Tesla Model S and Model 3, electric cars built for speed and safety, are vulnerable to cyberattacks aimed at their navigation systems, according to recent research from Regulus Cyber. During a test drive using Tesla’s Navigate on Autopilot feature, a staged attack caused the car to suddenly slow down and unexpectedly veer off the main road.

Regulus Cyber, reportedly the first company to deal with smart-sensor security across a wide range of applications including automotive, mobile, and critical infrastructure, initially discovered the Tesla vulnerability during its ongoing study of the threat that easily accessible spoofing technology poses to GNSS receivers.

The Regulus Cyber researchers found that spoofing attacks on the Tesla GNSS (GPS) receiver could easily be carried out wirelessly and remotely, exploiting security vulnerabilities in mission-critical telematics, sensor fusion, and navigation capabilities.

Regulus Cyber experts traveled to Europe earlier this month to test-drive the Tesla Model 3 using Navigate on Autopilot. An active guidance feature for its Enhanced Autopilot platform, it’s meant to make following the route to a destination easier, which includes suggesting and making lane changes and taking interchange exits, all with driver supervision. While it initially required drivers to confirm lane changes using the turn signals before the car moved into an adjacent lane, current versions of Navigate on Autopilot allow drivers to waive the confirmation requirement if they choose, meaning the car can activate the turn signal and start turning on its own. Tesla emphasizes that “in both of these scenarios until truly driverless cars are validated and approved by regulators, drivers are responsible for and must remain ready to take manual control of their car at all times.”

Designed to reveal how the semi-autonomous Model S and Model 3 would react to a spoofing attack, the Regulus Cyber test began with the car driving normally and the autopilot navigation feature activated, maintaining a constant speed and position in the middle of the lane. Although the car was three miles away from the planned exit when the spoofing attack began, the car reacted as if the exit was just 500 feet away—abruptly slowing down, activating the right turn signal, and making a sharp turn off the main road. The driver immediately took manual control but couldn’t stop the car from leaving the road.

The testing revealed another unexpected finding that significantly amplified the threat—a link between the car’s navigation and air suspension systems. This resulted in the height of the car changing unexpectedly while moving because the suspension system “thought” it was driving through various locations during the test, either on smooth roadways, when the car was lowered for greater aerodynamics, or “off-road” streets, which would activate the car elevating its undercarriage to avoid any obstacles on the road.

Yoav Zangvil, Regulus Cyber CTO and co-founder, explains that GNSS spoofing is a growing threat to ADAS and autonomous vehicles. “Until now, awareness of cybersecurity issues with GNSS and sensors has been limited in the automotive industry. But as dependency on GNSS is on the rise, there’s a real need to bridge the gap between its tremendous inherent benefits and its potential hazards. It’s crucial today for the automotive industry to adopt a proactive approach towards cybersecurity.”

The Regulus Cyber testing is designed to assess the impact of spoofing with low-cost, open source hardware and software, the same kind of technology that is accessible to anyone via e-commerce websites and open source projects on GitHub. Taking control of Tesla’s GPS with off-the-shelf tools took less than one minute. The researchers were able to remotely affect various aspects of the driving experience, including navigation, mapping, power calculations, and the suspension system. Under attack, the GNSS system displayed incorrect positions on the maps, making it impossible to plot an accurate route to the destination.

Prior to the Model 3 road test, Regulus Cyber provided its Model S research results to the Tesla Vulnerability Reporting Team, which responded with the following points at that time:

Any product or service that uses the public GPS broadcast system can be affected by GPS spoofing, which is why this kind of attack is considered a federal crime. Even though this research doesn’t demonstrate any Tesla-specific vulnerabilities, that hasn’t stopped us from taking steps to introduce safeguards in the future which we believe will make our products more secure against these kinds of attacks.

The effect of GPS spoofing on Tesla cars is minimal and does not pose a safety risk, given that it would at most slightly raise or lower the vehicle’s air suspension system, which is not unsafe to do during regular driving or potentially route a driver to an incorrect location during manual driving.

While these researchers did not test the effects of GPS spoofing when Autopilot or Navigate on Autopilot was in use, we know that drivers using those features must still be responsible for the car at all times and can easily override Autopilot and Navigate on Autopilot at any time by using the steering wheel or brakes, and should always be prepared to do so.

