NSA Seeks to Expand Adoption of Cybersecurity Tool for Vehicles

The National Security Agency and Morgan State University have partnered to accelerate the transportation sector’s adoption of a cybersecurity tool for internet-connected vehicles.

The NSA said its Research Directorate’s vehicle systems software analysis team partnered with Morgan State University‘s Cybersecurity Assurance and Policy Center to broaden the adoption of the government-made Ghidra cybersecurity tool.

“The mission of the Vehicle Systems Software Analysis team is to conduct vulnerability research against the electronic control units contained within modern vehicles, including cars, trucks, motorcycles, RVs, boats, and aircraft,” said Brian Knighton, a member of NSA’s Ghidra team.

Electronic control units are equipped with sensors, cameras and wireless systems for moving data for entertainment, engine performance monitoring, safety and emissions regulations compliance.

Kevin Kornegay, head of Morgan State University’s CAP Center, explained that manufacturers prioritize consumer value rather than cybersecurity when they design ECUs in modern vehicles.

The agency publicly released Ghidra in 2019 in response to the growing reliance of vehicles on the internet of things for safety, speed monitoring, routing and other functions. Knighton said such internet-based systems could endanger both privacy and lives if left unprotected.

According to the NSA, current security frameworks are not fit for vehicles, which typically have longer operating lives than other internet of things devices. 

The NSA said its team used virtualization and reverse engineering to develop countermeasures against hackers attempting to extract, disrupt, divert and obfuscate data stored in vehicles.

Morgan State University’s CAP Center provided expertise in hardware reverse engineering to develop the NSA’s cyber threat mitigation platform, Kornegay said.