Worried about your car being hacked? You should be – no matter where it was made

Earlier this week, the ABC reported a cybersecurity expert hacking a BYD Shark 6 hybrid ute. The expert gained control of the Chinese-made vehicle’s locks, headlights, and audio and video, saying the task “was easier than we were expecting”.

The ABC also reported concerns that cars made by BYD and other Chinese companies may share data – including audio, video and location information – with the Chinese government.

Most modern cars, whether electric, fossil-fuelled or hybrid, collect a lot of personal information. Many transmit that information to offshore servers for storage and processing, where it may be accessible to foreign governments, including China.

However, it’s not just foreign governments that have access to that data. Hackers may able to access it, too – and it’s a concern for all connected vehicles, no matter where they’re made.

A network of computers – on wheels

Our main mode of transport has evolved from a largely analogue machine into a distributed network of computers on wheels. The car’s own network is connected to another network of computers outside the vehicle.

Like other computer systems, modern cars are vulnerable to hacking and malware.

A modern car contains dozens of computers responsible for different functions. Some manage entertainment and communications, while others control braking, steering, engine performance, sensors and driver-assistance systems. These systems communicate with one another. Separate systems connect the vehicle to mobile networks, cloud services and the manufacturer’s online infrastructure.

Modern cars can connect in several ways, including Bluetooth, wifi, and built-in SIMs or eSIMs. Bluetooth and wifi connect our phones and other devices to the car, while a SIM or eSIM connects the vehicle itself to the internet and the manufacturer’s systems. Many cars also receive software remotely through over-the-air updates.

This means cybersecurity is no longer just about protecting a single vehicle. Manufacturers must also secure the systems used to distribute software across entire fleets.

Weak links in the chain

Most smartphone users are familiar with SIM cards and eSIMs, which connect our phones to mobile networks. Similar technology is built into many modern vehicles. This allows them to communicate with manufacturers, receive software updates and transmit vehicle data, known as telematics.

The SIM itself is not usually the vulnerability. Instead, it provides a pathway into a much larger communications system that includes the vehicle’s cellular modem, telematics systems and mobile network, as well as the manufacturer’s online infrastructure.

Researchers have found weaknesses in this communications chain while testing Tesla Model 3s and Cybertrucks, but similar weaknesses are also likely to exist in other cars.

Automotive systems can contain outdated technologies, remain in service for many years and depend on complex supply chains and trust relationships that were not designed for permanent internet connectivity. As a result, attackers may target either the vehicle’s cellular connection or the manufacturer’s cloud infrastructure.

Hackers are paying more attention to cars

In August, cybersecurity company Kaspersky documented a malware campaign targeting “head units” (which handle multimedia and sometimes car control functions) running on the Android operating system. The malware worked via an automatic firmware-update service.

Security researchers have also demonstrated several ways to attack vehicles that use the common QNX operating system.

In another demonstration, researchers bypassed anti-theft protections and used Bluetooth vulnerabilities to gain deep access to vehicle systems in a Nissan Leaf.

Gaining access to a vehicle could present direct physical safety risks if hackers compromise things such as steering or lights. It could also be used for identity theft or to steal the vehicle itself.

Australia’s eSafety Commissioner has also identified connected vehicles as technologies that can facilitate coercive control.

Trip histories, geolocation data and vehicle apps can be used to monitor a person’s movements. Remote functions can operate doors, climate controls, horns, headlights and other vehicle systems.

Australia has no cybersecurity standards for cars

Australia currently has no mandatory minimum cybersecurity standard specifically for vehicles. Implementation of new rules is likely years away at best.

Other markets, including China and the European Union, already require manufacturers to demonstrate how they manage cybersecurity risks and protect software updates throughout a vehicle’s life.

The more connected our cars become, the more important it is to ask not only what data leaves them, but what can get back in.

What to know if you’re buying a car

So where does this leave you if you’re thinking about buying a new, connected vehicle? As is so often the case with modern, connected technologies, taking on some risks around cybersecurity and data privacy is almost impossible to avoid.

But there are things you can do to reduce those risks. The Australian Cyber Security Centre offers a detailed guide on what issues to keep in mind when purchasing and using a connected vehicle.

Most of the advice comes down to four tips:

• keep the vehicle and any related apps up to date

• research the maker’s approach to cybersecurity

• consider the risks of using connected services

• if you’re buying or selling a used vehicle, restore it to factory settings.

You might also wish to take the vehicle’s country of manufacture into account, but remember that it’s only one factor.

Dennis B. Desmond received funding from the Australian Army and also conducted research under an ARC Linkage Grant.