“This is a distressing answer by a car manufacturer that is the self-proclaimed leader in the autonomous vehicle race,” Zangvil commented in the company’s statement. “As drivers and safety/security experts, we’re not comforted by vague hints towards future safeguards and statements that dismiss the threats of GPS attacks.” He offers the following counterpoints in response:

• Attacks against any GPS system are indeed considered a crime because their effects are dangerous, as we’ve shown, yet the same devices we used to simulate the attacks are legally accessible to any person, online via e-commerce sites
• Taking steps to “introduce safeguards for the future” indicates that spoofing is, in fact, a major issue for Tesla, which relies heavily on GNSS
• In the case of cars, a spoofing attack is confusing in the best case, and a threat to safety in more severe scenarios
• The more GPS data is leveraged in automated driver assistance systems, the stronger and more unpredictable the effects of spoofing becomes
• The fact that spoofing causes unforeseen results like unintentional acceleration and deceleration, as we’ve shown, clearly demonstrates that GNSS spoofing raises a safety issue that must be addressed
• In addition, the spoofing attack made the car engage in a physical maneuver off the road, providing a dire glimpse into the troubled future of autonomous cars that would have to rely on unsecure GNSS for navigation and decision-making
• Given that the trust of the public still has to be earned as the automotive industry moves towards autonomy, the leading players are accountable for a responsible deployment of new technology
• As Tesla clearly stated, drivers are responsible for overriding autopilot under a spoofing attack, so it appears its auto pilot system can’t be trusted to function safely under a spoofing attack.

• Because every GNSS/GPS broadcast system can be affected by GNSS/GPS spoofing, the issue is everyone’s problem and shouldn’t be ignored; furthermore, governments and regulators that have a mandate to protect the public’s safety must engage in proactive measures to ensure only safe GNSS receivers are used in cars

“According to Tesla, they’ll soon be releasing completely autonomous cars utilizing GNSS, which means that, in theory, an attacker could remotely control the car’s route planning and navigation,” Zangvil says. “We’re obligated to ask what steps they’re taking to address this threat, and whether new safeguards will be implemented in its next generation of entirely autonomous cars.”

Although Regulus Cyber researchers tested only the Model S and Model 3, they concluded that the “disturbing vulnerability” of Tesla’s GNSS system is most likely company-wide, as the same chipsets are used across the Tesla fleet.

“Just a few months ago we saw that during a spoofing incident in a car show in Geneva, seven different car manufacturers complained that their cars were being spoofed. This incident proves that many other automotive companies that are working on the next generation of autonomous cars are also vulnerable to these attacks. As an industry, to win public trust and succeed, every car manufacturer should be proactive and prepare against these threats,” Zangvil says.

The post Tesla Model S and Model 3 Prove Vulnerable to GPS Spoofing Attacks, Research from Regulus Cyber Shows appeared first on Inside GNSS - Global Navigation Satellite Systems Engineering, Policy, and Design.

The car maker states in its patent’s background that while GPS signals from space-based satellites are invaluable, factors such as satellite geometry, signal blockage, ionospheric perturbation, and atmospheric conditions, among others, can affect the accuracy of GPS receivers. Because of this there is a need to develop a system that can greatly improve location accuracy, mainly as it would be utilized extensively by full self-driving vehicles.

The patent, titled “Technologies for vehicle positioning,” describes a software that allows vehicles to send signals and positioning data to each other. This solution allows the cars to function much like Earth-based GPS satellites, feeding positioning information to other vehicles on the road. Tesla notes in its patent that the software is flexible, being capable of operating via at least one network protocol, such as Ethernet, a Transmission Control Protocol (TCP)/lnternet Protocol (IP), or others.

This latest patent application from Tesla was filed in 2017 and made public last December. In the application, the car maker describes a problem with the accuracy of GPS positioning:

“For example, a smartphone with a positioning receiver may be able to determine its position to within five meters of the smartphone. The accuracy of the position determination may worsen when the receiver is in proximity of buildings, bridges, trees, or other structures. Although this may be sufficient for some positioning applications, greater accuracy is desirable for other applications, including autonomous driving. Accordingly, there is a desire to provide greater positioning accuracy despite the factors that affect the signals from the navigation satellites.”

The document offers a variety of solutions that involve cameras detecting matching locations and using other vehicles in its fleet as a “cooperative reference station” to share raw GNSS data and make positioning corrections.

Without necessarily sharing data between vehicles, Tesla also found a way to correct GPS data using other sensors, the company stated. By matching camera data with vision maps, you can detect the exact location of a vehicle, and these types of solutions would enable Tesla vehicles to have more accurate positioning data even where the GPS signal is not as strong as they would like.

This more accurate positioning system would be especially useful for autonomous driving applications and Tesla clearly intended it to be used by its Autopilot system since all the inventors listed on the patent applications were part of the Autopilot team at the time.

