Flooring the accelerator pedal of a secure vehicle may still be a thing of the future. According to a recent study by Ponemon, nearly 30 percent of companies in the automotive segment do not have a proper cybersecurity team to handle its technology and security infrastructure, let alone secure smart cars. The state is so dire that many do not even engage a third party vendor to secure the software in the connected cars.

“As more connected vehicles hit the roads, software vulnerabilities are becoming accessible to malicious hackers using cellular networks, Wi-Fi, and physical connections to exploit them,” data protection research group the Ponemon Institute said in the report. “Failure to address these risks might be a costly mistake, including the impact they may have on consumer confidence, personal privacy, and brand reputation.”

The study also pointed out that nearly 63 percent of all vehicle manufacturers do not even test half of their software, hardware and other technology deployed in their vehicles. The study sampled 15,900 IT security practitioners and engineers in the automotive industry.

“Unauthorized remote access to the vehicle network and the potential for attackers to pivot to safety-critical systems puts at risk not just drivers’ personal information but their physical safety as well,” the study found.

As further detailed in the study, “Seventy-three percent of respondents surveyed in our report say they are very concerned about the cybersecurity posture of automotive technologies supplied by third parties. However, only 44 percent of respondents say their organizations impose cybersecurity requirements for products provided by upstream suppliers.”

Vehicle hacking isn’t just a theory. In 2016, Nissan had to shut its proprietary app NissanConnected EV for its Leaf line-up after it was found that hackers could access the cars’ climate control and other battery operated features to drain the batteries. Also, in 2015, automaker Fiat Chrysler had to issue a recall for almost 1.4 million vehicles after researchers Charlie Miller and Chris Valasek of Wired demonstrated a wireless hack on Jeep Grand Cherokee, taking over the controls of the dashboard, steering wheel, powertrain, and even the brakes.

Recently, WikiLeaks released documents blowing a whistle on the CIA suggesting journalist Michael Hastings’s fatal car crash triggered by a car hack. In 2013, Hastings died after the car he was driving abruptly sped up and crashed into a tree. Media has, however, considered this to be a conspiracy theory, but has given into the potential havoc a hacked car can wreak.

This may seem like a scene straight out of a heist movie, but a Chinese programmer did something as spectacular. Qin Qisheng, a former manager in Huaxia Bank’s technology development centre, stole $1 million in free cash by exploiting a loophole in the bank’s core operating system. In the Huaxia Bank, the withdrawals made in midnight were not recorded. After discovering the flaw way back in 2016, he inserted a few scripts into the system where he could make transactions without triggering an alert.

For nearly a year, made transactions of between 5000 and 20,000 yuan, until by 2018 where he amassed nearly seven million yuan without the knowledge of anyone. Most of the money stayed in the dummy account while a few were invested in stock market.

Even though his bank accept his explanation of testing the security of the bank and that the money was  simply resting on a dummy account he had created, the authorities did not buy it and have sentenced Qin for theft.

“Qin Qisheng said that the matter was complicated and involved lots of work … he believed the bank would not pay attention even if he reported it,” a bank representative told the trial. “We think this reason for not reporting is legitimate,” he added.

“The core business system of Hua Xia Bank was bought from overseas supplier, it was designed without considering the problem of night trading,” Qin said during his trial. “The customer generally would not report to the bank, [so] we were not informed about this situation. The problem was definitely there, the bank just couldn’t find the reason.”

State Bank of India (SBI) clarified that no data breach occurred in their banking system. Responding to the recent media statement about failing to safeguard the financial records of its customers, SBI officials declared that there was no incident of customer data loss.

Responding to media queries on recent reports of data leakage involving the bank, SBI chairman Rajnish Kumar said, “Customer data security is the top most priority for us. None of our customers lost data, there was a gap in the process that caused the error, but no incident of customer data loss was reported. Also, no customer-identifiable information, username or passwords of any account holder, was kept on the system.”

“We are reviewing the entire systems. We have been examining the issue in totality to ensure complete safety and security of data and storage.” Kumar added.

