Cyberattacks on connected cars could gridlock entire cities

Thanks a whole bunch, Internet of Things (IoT): you’ve already brought us autonomous vehicles and other connected cars that can be turned into steel/glass/combustible whirling dervishes, as in, Jeep Cherokees that can be paralyzed by remote attackers 10 miles away and whose steering wheels could be spun 90 degrees while the car was zooming down the highway at 60 mph.

Crazy Tilt-a-Whirls that they were, those were one-off, proof-of-concept attacks on individual cars, pulled off by renowned automobile/security researchers Charlie Miller and Chris Valasek.

But what about if hackers pulled a coordinated, distributed attack? As in, a denial-of-service (DoS) attack where multiple cars were strategically zombified, such that they gummed up a crucial intersection?

From a writeup of their research that was published in Science Daily on Monday:

In the year 2026, at rush hour, your self-driving car abruptly shuts down right where it blocks traffic. You climb out to see gridlock down every street in view, then a news alert on your watch tells you that hackers have paralyzed all Manhattan traffic by randomly stranding internet-connected cars.

According to the researchers’ simulations, all it would take to freeze traffic solid in a city like Manhattan is to strand 20% of all cars. Here’s David Yanni, a graduate research assistant working in the lab of Peter Yunker, co-leader of the study and assistant professor in Georgia Tech’s School of Physics:

Randomly stalling 20% of cars during rush hour would mean total traffic freeze. At 20 percent, the city has been broken up into small islands, where you may be able to inch around a few blocks, but no one would be able to move across town.

Those numbers are conservative, given that not all cars on the road need to be connected. If 40% of all cars on a city’s road were connected, attackers would just have to hack half of them to get a city gridlocked.

The researchers’ paper, titled Cyberphysical risks of hacked internet-connected vehicles, was published in Physical Review E yesterday.