In This Story
Gaming and driving are a dicey combination. Yes, there’s the obvious danger of combining barreling down the highway with Fortnite, but experts are also warning that the games pose another risk as a honeypot for hackers.
Experts note that when you factor in the Internet, cloud, and personal devices, automobiles are increasingly connected devices, like giant computers on wheels. And Google’s recent roll-out of games in cars raises concerns.
“And as with any connected system, the more functionality you add — such as gaming — the larger the attack surface becomes,” says Akash Mahajan, founder and CEO of cloud security firm Kloudle.
Mahajan says that the car’s gaming systems would have to be adequately segregated from critical driving functions such as steering, braking, or diagnostics that the attacker might exploit to access other parts of the system.
“And then there’s the concern about data privacy. Those gaming systems might harvest user data, connect to phones, or tap into cloud services. If data isn’t handled securely, it could be exposed or misused,” Mahajan says, adding that if consumers download games or log into accounts in the car, it creates more chances for phishing, credential theft, or malware.
Therein lies the problem. Despite assurances from Google (GOOGL-0.24%), experts aren’t sure how separate the systems are from the rest of the car.
Liudas Kanapienis, CEO and co-founder of consumer data and security company Ondato, says that games running on Android Auto are not guaranteed to be fully separated from the critical vehicle system.
“Hackers can attack the vulnerability of the gaming interface, thus allowing them to access the vital car controls, including braking, acceleration, or even steering in some models,” Kanapienis says.
Gaming apps also need internet connectivity, which makes remote attacks possible. “If an attacker compromises an in-car gaming system, they could potentially gain access to the personal data, track the location, or install malware,” Kanapienis says.
In fact, security researchers have already successfully hacked cars, accessing mission-critical functions through ancillary avenues like onboard entertainment systems.
Kanapienis warns that if past is prologue, gaming could open new attack vectors for hackers. For instance, he says, in 2015, security experts used the internet-connected entertainment system on a Jeep (STLA+0.86%) Cherokee and took over its steering, transmission, and brakes while it was in motion.
According to Kanapienis, in the same year, a vulnerability in BMW’s Connected Drive system was found, allowing researchers to imitate BMW servers and send remote unlocking instructions to vehicles.
Even Tesla (TSLA+5.31%), which, as Kanapienis points out, prides itself on its secure software, was exposed to threats when participants at the Pwn2Own hacking contest opened the trunk of a Tesla Model 3 while the car was in motion.
“These real incidents, where the car systems have already been successfully attacked through the entertainment and connectivity interfaces, verify certain aspects of the in-car gaming threats to security. If you don’t realize this system will become an issue, you should now,” Kanapienis says.
Do games belong in the car?
Earlier this year, Google began allowing Android games to be played on a vehicle’s touchscreen. While the games are only operable while the car is in park, that hasn’t stopped driving safety advocates from raising concerns.
“If the car is parked, there’s no immediate danger of the vehicle moving, but we still need to consider the human element here,” says Amanda Demanda, founding attorney at Amanda Demanda Law Group and a driving safety advocate. She adds that many drivers might find it hard to resist playing a game when stopped at a red light or in traffic.
“It’s tempting, and some might feel like it’s ‘safe’ to game while their car is idling. But here’s the issue: even when the car is stationary, video games are notoriously addicting, and a driver’s focus can still be completely diverted,” Demanda says, noting that this could lead to delayed reactions or poor decision-making once they start moving again.
Demanda says in-car gaming is feeding the younger generation’s voracious appetite for multitasking, which she says doesn’t belong in a car.
“Drivers are already distracted enough, and this new feature should heighten public safety concerns. It encourages risky behavior by making these games easy to access and difficult for drivers to resist,” Demanda says. “It’s giving the green light to normalize unsafe multitasking practices, with our youngest and least experienced drivers being the most vulnerable.”
Demanda says that if a driver gets into a car accident while using this system, it will most likely be seen as a legal liability, not just for the person behind the wheel but also for the manufacturer.
“If the design of this system fails to restrict use during driving or is too easy to misuse, carmakers may easily be drawn into liability for auto accident lawsuits,” Demanda says.