The declaration comes after TechCrunch reported that an unprotected SBI’s server allowed potential attackers to view the data of millions of SBI account holders. It’s believed that the back-end text message system of SBI’s mobile banking services exposed the sensitive information, including customers’ phone numbers, partial account numbers, balance details, recent transactions, and other sensitive information. It’s unclear that how long the insecure database, that store data from SBI’s Quick, YONO app, and other cell-based banking services, exposed the customers’ data online, the publisher stated.

In order to advance the preparedness of Indian banks against cyber-attacks, the RBI is working on enhancing cybersecurity mechanisms. The central bank announced an enhanced security mechanism as part of its agenda for the fiscal year 2018-19 to provide high-level protection against cybersecurity threats.

The RBI’s report said the new agenda includes taking effective steps to initiate the process of developing a cybersecurity culture, endeavor to make cybersecurity a responsibility, and ensure confidentiality, integrity, and availability of information system and resources. According to the report, the new private sector and foreign banks accounted for 36 percent each of all cyber frauds reported in debit, credit, and ATM cards.

Search engine giant Google announced that it’s going to offer anti-hacking technology, named as Project Shield, to political organizations in Europe ahead of the European Union elections in May 2019, the Telegraph reported.

The technology used in Project Shield will safeguard websites from DDoS attacks by using a technique called Reverse Proxy. This technique monitors the website traffic and scans it for malicious content.

Jigsaw, Google’s experimental incubator, said it will offer free cybersecurity protection to political parties and candidates to defend elections from digital attacks. Jigsaw was previously developed and used to protect news organizations and human rights groups in the U.S. midterm elections for a similar purpose.

“Project Shield was launched in 2016 to protect independent news and human rights organizations from DDoS attacks, but in the wake of major election breaches and targeted political cyber-attacks, Project Shield can now be used to give political groups the same defense,” said Scott Carpenter, Managing Director of Jigsaw.

Recently, Google was fined for 50 million euros (around $57 million) by the French data regulator CNIL (National Data Protection Commission) for violating the General Data Protection Regulation. The data protection watchdog stated it had levied the fine for Google’s lack of transparency and valid agreement regarding ads personalization. The regulator also said that Google didn’t sufficiently inform the people about how it collected the users’ data to personalize ads.

The issue started when CNIL received complaints from the associations, None of Your Business (NOYB) and La Quadrature du Net (LQDN) in May 2018. The associations complained on Google for not having a valid legal basis to process the personal data of the users for ads personalization, as mandated by the GDPR.

Thousands of cars with keyless entry systems are left vulnerable, according to a report from consumer group Which? The report suggests that cars, including the most popular models in the United Kingdom from Ford, Nissan, and Volkswagen, can be easily stolen/hacked by attackers using wireless transmitters.

The report revealed that more than 30 car manufacturers, including Audi, BMW, Honda, Hyundai, Kia, Peugeot, Renault, Skoda, and Volvo, made cars that are not secured. The German General Automobile Club (ADAC) stated that it tested 237 keyless model cars and found that 230 of them can be unlocked and started in just 18 seconds using a Relay Attack.

“Carmakers have sacrificed the security of scores of modern cars for the sake of convenience. And, with other methods of car theft also rife and the number of cars being stolen on the rise, manufacturers must do more to make their cars more secure,” Which? reported.

Explaining how a Relay Attack performed, Which? stated, “Using relay boxes – one near your car and the other near where you keep your key – thieves can lengthen the signal produced by your key, fooling the car into thinking the key is close by. The thieves can then open and start your car and drive it away.”

In related news, a study released by Upstream Security, the first and only cloud-based Smart Mobility Cybersecurity provider, cyber hacks might cost the auto industry $24 billion within five years. Upstream issued its first comprehensive report studying the impact of more than 170 documented, Smart Mobility, cyber incidents reported between 2010-2018 and projects future trends based on that eight-year history.

The Upstream Security Global Automotive Cybersecurity Report 2019 outlines how hackers attacked—from physical to long-range to wireless and more — and who they targeted in the Smart Mobility space.