The post Tesla Granted Full Self-Driving Patent that Uses Cars as Earth-Based GPS Satellites appeared first on Inside GNSS - Global Navigation Satellite Systems Engineering, Policy, and Design.

While Musk’s other company, Tesla, is at the forefront of autonomous vehicle development, chances are the orbited car didn’t have LiDAR, or Light Detection and Ranging, sensors onboard.

Despite new capabilities, LiDAR continues to be a high-ticket item for companies and agencies testing autonomous vehicles.  Velodyne’s venerable HDL-64, for instance, cost $80,000 per unit, according to published sources.

The cost and accuracy issues surrounding LiDAR may be one of the reasons such companies as Tesla aren’t using it.  Some industry experts say that testers can achieve similar results by using cameras and inertial measurement units.

Musk, among others in the self-driving car space, has been a vocal critic of LiDAR. Musk, via Twitter, said LiDAR "is a crutch that will drive companies to a local maximum that will be hard to get out of…if you take the hard path…you achieve the global maximum. Perhaps I am wrong, in which case I will look like a fool, but I am quite certain I am not."

The high cost of LiDAR has forced such companies as Velodyne to decrease unit prices in recent products. Other companies, like startup Innovusion, plan to roll out LiDAR units that will only cost a few hundred dollars in quantity.

The company, which likens its technology to the transition from text to graphical devices in the computer and smart industries, is targeting Level 4 and 5 of the autonomous vehicle and Advanced Driver Assistance Systems (ADAS) markets, said Junwei Bao, Innovusion CEO.

"Our engineers are naturally drawn to the toughest technical challenges and believe this is where we can have the most business and social [advanced driver assistance systems]. Image quality, high-definition LiDAR will also be useful in many other applications and adjacent markets," he said. "Our products have great range, are cost effective and are available in very compact sizes a little bigger than an iPhone."

Although autonomous vehicles are the company’s primary focus, Bao said that the product can be tailored for such applications as drones, geographic mapping, environmental resource management, logistics, security and defense. "I am sure our customers will surprise us by coming up with even more ways of using the technology and we look forward to watching the industry evolve," he said.

Before starting Innovusion in 2016 with partner Yimin Li, Bao led the sensor and hardware team at Baidu’s Autonomous Business Unit. The company said its engineering team has an average of 15 years’ experience in the LiDAR industry.

"My original team is comprised of veterans in the precision instrument industry, key members from Velodyne, and some of my former colleagues in Baidu’s Autonomous Driving Business Unit. In addition, a few of my college classmates have joined," he said. "We studied physics together during our undergraduate years-then spread out to different research areas post-graduation. Twenty years later, we have reunited to work together on this technology, each of us contributing in different areas [in] optics, software, firmware and algorithms."

Field of LiDAR Companies Growing…
While cameras and other sensors are growing in importance, LiDAR is the recent champion of investors.
At least 50 LiDAR startups have gained $678.4 million in the last four years, according to CB Insights in a Los Angeles Times a recent article. More than half of the venture capital funds went to 18 companies in just 2017 alone, the article said.
With that much competition in the effort to get LiDAR down to $1,000 in quantity, Innovusion is trying to compare and differentiate itself.
"The primary difference between Innnovusion and Velodyne is that we have image quality, high-definition LiDAR," Bao said. "Our resolution is over 300 lines. Most competitors in this field are less than100 lines. Mobileye uses camera data to derive 3D information, while our LiDAR provides reliable true 3D data through accurate measurement of time of flight of light."

SpaceX Falcon Heavy May Revolutionize Launch Industry…
Ultimately, the recent SpaceX Falcon Heavy launch wasn’t about autonomous vehicles. It marked the first time a commercial company has ever sent up such a massive payload.  

The successful launch not only put into low Earth orbit the largest payload, it did it at a price that could revolutionize the space industry, according to published reports.

The launch raises questions on how competitors United Launch Alliance and Arianespace will react. ULA, a joint venture between Boeing and Lockheed Martin, champions its Delta IV Heavy, which costs more than $400 million per launch. Musk contends that his Falcon Heavy costs $150 million per launch, according to published reports.  

The Falcon Heavy is composed of three Falcon 9 boosters. The side boosters used in the February 6 launch were previously flown and recovered. According to published reports, several minutes after liftoff, they split off from the core and made their way back down to Cape Canaveral. Musk stated these boosters won’t be flown again.

The post Tesla Car Launched into Space…Without LiDAR appeared first on Inside GNSS - Global Navigation Satellite Systems Engineering, Policy, and Design.