Just when you think you have the automotive industry figured out, another curveball comes your way.
The automotive industry continues to change and evolve at an alarming rate. In order to be successful in this industry, you have to roll with the changes. If you don’t update, you will evaporate.
Some of the changes in this industry present challenges that are very hard for technicians and shop owners to cope with. A lot of it boils down to the learning curve and the costs associated with it. Major changes can be an expense not only to the shop owner but also for the technician.
For the shop owner, it can be a monetary expense as the shop will have to spend money to update their equipment and their technician training standards.
For the technician, the extra time spent training along with spending money on equipment that the shop does not provide can be a burden on some.
No matter which end of the spectrum you find yourself on, when the manufacturers decide to make a change, the independent repair shops pay the ultimate price.
As most of you have heard by now, Fiat Chrysler Automobiles (FCA) (see Figure 1) has made changes to its proprietary software protocol. As part of a comprehensive approach to safeguard its vehicles from cyber-attacks, FCA has implemented a Secure Gateway (SGW) module in the electrical architecture, starting with most 2018 model year vehicles. This module functions as a secure firewall that protects external access to the vehicle via the radio and diagnostic connector from the rest of the vehicle network.
The SGW gates all data exchanged between the “outside world” (e.g., diagnostic tools, incoming signals to radio/head unit) and the “vehicle,” and it determines what commands to allow through the gateway based on an approved list. The SGW does not restrict access to diagnostic data. It restricts the ability of non-registered and non-authenticated users to perform intrusive diagnostics such as bi-directional controls.
The SGW can control the level of access for each user, based on an assigned role determined during an authentication process. A challenge-response protocol is used for authenticated access. A similar process is used for FCA U.S. franchised dealerships.
So if you’re wondering just how somebody could steal information or manipulate the vehicle to cause harm, believe it or not there are many ways to do so. In today’s world a cyber-attack can be devastating to the vehicle’s owner. For example, if a vehicle’s owner has their contact list on their cell phone and their phone is synched to their radio it would be very easy for a hacker to get in and steal some valuable information from the vehicle.
Here’s another example which is perhaps even more alarming. In 2015, preeminent hackers Charlie Miller and Chris Valasek dominated headlines with their landmark hack of a Jeep Cherokee. The duo, who now work at Uber’s Advanced Technologies Center, were able to hack into and remotely seize control of an unaltered vehicle and do everything from mess with the radio and windshield wipers to cut the transmission control.
From a basement couch 10 miles away and with Wired reporter Andy Greenberg behind the wheel, they exploited the car’s Uconnect system, an internet-connected computer feature that controlled the entertainment and navigation systems, enabled phone calls and, with a subscription purchase, offered a Wi-Fi hotspot.
From the audio/visual system, they accessed the car’s diagnostic messaging system to gain control, ultimately incapacitating the driver and steering the Jeep off the road.
This is the reason that FCA implemented the SGW in order to combat this type of automotive terrorism.
In the beginning, for the automotive aftermarket to be able to service these vehicles properly they didn’t have access to the gateway that protects access to the information systems. This presented a problem as only the dealership market had access.
Luckily for the aftermarket, the OEM granted access to the systems but only by strict cyber authentication. The FCA has set up a “bridge server” and user management system called AutoAuth that mimic’s the user and tool authentication process that FCA certified dealerships use with the FCA scan tool. This solution allows the aftermarket scan tools to unlock the SGW and perform all the necessary repair procedures.
One of the most common questions is, “Does the SGW placed on FCA vehicles prevent independent repair facilities from servicing FCA vehicles?”
The answer is a resounding, “No.” FCA U.S. continues to make available to independent repair facilities all diagnostic and service information. The SGW was placed on most 2018 model year and later FCA vehicles as a cyber security measure, as part of FCA’s commitment to continually review and address potential cyber security vulnerabilities. The concept and design of the SGW reflects an effort to proactively adopt available guidance and best practices for security controls, including guidance published by the National Highway Traffic and Safety Administration (NHTSA) and the National Institute of Standards and Technology (NIST).
The SGW is not intended to prevent aftermarket tool companies and/or aftermarket repair centers from servicing FCA vehicles. FCA supports aftermarket repair facilities and believes that the customer should be able to choose where to have their vehicle serviced. That’s good news for the automotive aftermarket sector.
So what is AutoAuth exactly? Auto Authentication Authority is an independently owned and operated service working in conjunction with Auto OEMs and independent tool venders which provides a service for independent operators to unlock vehicles to securely provide service to their customers. New vehicles will come enabled with the latest cyber security features to protect vehicle owners from cyber attack. AutoAuth works with independent tool vendors to ensure that the tools independent operators use to do their jobs are AutoAuth-certified tools. This will allow independent operators to continue to service cyber-enabled vehicles.
AutoAuth provides the registration service and “unlock codes” to independent operators’ service tools to unlock vehicle gateways to perform day-to-day service.
What did the FCA do to facilitate this? The FCA has reached out to all the aftermarket scan tool companies that currently have an active scan tool license agreement with FCA in order to provide them with this capability. FCA is having ongoing conversations with several scan tool companies and is working to help them provide their solution in the shortest possible time. The aftermarket scan tool companies will have the same access to the SGW as the OEMs.
As most of you have noticed, FCA is always changing the way the game is played. When setting up your aftermarket scan tool to be able to access the SGW, you should visit the website of AutoAuth.
AutoAuth is an independently owned and operated service working in conjunction with auto OEMs and independent tool vendors. What exactly does AutoAuth do for the independent repair shops? Well, they provide a service for independent operators to unlock vehicles to securely provide service to their customers. New vehicles will come enabled with the latest cyber security features to protect vehicle owners from cyberattack.
AutoAuth works with independent tool vendors to ensure the tools independent operators use to do their jobs are AutoAuth-certified tools. This will allow independent operators to continue to service cyber-enabled vehicles. AutoAuth provides the registration service and “unlock codes” to independent operator’s service tools to unlock vehicle gateways to perform day-to-day service.
Each tool has to be supported by the independent tool manufacturer and registered on AutoAuth based on the tool’s serial number. That tool can only be registered one time and by one shop. If that tool is used by more than one shop it stays by the shop it’s registered to.
Go to www.autoauth.com and search in the list that they have provided to see if your particular scan tool is supported. That is based on whether or not your scan tool manufacturer is participating in this feature.
If for some reason the tool that you have is not supported, then I would recommend that you contact the manufacturer of that tool and ask them for assistance. My recommendation is if you are thinking about purchasing a new tool, I would find out first to see if it is supported on the SGW protocol before purchasing the tool.
You will probably start to see that many aftermarket scan tools will start implementing this feature in their scan tools as well. Some tools have done so already. Topology mapping makes it visually easier to see all the modules on one page and their current status on the network.
As I mentioned earlier, technology is changing at a rapid pace. Along with those changes comes the increase of what I call cyber terrorism. While computer systems seem to make our lives and the way of doing business more proficient, it also gives those who wish to do us harm an easier avenue to do so. The only way to protect yourself is to be vigilant and aware of the potential harm that can happen in the most unexplainable ways.
As an auto repair shop owner or technician you have been trained to keep your customers safe in their vehicles. Protecting your customers safety by inspecting the brake system on their vehicle isn’t any different than protecting them from a potential cyber attack. Don’t just protect your customer’s vehicle by the things you can see but you also need to protect them by the things you can’t see.
That is why you need to keep current on your training and your equipment needs.
Unfortunately, today the world is not as safe as it used to be. Hacking into a vehicle to alter the brake system or steering control system can be a very serious thing. The lives of your customers and those that are on the road with them could be put at serious risk.
Between altering the vehicle’s guidance systems or accessing the vehicle owner’s personal information from the radio or cell phone can have catastrophic consequences. So do yourself and your customers a favor and service their vehicles as if it was your own. Keeping your customers safe will give you not only peace of mind but the satisfaction of servicing their vehicles the right way.