50% of Automotive Manufacturers Are Susceptible to a Ransomware Attack

The automotive industry has started to ramp up its digitalization in their manufacturing sites but cybersecurity is still an afterthought for most organizations. For cyber criminals who are adopting ransomware attack methods, this is music to their ears.  

According to a recent ransomware trends report, close to 50% of the 100 largest automotive manufacturers are highly affected by ransomware attacks. Additionally, more than 17% of automotive suppliers most likely will incur a ransomware attack.

One headline-grabbing example of a successful ransomware attack that hit automakers hard was the 2017 WannaCry outbreak. This attack affected over 200,000 computers in over 150 countries. This included France’s Renault where many of their industrial systems were exploited and were forced to temporarily idle some of their plants in Europe. Renault manufacturing plants in France, Slovenia and Romania were so affected, that all their industrial activity was shut down and remained offline for days. 

A more recent example of automotive manufacturing companies being attacked is when massive vehicle manufacturers Volkswagen and Audi fell victim to the “Conti” ransomware group. Over 3.3 million customers and interested buyers in the United States and Canada were affected by this attack. The attacker was able to obtain access to their networks by scraping an unsecured Microsoft Azure server. Data stolen includes email addresses, vehicle identification numbers, phone numbers, and physical addresses.

The threat landscape of automotive manufactures will only continue to grow and the need for improved cybersecurity will become more obvious as more automotive companies will fall victim to cyber criminal attacks. 

The Keys Are in The Cyber Criminals' Glove Compartment 

No industry is safe from the threat of cyberattacks such as ransomware and this is especially true with the automotive industry. Due to implementing legacy systems and their physical cybersecurity approach, the industry as a whole needs to rethink its security strategy. 

Until recently, the majority of automotive manufacturers believed the security of their manufacturing plants and enterprise IT systems were less of a priority. This meant that the typical automotive organization would keep any security attack or event out of the public eyes which resulted in their security teams ignoring the real risks at hand. 

As the technology of automotive manufacturers is advancing, security is becoming more prominent not just inside the cars, but also in the manufacturing phase. According to an industrial threat research report by IBM, “automotive manufacturers were the top targeted manufacturing sub-industry in 2021, accounting for almost 1/3 of the total attacks against the manufacturing industry.”

As a result of the increasing number of attacks on the automotive manufacturing industry, organizations and their management teams are now taking security more seriously by getting a better understanding of their organization's security strategy and how they can strengthen their security posture against attacks. While this is a good first step for organizations to understand where they are vulnerable, automotive manufacturers need to understand why cyber criminals see them as attractive targets.

Why Automotive Manufacturers Are Constantly Being Attacked 

As the automotive manufacturing industry has started to embrace more Industrial Internet of Things (IIoT) it has created an endless amount of security challenges. The most glaring security risk for automotive manufacturing systems is modernizing their technology to be more interconnected to the Internet which has resulted in their OT environments being under attack. This has impacted automotive manufacturing plants as process control devices and intelligent assembly manufacturing lines with PLCs are becoming less secure by the day. These threats are challenging the industry from a security and organizational perspective.  

Additionally, cyber espionage is a large threat to the manufacturing of vehicle development, production and delivery due to the automotive industry being extremely competitive. Not just between manufacturers but actually between countries as there is a massive drive for new automotive technologies and innovation. Similar to other industries, North Korean and Russian threat actors have been linked to targeting the automotive industry. The state-sponsored attackers' key initiative is to exploit the system of automotive manufacturers and steal information that pertains to innovative research, developments, intellectual property information and in some cases to even slow down their production lines.  

Another reason why state-sponsored attackers may target the automotive industry is to steal information on new technologies that are being developed for governments and the military. By targeting automotive constructors it can provide cyber criminals large amounts of information which can include, artificial intelligence, sensor detail, autonomous vehicle systems and discrete deployment information. 

One of the more recent and popular methods that cyber criminals are implementing is attacking automotive manufacturer’s supply chains via third-party vendors. These external parties can be seen as low-hanging fruit for cyber criminals as they are potentially easy entry points to compromise additional systems up the supply chain in order to gain access to the targets’ primary networks. If a third party is exploited, an automotive manufacturer would be presented with even more risks. 

What Automotive Organization Can Do To Prevent Attacks 

Automotive manufacturers need to distribute their time and resources to gain a better understanding of how vulnerable their systems are and what they can do to secure their organization's data and systems. To understand how to protect the organization’s systems, the first step is to understand the different security challenges and risks that relate to automotive manufacturer systems and equipment and which strategy is needed for better security.  

With the amount of successful state-sponsored attacks over the past few years, different industrial verticals including automotive manufacturing, now understand the urgency of adopting the correct security practices when it comes to securing OT environments. As more automotive organizations continue to modernize their OT equipment and connect their industrial networks to the Internet, it will open a door for cyber criminals to attack and move laterally within the OT networks. 

Only until recently did the typical automotive manufacturer use stand-alone systems and equipment. However as technology has advanced, more organizations are connecting their legacy systems to the Internet to provide access to third-party vendors to work with their OT equipment. This new method of work has forced security teams of automotive manufacturing companies to change their mindset and approach to secure their OT networks and equipment.  

While the industry is taking time to adapt to this new security approach, it is great to see the ongoing increase in awareness that is shaping the industry to become more secure. Some organizations, like Coşkunöz Holding have taken a more proactive approach when securing their OT assets with a passive network monitoring solution that is designed for OT environments. Coşkunöz Holding now has complete visibility into their OT networks, up-to-date inventory of all their production assets, including detailed critical asset visibility and vulnerability management capabilities. 

To avoid becoming victims to the next widespread ransomware attack, the automotive industry needs to implement a more proactive security approach that is based on detection and mitigating risks within their production environment. By implementing the right OT security approach with awareness and technology, the automotive manufacturing industry can benefit significantly from it, ensuring their servers and systems are secure from incoming cyber attacks.

To learn more about smart organizations like Coşkunöz Holding expanding their OT visibility into their automotive manufacturing plants, check out their OT Security case study here: https://www.scadafence.com/resource/global-automotive-aerospace-manufacturer-expands-ot-visibility-and-cybersecurity/