Manufacturing

The automobile industry is increasingly becoming a target for cyber-attacks as vehicles evolve into sophisticated, connected systems. This transformation introduces vulnerabilities at multiple levels, from manufacturing processes to the vehicles themselves. Cyber threats in this sector can disrupt production lines, compromise sensitive data, and even endanger public safety through attacks on vehicle control systems. This abstract explores the nature of these threats, including ransomware, data breaches, and vehicle hacking. It highlights the importance of robust cybersecurity measures and industry-wide collaboration to safeguard against these evolving risks. Emphasizing the critical need for enhanced cybersecurity protocols, this study calls for continuous vigilance and adaptive strategies to protect the automotive industry’s integrity and ensure the safety of its products. The Rising Threat: Cyber Attacks on the Automobile Industry The automobile industry is no exception in an era where technology drives innovation across all sectors. Modern vehicles are increasingly becoming computers on wheels, integrating advanced software systems, connectivity, and automation to enhance user experience, safety, and efficiency. However, this digital transformation also opens new avenues for cyber threats. This blog explores the nature of cyber-attacks on the automobile industry, their implications, and the measures being taken to mitigate these risks. Cyber-attacks on the automotive industry can take many forms, from hacking into vehicle systems to targeting manufacturing processes and supply chains. These attacks can lead to severe consequences, including the theft of sensitive data, disruption of operations, and even compromising the safety of the vehicles. How IT-OT cyber-attacks in automobile industries have been increased in the last 5 years? Fig: 1 shows the approx. number of cyber-attacks attacked occurred and increased in automobile industries. Recent cyber attacks How Tesla thwarted ransomware attacks Attackers identified an unprotected Kubernetes console belonging to Tesla, The Kubernetes console was not password-protected, which allowed the attackers to gain unauthorized access. This lack of security is a critical misconfiguration, as it provides a gateway to sensitive internal systems. Once inside the Kubernetes environment, the attackers deployed containers designed to mine cryptocurrency. To avoid detection, the attackers configured the mining software to use a minimal amount of CPU power, ensuring that the spike in resource usage was not easily noticeable and they used techniques to obfuscate the network traffic, making it difficult for Tesla’s security systems to detect the malicious activity. Similarly, if attackers gain access to the IT side of an OT company, they can launch attacks on the OT side by moving laterally within the network. This type of lateral movement allows attackers to penetrate deeper into the organization’s infrastructure, compromising operational technology systems and potentially causing significant disruption. Sign up for a risk assessment today: Contact Sectrio Another example from Tesla thwarts ransomware attempt 2020, where a Russian threat actor named “Egor Igorevich Kriuchkov” tried attacking Tesla by using social engineering method where the attacker offered to bribe the employee with $1 million to install malware on Tesla’s network, The malware was intended to provide remote access to the attackers, allowing them to deploy ransomware, employee inserting a USB drive containing the malware into Tesla’s internal network or executing a malicious email attachment. The malware was designed to establish a backdoor, enabling the attackers to exfiltrate sensitive data and encrypt critical systems with ransomware. Before deploying ransomware, the attackers planned to exfiltrate large amounts of sensitive data as leverage to ensure Tesla would pay the ransom and once data exfiltration was complete, the ransomware would encrypt Tesla’s critical systems, causing significant disruption to operations.Based on our current research we have observed that the attacks on the automobile industry have drastically increased in recent years, Let’s understand the threat increasing the Automobile sector in more detail by seeing the output of the attacks received on our Automotive honeypot lab, dark web analyze and some open-source intelligence research. Sectrio’s honeypot network in the Automobile Industries In the heart of an automotive manufacturing facility, where precision and innovation drive the production line, lies a hidden gem—a meticulously crafted honeypot designed to lure cyber attackers. This honeypot, camouflaged within the network, mimics the complex IT and OT environment of the automotive industry, silently waiting to detect and analyze malicious activities. The Genesis of the Honeypot Our journey began with a clear objective to understand the ongoing cyber-attacks targeting the Automobile industry and to enhance security. We have designed our OT honeypot architecture to monitor and analyze the new and possible types of attacks on automotive industries, complete with both IT and OT components. Our Automobile honeypot is segmented into the IT Network, OT Network, and the DNZ zone. IT Networks consist of different servers, Endpoint workstations, and other Networking devices. OT Network consists of PLCs, RTUs, SCADA systems, HMIs, CNC machines, CAN Bus Networks, MES, etc. All the traffic coming to this honeypot is captured and monitored to identify attacks and enhance the detection power of the Section’s Operational technology Intrusion detection system in the Automobile industry. The chances of attackers targeting the OT systems of automobile industries are increasing day to day and after in-depth research and analysis from our honeypot traffic, Dark web, and some OSINT we have observed that Ransomware attacks are more commonly happening in the automotive industry. Let’s understand some attacks from our honeypot lab with an example, a)    Manipulating the CAN Bus The first sign was seen when our OT Intrusion Detection system flagged an anomaly on the CAN bus network, the backbone of communication within vehicles and a popular communication standard in the automobile sector, It helps in communication between different electronic control units. The Electronic Control Unit (ECU) is responsible for processes in a car, which includes the break, engines, airbags, etc. The ECUs can communicate with the help of the CAN protocol. An attacker had injected false messages, attempting to manipulate the signals controlling the robotic assembly arms. This attack aimed to disrupt the precise coordination required for assembling vehicle components. Due to the honeypot environment, the attack was within the simulated environment allowing us to research and analyze the attack

The IoT market is projected to hit the $1.5 Trillion mark by 2025. Doesn’t that number look staggering? Putting in perspective, it’s a 600% growth from 2019, when the IoT market was pegged at $250 Billion. It is expected that 25 billion devices will be a part of the IoT network by 2025 with smartphones making 24% or 6 billion of the total devices. The biggest beneficiary of the IoT revolution is Industry 4.0. The IoT revolution can take off only if we can secure troves of data flowing through billions of IoT connections. This brings us to the focus point – IoT Security. IoT Security – The key that unlocks Industry 4.0 IoT security involves securing software, hardware, and networks that store, handle, collect, transmit, and process data. Be it your garage shutter, rolling up when your car enters your home perimeter, or your lights turning on the moment you enter the room, work on sensors. These sensors collect and send the data to a Command Center, which then processes and sends the response. This data needs to be secured. Your devices need to be secured. The entire network needs to be secured. This is what IoT security deals with. It comprises tools, strategies, and methods to secure you from bad actors who constantly keep coming back to find vulnerabilities in your networks. Unlike device-based security, like a smartphone or a laptop, IoT security is cloud-based. It is the fundamental block of the IoT – Big Data – Cloud Computing ecosystem. While IoT devices help in generating and collecting the data, the Big Data platform deals with analytics. The cloud computing system stores, processes, and addresses other aspects related to data mobility. IoT security ensures that everything taking place in the cloud and within the IoT devices is well protected. “The fate of Industry 4.0 is in the hands of IoT security and not just IoT device interconnectivity”, opines major players in Technology, Industries, Logistics, Commerce, and Government agencies. To tackle IoT Security challenges, Sectrio believes in the deployment of a robust IoT security management plan. At a design level, adopting security-by-design architecture is the best way to prevent and mitigate IoT security threats and vulnerabilities. A network without IoT Security is a house without a roof! What would it be like to lose control over a 100-Tonne machine on an industrial site? What would happen if a subway railway signaling system fails? It’s even difficult to imagine. Complex systems like power distribution, water management, traffic management, smart homes, and a ton of other systems and devices are interconnected via IoT devices, forming complex networks. Also read: Why IoT Security is Important for Today’s Networks? While the goods of IoT connectivity are already known, the worst of it is yet to come. Any compromise on the security of these complex networks can lead to a catastrophic event. If a military network, nuclear plant network, or power transmission grid is compromised, the threat could be at a national level. Robust IoT security is imperative for complex and sensitive networks which keep this world on its wheels. From a cybersecurity expert’s POV, there are a host of IoT security challenges that a cybersecurity team has to deal with.   Let us take an example of a smart automotive manufacturing factory. The functioning and competence of the factory highlight what the IoT revolution has to offer with time. On the other side, the same factory is a strong case to understand how important IoT security is. Upon infiltrating the factory’s network, hackers can get access to key systems and processes running on the factory floor. It’s only a matter of time before they get control over ‘privilege escalation’ permissions. In the case of our automotive manufactory factory, hackers can tinker with the settings of a manufacturing unit or an assembly unit, putting hundreds of lives in jeopardy. Similarly, if they manage to enter a Medical Command Control that monitors hundreds of medical devices like artificial pacemakers, there is a chance for greater human loss. Even in-home gadgets like CCTVs, Smart TVs, Smart Refrigerators, and others are not safe. These devices are configured to the home networks without their default credentials being changed. This puts the entire network at risk and the mercy of bad actors. It is important to have all endpoints of a network secured. The data passing between the devices and the cloud should be encrypted at all times. This mitigates the risk even during a data breach.   Understanding the IoT Security Framework Most guides based on various IoT Security frameworks strictly depend on protocols and pre-defined policies that are actioned via the cloud. Depending on the nature of the industry, level of data collected, data processing, and other parameters, enterprises meet certain compliance standards as required by local laws. While this holds good for secure data processing on the IoT device, even manufacturers and consumers should be cognizant of their practices. IoT Security Framework is primarily spread across three levels: Physical Layer: 1. Security-by-design IoT Security by design should be strictly implemented. The development team should consider the ‘security’ feature as important as the device itself, being embedded into the SoC (System on Chip). This minimizes IoT security threats during the lifetime of the IoT device. Patch and firmware updates should be provided only through a secure mechanism. 2. Accessing the device At all times, user access credentials should be confidential and private. To prevent ‘brute force’ unlocking and abusive login attempts, steps should be undertaken. A thorough IoT security testing can help minimize IoT security risks. MFA should be mandatory to access sensitive data. 3. Detection and Anti-tamper Mechanism Manufacturers should ensure that no tampering with the IoT device can take place with minimal tools during shipping and installation. A comprehensive detection system should be in-built to alert the command control if needed. Complying with certain security certifications can help consumers make better choices in buying IoT devices. This is of primary importance owing to the