Automotive companies are warming up to vulnerability disclosure programs

The automotive industry is looking to step up its collaboration with cybersecurity researchers to identify software and hardware bugs after a watershed 2015 hacking demo.

The automotive industry is looking to step up its collaboration with cybersecurity researchers to identify software and hardware bugs in order to better protect vehicles, which are becoming more connected and automated.

“We’ve begun to actively develop relationships with the researcher community to encourage them to look at our vehicles and to let us know if they find vulnerabilities,” Harry Lightsey, an executive at General Motors, said Tuesday at the Wilson Center in Washington, D.C.

A case in point is a workshop in Detroit next week that will show industry representatives how to set up an effective vulnerability disclosure program, a practice that enlists outside researchers to find bugs in an organization’s equipment.

The workshop’s goal will be to “understand what a vulnerability disclosure program is, how to stand one up, what the pitfalls are,” Faye Francy told CyberScoop after the Wilson Center event. She heads the Automotive Information Sharing and Analysis Center (Auto-ISAC), the threat-sharing hub hosting the workshop.

Some companies are further along in embracing vulnerability disclosure than others: Fray estimated that 20 percent of Auto-ISAC’s 47 members, which include automotive giants like Ford, GM, and Mercedes-Benz, have disclosure programs in place. Some automotive companies have also adopted bug bounty programs; Fiat-Chrysler was the first major car manufacturer to do so in 2016.

“There’s a lot of devil in the details” in setting up a disclosure program, Francy said.

“You need to have a process of how to handle these, how to adjudicate them, how quickly you’re able to disclose that more broadly [and not just within the company],” she told CyberScoop, outlining what Auto-ISAC members stand to learn at the workshop.

HackerOne, a company that specializes in bug bounty programs, will help run the Motor City tutorial.

The auto industry’s complex supply chain make tight collaboration between suppliers key to an effective disclosure program, according to HackerOne CTO Alex Rice.

“If a single vulnerable supplier refuses to collaborate with a friendly hacker, it can increase the risk for the entire ecosystem,” he told CyberScoop.

The increasing willingness of car makers to collaborate with white-hat hackers comes after the two groups famously crossed paths in 2015, when researchers Charlie Miller and Chris Valasek showed how to remotely commandeer a Jeep, taking over its steering and braking. Chrysler responded by recalling 1.4 million vehicles affected by the software vulnerability.

After that demonstration, “I think the immediate reaction was to kind of put the researcher community at arm’s length,” Lightsey said. “But I think the industry has moved beyond that and…[is] working very hard on outreach to that community because they’re an incredible resource.”

Since the Jeep hack demonstration, disclosure programs have gradually gained traction with car makers. GM set up a program through HackerOne in 2016 that has resolved 700 vulnerabilities, according to Rice.

But program adoption in the industry’s vast supply chain, with all of its complexities and potential vulnerabilities, has been slower: Just two of the industry’s top 50 suppliers have a program in place, according to HackerOne.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure