BlackBerry CTO Charles Eagan answers our car software questions

It may be hard to remember now, but just over a decade ago, BlackBerry was synonymous with smartphones. These days, the company has abandoned its identity as a cellphone maker, but new innovations in its IoT sector, especially pertaining to car software, have BlackBerry mounting an impressive tech industry comeback.

IT Brew spoke with BlackBerry CTO Charles Eagan at CES ’23 in January to talk about car software cybersecurity.

This conversation has been edited for length and clarity.

Car safety and security is something a lot of people have been talking about at CES. Where do you see the industry moving in that regard?

Safety and security are really becoming the same word. As kinetic things start to become cyberattack-able, safety and security are [intertwined].

Now, cars are safe. There’s a lot of knowledge in terms of functional safety that has been designed into cars. There are type approvals and heavy reviews that go into software, and a big part of security in automobiles is partitioning. We have a hypervisor that allows you to partition the bad software that’s untested or could be maliciously compromised with the control system.

Cars have a great architecture—the volume of the software update is kind of where the rubber hits the road, so to speak. We have to make sure that we’re not accidentally opening up compromises as we [are vastly] changing the software on the vehicle. So, we know a whole bunch of good practices on how to partition, do lease privileges, zero-trust, you know, a lot of cybersecurity wisdom needs to be applied to that car…

Something like our BlackBerry IVY, it gives you a way to add functionality in a way that doesn’t disrupt the architecture. It’s built to be extensible. You can download new features and not worry about secondary effects.

Can you talk about the dangers of your car being hacked, and how malicious code can get into the system?

I’ve heard of automobiles where the braking system failed because the debug mode had been left on, and it changed the timing of the control systems. That’s what happens when you change software that could have an impact on other software. Having a framework that allows you to have well-contained software updates…you need to partition it so that new software doesn’t disrupt the old control system software. That’s done by partitioning and having an architecture like IVY, that allows you to add new functionality in a controlled way.

We think that the most vulnerable point will be where the most software is running, and the most software changes [are] happening. So, that’s the infotainment system. We’re basically instrumenting that—looking at memory, network, file systems and monitoring that to say something anomalous has been going on.

Can you expand on how the code gets into the system in the first place?

What [could happen] is someone downloads an APK [Android Package Kit]. And that APK has malicious code in it, that could do something simple, like assign itself access to the microphone or the speaker and then leave that resident in the system. Then later, in a traffic situation, it could blast noise into the infotainment system to cause distraction—a lot of driving accidents are caused by driver distraction.

Basically, malicious code gets planted in an unintended manner through a malicious APK. It could be a software update or something [else] that gets the code on there. It plants itself in the infrastructure, and then it rears its malicious behavior. You know, a lot of times, malware will be deployed and installed, but not sort of detonated until the opportune time.

I know that you guys are doing what you can to avoid the possibility of the dangerous operational hacks. But is that an inevitability? Or is that just a possibility?

I think it’s unlikely. Cars weren’t safe, now they are safe. Every time we build a new infrastructure, we learn from the past.

So, the software-defined vehicle will be more secure than the mobile phone, which is more secure than the computer. We’re going to learn as we go; we’re not going to go from zero to fully autonomous…We need to apply our best [cyber] practices to reduce unnecessary attacks, because we will be attacked. So, we have to have a remediation plan…Most cyberattacks today wouldn’t be successful if everyone used the general wisdom. The cyberattackers look for the edges.—EH

Do you work in IT or have information about your IT department you want to share? Email [email protected].