News

חברת Cymotive, שנוסדה על-ידי שלושה בכירי שב”כ לשעבר, מציעה פתרון מקצה לקצה לאתגר הייחודי והמורכב של אבטחת סייבר לתעשיות הרכב והתחבורה החכמה, שמתחיל כבר בשלבי התכנון והייצור של כלי הרכב וממשיך גם כשהם עולים על הכביש. העובדה שב-2024 ייכנסו לתוקף תקני אבטחה בינ”ל מחייבים לרכבים מקושרים משחקת לטובתה.

Due to the regulations and standards in the cyber security field,requiring many OEMs to reorganize and build new cyber processes and culture, working with professional third-parties can reduce much effort, time, and costs for the OEM.

Of course, it can also open doors of opportunities for OEMs and the third-party companies to introduce new innovations to solve the upcoming challenges by with proven technologies in this nascent field of the industry. Clearly, the OEMs and the suppliers should choose a company which whom they can trust and feel confident to satisfy their customers.

Definition: Soft·ware de·fined ve·hi·cle | ˈsɒfˌtwer dəˈfaɪnd ˈviːhɪkl̩ | – noun: Cars whose features and functions are primarily enabled through software. The emergence of SW defined vehicles is the result of the ongoing transformation of the automobile from a hardware-based product to a software-centric electronic device on wheels.
How is the SDV different than previous car generations and how does it influence cybersecurity? Why is it good for the industry?
The SDV is a disruptive technology changing the current market paradigms and customer mindset. Here are some examples:

Advancing Cybersecurity of the Connected Vehicle across the Industry

Washington, DC – October 26, 2022 – The Automotive Information Sharing and Analysis Center (Auto-ISAC)
welcomes new members CYMOTIVE and Flex.

The Auto-ISAC announced today that two companies focused on automotive connectivity have joined its
membership. The new members are CYMOTIVE Technologies, a leader in smart mobility cyber solutions, and
Flex, a global manufacturer serving diverse industries and end markets including automotive and next
generation mobility technologies. The Auto-ISAC was formed by automakers in 2015 to establish a global
information-sharing community to promote vehicle cybersecurity.

“אל תסתכל בקנקן אלא במה שיש בו”

פרוטוקול ה-CANBUS הוא פרוטוקול תקשורת המשמש את  עולם הרכב כבר שנים רבות. בשנת 2012 נכנס לשימוש פרוטוקול חדש בשם CAN-FD, המספק תמיכה לאחור לפרוטקול ה-CANBUS, אך בנוסף מציע אפשרויות חדשות לשליחת הודעות. בפרט, פרוטוקול זה תומך בשליחת חלקים מההודעה בקצב גבוה ביחס לפרוטוקול ה-CANBUS, ובנוסף מאפשר שליחה של הודעות המכילות הרבה יותר בתים של מידע (64 בתים לעומת 8 בתים בפרוטוקול ה-CANBUS).

תקיפה חדשה בשם “קנקן” (CANCAN) פורסמה לאחרונה (ב-15 ביוני 2022) בכנס ESCAR USA על ידי החוקר מתן זיו מחברת סיימוטיב טכנולוגיות (CYMOTIVE Technologies). תקיפה זו מנצלת את היכולת לשלוח מידע מהיר על מנת “לקודד” בעזרתו מידע הנראה כהודעה תקנית אחרת.

The first Secure Our Streets (SOS 2022) conference was held in September 2022 focusing on the topic of cyber security in automotive products and supporting infrastructure. Organized by the ASRG (Automotive Security Research Group) SOS is planned to be a yearly conference with the goal to allow anyone and everyone to participate and learn about how to bring security and safety to automotive products. Automotive Security Research Group (ASRG) is a great initiative to build a community for the topic of automotive security research. CYMOTIVE is committed to this mission and we are looking forward to working with OEM and suppliers to secure the entire mobility ecosystem. Three presentations from the full lineup were given by CYMOTIVE’s experts: Benny Meisels, Lead Solution Architect, on 99% Complete, Do not turn off your car, Automotive cybersecurity for the connected vehicle, Gilad Bandel, Business Development, Is cybersecurity protection of commercial vehicles harder?, and Cristian Ion, Head of Secure Engineering, “Security challenges in autonomous vehicle market entry”.

