Donny Seyfer, chairman of the Automotive Service Association and owner of Seyfer Automotive in Wheat Ridge, Colo., tours the country teaching shop owners all about connected cars. And, while he would love to quell their fears about the possibility of cybersecurity breaches associated with modern vehicles, he can’t currently do so.
Instead, Seyfer prepares shops for the growing threat posed by hackers.
“Sometimes shops don’t even know if they’ve been hit,” Seyfer says, in regard to breaches in cybersecurity, in which vehicle or customer information is compromised. “So really, what this is all about is being proactive.
“We’re just trying to stay ahead of the curve as much as we can, before something really nasty happens. … We just think it’s going to get worse and worse.”
High-end vehicles in 2015 averaged more than 100 million lines of software code per car, according to data research firm Information is Beautiful; Facebook uses just over 60 million. Additionally, according to market intelligence firm VDC Research, the average new car in 2015 came equipped with 30 microprocessors, and “the cybersecurity of those embedded systems is severely challenged by in-vehicle Internet connectivity.”
“A lot of shop owners,” Seyfer says, “still have that [mentality], ‘Why would [hackers] be interested in me? There’s all these big things they could get, like credit cards and things like that; I don’t keep any of that information.’
“But it’s amazing how much information you actually do keep.”
Consumers are aware of the threat of data hacks, but they’re largely ignorant to how such breaches happen, Seyfer says. In his observation, most consumers are under the impression that information is compromised through crimes like vehicle break-ins—when, in reality, the issue is far more wide reaching than that.
Fortunately, Seyfer has thoroughly studied how shop owners can limit the chances of a cybersecurity breach within their facilities. He’s eager to offer tips, too. But first, he explains how data hacks typically occur in the industry.
How Issues Arise
What, precisely, causes an infestation of software-related “bugs” in the auto repair industry? Often, it’s sophisticated foreign hackers, Seyfer says. And, on occasion, it’s your own shop employees or customers.
These days, professional hackers are often looking to place malware (software that’s intended to damage computer systems) on open systems; i.e., systems with no password protection like those that are all too prevalent at auto shops.
“They’re trying to place a piece of malware on servers that appear to have interactions with cars,” Seyfer explains.
“The most pervasive risk that can happen is the threat that comes from spyware-infected cell phones walking in and being connected to your network. The goal is to infect a car through an open port, either on a scan tool, TPMS, the car’s Wi-Fi or Bluetooth. The shop can be completely unaware this has happened.
“It is believed that that this type of attack is looking to use the car as a mobile means to connect to more important information,” Seyfer says.
One noteworthy incident of malware rearing its ugly head occurred recently when a platform typically used in Dodge Charger police vehicles—FCA products—was compromised. Homeland security discovered the threat and required all of those vehicles to receive an update to their center stack software, Seyfer notes.
“Usually these are timer-based applications,” Seyfer says, “where they’re all looking to happen on the same day, when they can really cause some trouble.”
Now to those unwitting accomplices: In 2017, data breaches often occur because consumers’ cell phones have rather weak, four-digit password security, or those devices have been used to visit non-secure websites. Seyfer notes that this can often happen with employee or customers’ devices.
“They’re walking in with the hack on the phone, or on a machine that they carry back and forth to the shop,” Seyfer notes. “Maybe they’ve got a piece of scan tool software. They take it home, and they’re on fantasy football or fantasy baseball or whatever, and some of those sites are not all secure.”
Of course, sometimes shop owners only have themselves to blame for leaving their facilities susceptible to a cybersecurity breach. Seyfer suggests taking a look around your shop and securing technological devices that may have an open-share setup, for example.
“A lot of us have got printers that, by the way they’re built, are set up so that anything on the network can attach to them,” he says. “A lot of times there’s a server, or a machine that accesses that printer, that’s got an open share going on. So that can basically be a portal from outside right through to your network.”
Providing Protection
If you’re a shop operator guilty of the above cyber oversights, know that you’re not alone. Seyfer sees plenty of similar offenders during his travels for ASA.
In Seyfer’s opinion, these are the best ways to can brace your shop for cybersecurity threats:
Break your network up. To protect key information, Seyfer suggests utilizing a firewall, and breaking your shop’s data network into segments that are independent of each other.
For example, in Seyfer’s shop, he sees to it that nothing goes on the scan tool network except the facility’s scan tools. Then, his staff asks customers to work off a dedicated wireless connection. Additionally, the shop’s technicians use the guest network for their cell phones, along with any devices that they bring from home.
“You want to have separate networks for these machines to live on by IP address,” Seyfer says, “... so that the shop management system and scan tool network are not exposed.”
Rein in your Wi-Fi reach. Seyfer has noticed that many shops have Wi-Fi network reaches that extend for seemingly the length of a city block. That can expose your network to far more people than necessary.
“We limit it to our property,” Seyfer says, in regard to his Colorado shop, “because we found people were using our Wi-Fi when we were not well locked down.”
Seyfer says adjusting your Wi-Fi set-up’s reach “is a job for an IT specialist. Higher quality access points and wireless routers often have the ability to adjust the strength of the signal. We take a device to the edge of where we want our signal to go and adjust the signal.”
Change your passwords often. This is a fairly obvious, though often neglected, rule of thumb: Changing your business’s passwords periodically can limit the risk of a potential data breach. Similarly, Seyfer says it’s important to run any and all suggested security updates on your Window or Mac devices.
Seyfer suggests changing passwords at least twice per year—ideally at unpredictable intervals—as well as whenever there is personnel turnover in your shop, or when anyone affiliated with your business is the victim of identity theft.
“If every shop in the country simply solved their Wi-Fi and their wired networks, and put some good security passwords on them,” Seyfer adds, “that would be a huge improvement.”
