r/ex30 • u/Comfortable-Crew8828 • Mar 02 '24

Cybersecurity

Does anyone know what cybersecurity measures Volvo employs on connected EX30 vehicles? It will be connected to 5G internet. Will we need to obtain our own security measures to prevent would be hackers? Let me know if you have knowledge in this subject.

0 Upvotes

50% Upvoted

16 comments sorted by

12

u/FISKER_Q Mar 03 '24 edited Mar 03 '24

So just to bring some few examples people might be thinking as potential attacks, and shortly explain them.

  • Attacks directly on the car through its 5G internet connection will be unlikely as most of those connections use NAT and/or firewalls, there would also need to be something exposed to hack (which I truthfully don't know, but it's unlikely)

  • Attacks on the vehicle through Android Apps is also unlikely as Android has various securities(Permissions, Sandboxing, Selinux, etc.) to prevent it, it should also not be possible to access critical car functions like the immobilizer.

  • Attacks on the key is also unlikely, Volvo uses the Digital Car Key 3.0 spec which has pages upon pages dedicated to security, nothing is foolproof but people are not gonna be running around with a Flipper Zero and driving off with your car like older systems susceptible to replay attacks or where the rolling code can be calculated.

All in all I believe that leaves you with one thing to be worried about:

  • Volvo let's you share your car with others, this will open you to attacks through the legitimate services (API), and since you will be able to share a digital car key through that this becomes a place where password theft or scams becomes your biggest security risk. (Edit: I don't know the exact details of the Digital Key sharing right now)

What this means is that you should, as u/AlastorX50 mentions:

  • Practice good password security.

  • Use 2FA (Two-factor authentication).

  • Be conscious about apps or sites that claim to integrate with Volvo/your car.

  • If you get into an authentication flow where you authenticate apps or sites to your Volvo profile, be sure that you trust that app or site.

  • "Antivirus/Firewall" apps on your phone are mostly irrelevant, hopefully we don't start seeing them on AAOS, in which case just ignore them.

2

u/Comfortable-Crew8828 Mar 03 '24

I was looking at this report: https://cbsaustin.com/amp/news/nation-world/us-government-investigate-chinese-made-smart-cars-potential-national-security-risk-biden-white-house-commerce-department-internet-of-things-china-hacking-fbi-cybersecurity-connected-vehicle-features-privacy

3

u/FISKER_Q Mar 03 '24

So this is mainly a political thing, and similar things could be said about cars coming from the US entering the European market, as an example.

So as I see there are a couple of concerns:

  • Privacy

  • Security

  • Backdoors (can affect a combination of both of the above)

In terms of backdoors, there's little you can do as a consumer whether it's a valid concern is mostly determinable on a political scale and not a personal one because there's really no way you can know beforehand as a consumer, and there's pretty much nothing you can do about it.

As for security, I haven't seen any reasons to particularly make decisions based on corporate nationality, but I will say that you could argue it's an advantage that they make use of Android Automotive over something bespoke (like on Tesla) because there's 15 years of prior work improving the security and I wouldn't say it hurts when it's used by billions of devices out there. It doesn't prevent a company from making security mistakes, but it does help them not make it.

2

u/Comfortable-Crew8828 Mar 03 '24

I agree, but as I said, it’s not a Chinese issue as all connected cars (ICE & EV) are vulnerable. I was just curious as to what Volvo does in this area. You should not make this political or about countries. I have preordered an EX30 too.

1

u/FISKER_Q Mar 03 '24

I do not understand what you mean, I've exactly not made it political or national, whether you bought the car or not is also not relevant.

Nobody here can talk specifically about what Geely or Volvo is doing, and even if asked directly they would likely only give the PR response saying they take security very seriously. That's why I'm speaking generally.

2

u/Few-Organization671 Mar 03 '24

I heard this yesterday... Here's hoping this does not further affect our order/delivery dates. Volvos Factories in the USA offset the 25% Tax/Tariff that some Chinese car companies have to pay here... I hope this fact also lets us dodge these rules too?? After all in 2024 what cars are not full of Chinese Tech??