CYMOTIVE cyber expert, Matan Ziv, presented the CANCAN vulnerability in a Meet-up sponsored by ASRG- Automotive Security Research Group. The Controller Area Network (CAN) bus protocol allows communication between various components inside most modern-day vehicles. The introduction of the new Controller Area Network Flexible Data-Rate (CAN-FD) protocol allows for faster communication with a larger number of data bytes per message. As these protocols are used for passing critical messages between different components, many attacks were found, and many security measures were proposed to solve or restrict them. In this talk, a new way of compromising systems utilizing the CAN-FD protocol is presented. By introducing a crafted CAN-FD message encapsulating a legal CAN or CAN-FD message, components could potentially be made to accept the encapsulated internal message instead of the external message that was, in fact, sent on the bus. This presentation shows how existing security solutions do not mitigate this attack and will offer effective mitigation solutions against it. The presenter Matan Ziv is a Principal Cyber Security Researcher at CYMOTIVE Technologies specializing in vulnerability research. Matan has over 15 years of experience in the embedded security field. His work for the last 8 years has been focused on automotive security, firmware binary analysis and tool development. As part of his contribution to the research community he has developed an open-source IDA plugin tool called “Oregami”, helping with the handling of information flow through registers in the disassembly code of embedded systems.

This article is based on our own extensive experience in the market, leading this kind of process with OEMs and Tier 1s. It is not an academic article. We are sharing our knowledge, insights, and experience in the goal to assist the industry and promote the security of our vehicles. Although this exchange of information process can be performed manually, we use a Cyber Security Management System (CSMS) automated tool for managing the compliance process, better preparation for the audit and controlled storage of the information and documents. We strongly recommend the industry to adopt this approach

A demand to protect the messages inside a vehicle

The automotive industry regulatory requirements and cybersecurity threats demand addressing the protection of the messages inside vehicles. As part of the automotive industry shifts towards CASE (Connected, Automated, Shared and Electric) vehicles, the two dominant network types are CANbus and automotive Ethernet. Since the CANbus is being replaced by automotive Ethernet, this article will focus on the latter. Although not related, we shall also discuss the external communication between the vehicle and the cloud, appreciating that alternative and more suitable solutions might be appropriate for each case. We shall review the various cryptographic aspects of network protection, present the alternatives, analyze them, and propose the relevant courses of action to the various players in the industry.

In today’s competitive economy, job success depends very much on learning everything possible about your product and its potential customer. You need to be familiar with the market challenges and the day-to-day issues affecting the customer.

The loss of life or any extensive damage due to a cyberattack on a vehicle would have enormous ramifications. The car’s brand would be irreparably damaged, together with immense financial losses. From a financial perspective, an OEM (Original Equipment Manufacturer) should invest in preventing anything close to such a financial and public relations disaster. Fortunately, we needn’t wait for OEMs to decide to invest in cybersecurity. By 2024, Tier 1 suppliers and OEMs have a shared goal to secure cars against cyber events by complying with regulations such as The UNECE World Forum for Harmonization of Vehicle Regulations (WP. 29) (UN – R155) or the Chinese GB/T.

The Introduction of Cybersecurity Regulations in the Automotive Industry 

Within the last few years, the automotive industry has witnessed the emergence of cybersecurity regulations. The two most prominent are the UNECE regulation UN R155 that applies to the UNECE member states and the GB/T that applies to China. 

As the automotive industry transforms into a digital software-based industry, the challenges and risks are significantly higher. Automotive cybersecurity is a set of practices, principles, technologies and solutions designed to protect today’s connected vehicles from being exploited by malicious hackers.

What is the story behind the Rolling-PWN attack?

The Rolling-PWN attack scenario was published by Kevin2600 and Wesley Li from the Star-V Lab. It describes an attack on various Honda vehicle models from 2012 and onwards. However, it is not necessarily limited to Honda and more likely, applies to many other vehicle makes and models in Asia and elsewhere.[1]  The Rolling-PWN attack performs a “replay at a distance” using the RKE (Remote Key Entry). It allows opening car doors and possibly even starting the engine, although no evidence has been provided to date.

A replay attack is one in which the attacker records the legitimate key commands communication sequence and plays it again later against the targeted car.

On May 31, 2022, Gilad Bandel, Senior Director of Business Development from Cymotive Technologies Ltd shared his thoughts on ICA Summit 2022. He participated as a speaker in “Panel 3: Cybersecurity for Autonomous Vehicles”. Company Cymotive Technologies Ltd is one of the Bronze sponsors of ICA Summit 2022. Due to the exponential growth of new technologies in the automotive industry, the demand for more secure and efficient driving, and the great success of the 1st edition, InLinum organized the 2nd ICA Summit, bringing more than 60 delegations from the automotive industry to discuss automotive innovations. What? Innovation, Connectivity, Autonomous – ICA Summit 2022 When? 30-31st, May 2022 Where? The Leonardo Royal Hotel, Munich Follow the updates of the ICA Summit event: www.ica-summit.com https://www.linkedin.com/showcase/ica… and look out for the date for 2023 confirmed! Find out more about automotive industry events organized by InLinum: www.inlinum.com #ICASummit #innovation #connectivity #autonomous

Gilad Bandel, Business Development, CYMOTIVE Technologies.

Let’s put it bluntly, the commercial vehicle cybersecurity landscape has significant financial and other “advantages” for hackers to make them a prime target, evidenced by the increased frequency of cyberattacks on fleets:

As the largest vehicle manufacturer in Turkey, Ford Otosan ramps up for upcoming cybersecurity regulatory compliance with CYMOTIVE’s vulnerability and compliance management solutions and services. 

רבות מהמכוניות שיוצרו בשנים האחרונות מכילות פרצת אבטחה במערכת התקשורת בין רכיבי הרכב – שמקלה על תוקפים לשלוח פקודות זדוניות שמשבשות את פעילותן. כך חושפת  סיימוטיב שעוסקת בהגנת סייבר בתחום המוטורי. החולשה התגלתה בתקן התקשורת בין מערכות הרכב בשם CAN FD, שהחליף בשנים האחרונות את תקן אחר – ה- CAN bus, ואיפשר ליצרנים לחסוך עשרות מטרים של חיווט חשמלי יקר בין חלקי הרכב.

Ypsilanti, Michigan, June 14, 2022, CYMOTIVE Technologies, the leading provider of smart mobility cyber solutions, today announced its participation in the international automotive security event ESCAR USA taking place on June 15 -16, 2022. On the first day at 9:45 am EST, CYMOTIVE’s Principal Cyber Security Researcher, Matan Ziv, will present research entitled “CAN-in-CAN Attack for Bypassing Security”, revealing a new potential attack on the CAN-FD (Controller Area Network Flexible Data-Rate) vehicle communication protocol. Matan has named the vulnerability “CANCAN”, referring to an ancient proverb on looking inside a person for hidden truth.

CAN-in-CAN Attack for Bypassing Security

At the ESCAR USA 2022 conference, we presented research discovering a new protocol attack on the CAN-FD vehicle communication protocol named CANCAN.

Our Lead Solution Architect, Cymotive, Benny Meisels spoke with EmbeddedFM about implementing embedded software security in cars. The discussion touches on the cybersecurity aspects of ECUs, IoT vehicles, threat and risk analysis, and how reverse engineering plays a role in security testing. What are the realistic possibilities for hacks into vehicles? How is it possible to offer reliable cybersecurity? How can developers maintain a high standard of functionality and cybersecurity? What are the complexities of this whole new world of connection? What will the first virus in a car look like? Tune in to hear many more intriguing questions and answers. You can find Benny on LinkedIn benny-meisels or on Twitter @benny_meisels.

Vehicles are becoming more reliant on technology every day. The speedy adoption of smart vehicles on our roads has opened up new avenues of possibility as well as risk. Electric, autonomous, and connected cars are transforming the automotive industry and introducing new attack surfaces for cybercriminals to target. Professional criminals, nationally legislated hackers, and even amateurs have already proven the risks of software-defined vehicles by seizing car controls remotely and otherwise taking advantage of various vulnerabilities found in vehicle code.

Field-proven at OEMs, Car Alert™ automates risk management of cybersecurity threats throughout the vehicle lifecycle delivering reduced costs and assured regulatory compliance.

TEL AVIV, May 25, 2022, CYMOTIVE Technologies, the leading provider of smart mobility cyber solutions, today announced the commercial launch of its automated vulnerability management solution, Car Alert™, aimed at increasing vehicle fleet safety and security with assured regulatory compliance by minimizing the risks resulting from in-vehicle software and hardware component vulnerabilities.

Automotive Cyber-Security
Benjamin Meisels, Lead Solution Architect, CYMOTIVE Technologies

As we celebrate Israel’s 74th Independence Day, let’s take a look at where Israeli experts think our tech ecosystem will be in 10 years.

Our lead solution architect, Benny Meisels, approached this question in regard to how the smart mobility system will look. “Israelis have entered the international automotive market through our expertise in cybersecurity, gradually extending our knowledge of the complexities of the industry. Today, we can be proud that Israel has made a significant and positive impact on the safety of the global smart mobility industry.”

At CYMOTIVE, we look all over the world for our cybersecurity experts, which means we are always gathering new talent for our teams. The best proof for this is “Cyber Security Architect” Annemike Vierneisel. The young woman has no difficulty keeping up in the international smart mobility environment and ensures more balanced numbers of men and women on our team.

The remarkable CV of the 26-year-old is presented in more detail in this article of Braunschweiger Zeitung.

In the previous article, you became better acquainted with your vehicle and the vulnerability of ECUs. You also read about the regulations and standards that automobile manufacturers and their supplies must follow, with their respective challenges.

Today’s article will take a deep dive into how we implement the incident response (IR) process, assisting OEMs to face the challenge of a greater attack surface given the increasing number of connected cars.
Many terms used in this article have already been defined and described in the previous one. They are important for your understanding, so if you haven’t had the chance to read the last article, here is a link to part 1.
Some people describe modern vehicles as computers on wheels, but with great power comes even greater responsibility and risks. In this rapidly developing industry, vehicle cyberattacks have happened, and are a very real concern. It’s only a matter of time until vehicles will face the next big cyberattack on a large scale. The next few sections describe a real cyberattack scenario, its impact, who is involved in the IR process, and how we handle it at CYMOTIVE.

כתבה עם ד״ר תמיר בכור, שותף מייסד וסמנכ״ל הפיתוח שלנו בה ניתן ללמוד קצת על מה אנחנו בעצם עושים, מהם האיומים העומדים בפני תעשיית הרכב, מה הסכנה בכך, מי עלול להזיק למערכות הרכב ומהו החזון שלנו בסיימוטיב עבור תעשיית הרכב החכם בטוחה ומוגנת יותר

CYMOTIVE COO Urit Lanzet was interviewed by i24News Jeff Smith on the company’s program to offer training to veteran IDF combat soldiers, thereby granting them better chances of entering into the world of Hitech.

Check out the “HIGH-TECH WITHOUT TRAFFIC” podcast where Tsafrir Katz, our CEO, and Avital Menaged, our Global HR Director were invited to speak.

שימו אוזן והזינו לפרק 18-
משיחה שהתחילה על תעשיית הרכב הגיעו לדבר על ערכים, חשיבות פיתוח הפריפריה וגיוון העובדים.

בפודקאסט מדובר על המעבר משירות הביטחון לעולם העסקים ותעשיית ההייטק, עבודה עם שותפים גרמנים והסינרגיה של התרבויות, הסתכלות ארוכת טווח על החברה ופיתוח האנשים בה, הזדמנויות גיוס מגוונות בצפון, הסבלנות הנדרשת בהתבססות סייט, ושילוב לוחמים משוחררים בהייטק.

במהלך הפודקאסט תשמעו גם דוגמאות איך בסיימוטיב
מעריכים את העובדים ביותר מאין סוף בירה וקינוחים. למשל משרד הלווין שיש לנו בסייט הצפוני, הכשרת לוחמים, תוכניות פיתוח אישי והזדמנויות לקידום בתוך החברה.

In Q4 of 2022, Start-Up Nation Central and the IDF’s Director of Professional Life, in collaboration with CYMOTIVE Technologies, are planning to launch Data4s, a program intended to train and incorporate combat soldiers and veterans into the hi-tech industry.

Vehicles today contain a lot of technology and software that makes them vulnerable to cybercrime, just like computers and IT networks, which is why many OEMs operate VSOCs – Vehicle Security Operational Centers.
Here in Cymotive, we provide a data analysis service in which a team of cyber security analysts, called ARL – Attack Research Lab, analyze data collected from the entire fleet to detect anomalies and cyber-attacks, all the way to the resolution of a single vehicle.
Today’s article will discuss the technologies in the vehicle and their differences from the traditional IT field, as well as their challenges that we face on a daily basis.

This has been a historic year for Israeli hi-tech, with the sector reaching unprecedented highs in 2021 in terms of funding. While the industry has progressed in one way, however, there may still be work to do incorporating women and granting them equal opportunities in hi-tech.

The critical Apache Log4j vulnerability is currently being exploited in the wild. Here’s how CYMOTIVE Technologies suggest mitigating the risk.

Yair, a 24 years old cymotiver has been working with our backend group for the last year and 8 months.

“It’s important for me to say that you can succeed. You should always do your best.”

Dirk Reimer, our CEO at CYMOTIVE GmbH has participated in an interview at Markt&Technik with the journalist Iris Stroh.

In the interview, Dirk talks about the existing challenges with cybersecurity in the smart mobility domain and shares some possible solutions.

What are the dangers and how can smart mobility be properly protected? These are questions that concern manufacturers, suppliers and customers alike. After all, in the future, digital trust will be one of the deciding factors in whether or not we buy a car.

CYMOTIVE in partnership with Scale-Up Velocity and “מקצוע לחיים”, will take part in a unique program called Data4s, which will enable IDF veterans (fighters) without any prior knowledge and experience, to become data analysts within 4 months, and join the company.

Mobility in 2030 will be autonomous, digital, intelligent, sustainable and safe. However, the increasing connectivity and the integrated communication and service functions of vehicles place high demands on security.

Tsafrir Kats, the former head of the Shin Bet technology unit who co-founded CYMOTIVE Technologies with the Volkswagen Group, discusses the decision not to engage in the offensive cyber arena, and reveals a new customer that has been his lifelong dream.

Tsafrir Kats, the former head of the Shin Bet technology unit who co-founded CYMOTIVE Technologies with the Volkswagen Group, discusses the decision not to engage in the offensive cyber arena, and reveals a new customer that has been his lifelong dream.

Our E2E PT Team Leader wrote about his unusual sequence of events that led to a once-in-a-lifetime relocation experience in Italy.

More and more companies are making an effort to reduce carbon footprint and become vegan friendly. We talked to their employees.

The center (located at Bar Lev High-Tech Park) will include a research lab for smart vehicles. Yuval Diskin: “There is a connection between protecting smart mobility, the mission of connecting the center of Isreal to the periphery, and incorporation of Jews and Arabs in one workplace. We believe in the contribution of cultural diversity to creativity and innovation of the company”

Executives at leading companies, sum up 2020, and sharing the plans for the upcoming year.

How management skills that emphasize determination and sensitivity, are creating strong and stable leadership in the challenging times of the Coronavirus pandemic. (Hebrew content)

Our vehicles are smarter than ever, but so is the risk of attacking vehicles via the network. CYMOTIVE Technologies has protection solutions, some of which are now integrated into more than one and a half million cars worldwide. (Hebrew content)

The Corona crisis caught everyone unprepared, while many businesses had to close and send workers home, there were also those who continued to recruit and conduct training remotely. How does it feel starting to work at a new company in the middle of this crisis? (Hebrew content)

Cars are already communicating with the cloud – so what about cyber security? Read more to find out.

Former top Israeli security operative Tamir Bechor talks about car cybersecurity company Cymotive, which he founded with two other former security service colleagues.

Former top Israeli security operative Tamir Bechor talks about car cybersecurity company Cymotive, which he founded with two other former security service colleagues.

CYMOTIVE offers its employees to experience short term relocation (Hebrew content).

A zero day vulnerability in a famous embedded Bluetooth stack found by CYMOTIVE, affecting about one hundred million devices

Speaking at a Calcalist panel held during the Paris Motor Show, former director Yuval Diskin spoke about the current challenges facing the automotive industry

It didn’t really work out with Susita, but increasing cyber threats a bringing the global automotive industry to look for solutions in Israel

When cars can talk to the Internet, hackers can talk to cars. Which is why Volkswagen has become the latest in a string of companies entering the automotive cybersecurity realm.

The company was founded by Yuval Diskin, Zafrir Katz, former head of the technology division of the Shin Bet, and Dr. Tamir Bechor. Will develop technological solutions to secure the next generation of smart cars

Volkswagen is teaming up with three leading Isreali cyber security experts to found CYMOTIVE Technologies. Led by Yuval Diskin, Tsafrir Kats, and Dr Tamir Bechor, the company will work to protect connected cars with mobile services from hackers.

Volkswagen is forming a company with the former head of Israel’s Shin Bet intelligence agency to develop cyber security systems for Internet-connected cars and self-driving vehicles, the partners said in a statement on Wednesday