With many key fobs vulnerable to hacking unless they are, say, wrapped with aluminum foil, security experts say carmakers will soon require fingerprinting.
You heard correctly.
Fingerprints are required to cash checks at the bank.
Fingerprints are used to access mobile phones.
Cars are next. Not just to open the door, but to start the engine.
“This technology will be used in cars in two to four years,” said Godfrey Cheng, corporate vice president for Silicon Valley-based Synaptics. “Driver identification will be revolutionary.”
Understanding that car fobs present an increasing security risk, auto companies are following the lead of personal technology devices and moving toward vehicle access through fingerprinting, facial recognition and retina scans.
This is not Mission Impossible. This is real life.
The Free Press in July reported that cybersecurity experts recommend that car owners go online and spend a few dollars to buy what’s called a Faraday Cage to shield key fob signals from potential theft. Imagine a traditional sandwich bag made of foil instead of plastic.
This is because newer cars with keyless starting are always waiting for the fob signal. Thieves can buy legitimate devices that amplify or record and replay the fob signal sitting unprotected in a purse, a pocket, on a counter at home or even just copy the code to access the vehicle.
Copying code from key fobs isn’t difficult. And this is something the auto industry and insurance companies are monitoring closely.
The cheap (or homemade) metal protection covers, named for the scientist who figured out how to block an electromagnetic field, can prevent thieves from having access to vehicles with a wireless fob. Currently, thieves can capture fob signals from outside a home, office or hotel room.
In the near future, fobs won’t disappear; they’ll be paired with biometrics.
“You’re no longer relying just on a fob. This will be a fob and a fingerprint,” Cheng said between meetings in Detroit. “We’ll cover touch, sight, hearing and voice. We’ll cover all the senses but taste and smell.”
“We're making the car more secure. It’ll be a lot like online bank security. And if you can hack a bank or a car, wouldn’t it be more worth your time hacking a bank?" Cheng asked.
Rapidly evolving technology
Synaptics is best known as a leader in consumer technology products on items such as smart speakers that shoppers associate with Google and Amazon's Alexa.
Recently, the company developed technology that allows drivers to adjust the heat dial on touch screens in freezing temperatures without removing thick gloves. Clients using these and other features include Ford, Porsche, Jaguar, Range Rover, Audi, BMW, Honda, Volkswagen and Mercedes.
But where the industry is going — toward access that requires identifying body parts to circumvent concerns related to hacking — is unfolding rapidly.
Cheng was showing a prototype SUV to automakers and suppliers that had been modified to allow access with just a fingerprint. He snapped a photo of a would-be driver's face using a computer notebook, scanned the driver’s fingerprint into the notebook and downloaded the biometric data into the SUV system.
Synaptic prototype vehicle in Detroit testing fingerprint technology in September 2018. (Photo: Synaptic)
Then Cheng programmed the car to accept the fingerprint as a driver, just as a car dealer would upon sale. The driver pressed a fingerprint sensor on the dashboard and started the engine.
“Tesla transformed the way people looked at the car," he said. “People saw a future of cars that will be connected devices.”
Then he shut down the car to demonstrate something else. He reprogrammed the device to say that the driver who belonged to the fingerprint had skipped a car payment. Bam. Car wouldn’t start.
This sort of biometric program will allow vehicle owners to program the car to match the fingerprint — music choices, seat adjustment, navigation settings, temperature selection. This will allow parents to install “geofencing” limits, which control where teen drivers might go or how far.
“Let’s say we create the ‘teenager mode,'’’ Cheng explained. “You can restrict their access by time and you can customize the amount of horsepower the teenager has, like if they borrow a Hellcat. It’s irresponsible to lend your 707-horsepower car to a teenager. In the old days, you only had the choice of giving someone the key or not. Now you can geofence them and give them time-based access.”
So that means the car is a lot like Cinderella’s carriage that turns into a pumpkin at midnight.
“Car companies are bringing high-speed connection to the cars and biometrics are a necessary element of the connected car,” Cheng said. “Without secure biometric authentication, drivers would be distracted with passwords and pins. Fingerprint sensors offer state-of-the-art security as well as the convenience of touch.”
Biometric authentication could be in place with some products as soon as 2019, predicted Tamara Snow, director of interior systems and technology for North America within Continental.
“Vehicle access and start technology” is evolving rapidly, she said.
Convenience over privacy
While some people may be concerned about privacy, surveys indicate most consumers want convenience.
“There’s a personality that doesn’t want to give Big Brother everything; there's a discomfort about automobile companies having so much information about us,” said Holly L. Hubert, a retired FBI cybersecurity expert and founder of GlobalSecurityIQ. “This will take some getting used to. But it’s pretty exciting, thinking about how technologies can be leveraged. If you’re a parent of a teenage driver, these are great things.”
Auto companies are working cautiously but rapidly to adapt to a new security landscape.
“There was a survey earlier this year that said 25 percent of new customers buying cars are really concerned about cybersecurity,” said Faye Francy, executive director of the nonprofit Automotive Information Sharing and Analysis Center, which specializes in cybersecurity strategies.
“There’s a tension between security and convenience. The consumer really does love convenience. We recognize this is a key issue.”
In fact, her organization has more than doubled in the past year as automotive companies work to try and figure out the future and its technology.
“There are ways we can protect the critical function of the vehicle,” she said. “What we need to do is thwart the threat. Automakers are invested in getting the security literally built into the design.”
Engineers all over the planet are trying to understand what’s next.
And top cybersecurity advisers are working with the automotive industry, including Moshe Shlisel, CEO of GuardKnox Cyber Technologies.
“They need to compromise between innovation and what the public wants,” said Shlisel, a veteran of the Israeli Air Force who helped develop cyber protection for fighter jets and missile defense systems. “In some cases, price is the issue. The early birds may have the answer as soon as 2019. Companies want everything secure. This is where the industry is going.”
For now, industry leaders and cybersecurity experts say consumers must assume responsibility for their own safety.
“Be aware if you are in a rental car and upload your contact information, it will stay there unless you delete it when you turn in your rental car,” Francy said. "You might have sensitive information loaded as well. And if you sell your car? Have you deleted your data? I actually bought my new Lexus, well, a used Lexus, and I paired with my phone. When I selected the home destination, it took me to someone else’s home. Be careful with your data. We all have to be vigilant.”
Contact Phoebe Wall Howard: phoward@freepress.com or 313-222-6512. Follow her on Twitter @phoebesaid