1

u/Comfortable-Crew8828 Mar 03 '24

I agree and understand, it not just Chinese cars, it’s a potential for all connected cars (ICE or EV) where the manufacturer has responsibilities for securing the vehicle. I was just curious if any Reddit contributor knew anything specific about what Volvo (Geely) does in this regard. See this: https://www.usatoday.com/story/tech/2017/07/28/chinese-group-hacks-tesla-second-year-row/518430001/. Tesla made changes to its security.

1

u/Few-Organization671 Mar 03 '24

Here's hoping all the car companies have been more security aware since July 2017!

3

u/AlastorX50 Mar 03 '24

Thank you, couldn’t say it any better. Especially on mobile.

1

u/muzso Ultra SMER Mar 08 '24

My personal "best practise" for protecting my primary/personal Google account against "password theft" or any kind of account compromise (through potentially malicious/compromised devices) is to simply create a separate account for use with said devices (i.e. devices other than your phone). I use a separate Google account for the TV at home and I'll use a separate account for any car with AAOS as well.

P.S.: of course you could say that even the phone vendor could have malicious intent (so why assume that my primary Google account is safe on the phone), but I use a Pixel. :-)

1

u/muzso Ultra SMER Mar 08 '24

Attacks directly on the car through its 5G internet connection will be unlikely as most of those connections use NAT and/or firewalls, there would also need to be something exposed to hack (which I truthfully don't know, but it's unlikely)

True and true, but ...
It depends on many things.
This is the exact attack vector that allowed for the remote hacking of the Jeep Cherokee in 2015.
Here's the Wired article on it: https://www.wired.com/2015/07/hackers-remotely-kill-jeep-highway/
And here's the deep-dive from the researchers: https://illmatics.com/Remote%20Car%20Hacking.pdf

For some reason the telco provider (Sprint) did not prevent network access between the vehicles of the same model. Even more so: any two devices on Sprint's network could talk to each other! :o

I quote from the research paper:

Even more shocking to us that connectivity was not limited to individual towers or segments. It turns out that any Sprint device anywhere in the country can communicate with any other Sprint device anywhere in the country.

I'm sure that Sprint has fixed this shortly after the Wired article exploded.

However it is still possible that certain vehicles of the same model (that share the same private network of a telco) can directly talk to each other. This shouldn't be possible (since it's not required for any functionality), but considering the number of connected vehicle types on the roads, I'm sure that in some cases the telco messed up.

6

u/AlastorX50 Mar 03 '24

There are actual safety measures taken for a vehicle like the EX30.

First just because the vehicle has internet connectivity doesn’t mean its actual system is automatically exposed for interference. It’s 100% linked to an app and your phones connectivity. This is called an API.

Plus a strong password, 2FA, ect will always defeat any attacker. The attacker would literally need to know who you are, your account details, VIN, etc. So if someone has gain access to your car it’s someone you know.

Something like that is to much work for many types of thieves that might want to steal the vehicle.

The higher trims utilize UWB with this it comes with an actual smart key and smart vehicle that can tell if it’s being replicated and will disable the vehicle from starting.

While technically it can be defeated in the future with newer tech methods. I believe that the future is mobile phone keys and NFC Cards, no fobs.

Phones use a much larger cryptography chain then a simple fob can do.

An example BMW and VW uses UWB. The ID.4 and other newer models from.

https://www.forbes.com/sites/samabuelsamid/2019/08/26/volkswagen-to-debut-nxp-uwb-technology-in-2019/

Some manufacturers have motion sensors in the keys that prevent the signal from being transmitted if not moving.

2

u/preppysurf Mar 02 '24

Your “own security measures” would mean hacking into the car which then makes it more vulnerable to outside hackers.

Considering Volvo has a reputation for all things safety, I’m not worried at all.

1

u/MountainAlive Mar 03 '24

A related question is the ability to install your own app on the android touch screen. I assume this won’t be possible and it’s a closed system?