with new cybersecurity regulations.

Young industry

Manish Menon, global program manager, connected cars and autonomous driving at Frost & Sullivan, said automotive cybersecurity is still at its infancy.

Menon said that for India to get to the level of Israel when it comes to being a leader in the sector it would need to outsource cybersecurity solutions to players in different geographies.

"Implementing strict standards over and above the mandated regulation along with cutting-edge research in this domain will be central," he added. "Currently, this position is taken by Israel in the automotive industry, with a spurt of startups cropping up in the automotive cybersecurity domain."

Gartner analyst Pedro Pacheco said the steps India is taking in the sector “clearly show the direction we are headed, because regulators understood that there is a big risk as vehicles are becoming more connected."