What was the vision behind the foundation of Upstream Security and what is its mission?
Having worked in cybersecurity for many years, when my partner and I decided to found our own company, the IoT space immediately attracted our attention, especially due to the rapidly growing connected vehicles segment. Modern vehicles are such complex machines that cybersecurity and safety can work as interchangeable terms in their case. Securing a vehicle is not only important for the image of the automotive industry but also for the peace of mind of the consumer. As we found a great deal of value in this space, we decided to create Upstream Security to bring our contribution to vehicle security worldwide. Currently, we are a leader in cybersecurity for connected vehicles with more than 12 OEMs benefiting from our services in the production of multi millions of vehicles. We have been the first player in the industry to build a cloud-based security solution, and we are also operating two VSOC (vehicle security operation center) units, in Tel Aviv and in Michigan. These centers act as command-and-control rooms that monitor millions of vehicles on the road so that we can investigate and mitigate threats.
What are the potential dangers of somebody hacking into a car system?
For five years we have been putting together hundred-page reports that aim to find the answer to why and how people are hacking vehicle. The analysis has shown that in addition to the constant quest to gain remote control over vehicles, they are interested in stealing data (like GPS routes, billing and other personal information) via ransomware attacks, and, of course, the vehicles themselves, without breaking windows or hot wiring it. The black market abounds in many different modules that can be connected to the vehicle, for example via Bluetooth and even headlight of the car, to transmit data on the CAN-BUS network, thus unlocking the doors and faking the presence of the key. Last but not least, we have also identified activities that relate to fraud against warranty terms. Customers are rolling back their vehicle's odometer to get it fixed by dealerships at the expense of OEMs. This half a century old technique has just become easier thanks to new cybersecurity techniques.
How does Upstream Security operate in order to solve or limit these security issues?
Six years ago, when we started the company, most companies were trying to build firewalls inside the vehicles, but we opted to go with a cloud security solution instead.
Considering that now vehicles are connected devices that are part of a larger ecosystem of charging stations, APIs, mobile apps and even smart homes, we must secure this entire chain, not only the vehicle itself.
Our solution analyzes different types of data feeds and detects threats and anomalies that are mitigated in an automated, almost real-time, manner. We employ an XDR approach which is similar to the enterprise space but purpose built for the automotive industry, and once we deploy our technology, we are able to start monitoring and detecting threats in vehicles that are already driving on the road.
Is there a particular challenge in keeping cars safe as they become increasingly software defined?
Software-defined vehicles allow us to configure many elements remotely, with APIs being open for third parties, which can be a double-edged sword that leads to possible cybersecurity threats. Phone apps related to fleet management, OEMs charging features as a service or battery overview have proven to become a vulnerability. If a hacker knows the VIN number, he/she can unlock the doors and start the engines of an entire fleet. Hacking vehicles is much easier today than it was five years ago when you needed to connect a computer to the car or know all the CAN-BUS networks. Risks are also growing in the smart mobilityspace -- in this sense, a particularly famous case took place in Moscow, where all the Yandex cars were summoned to the same location to create a massive traffic jam. This attack was enabled by hacking the backend of the application and manipulating API transactions. Moreover, we are starting to see an increasing number of cybersecurity attacks on EV charging stations, not only targeting the vehicle itself but the entire electric grid, and, as a result, creating a potential critical safety issue. All these new menaces can only be overcome if, besides the vehicles, we are also protecting the servers and the applications related to them.
What are the main objectives that you would like to achieve at Upstream Security in the next couple of years?
Our plan is to continue to lead the cybersecurity space for the automotive and smart mobility segment, become the best player in the industry and manage to secure every vehicle on the planet. Especially as vehicles become more connected and more autonomous, cybersecurity will become a central pillar of this new auto market that we are now creating.
