Your car’s smartest features open the door to hackers

The biggest threat to your car was once a coat rack combined with a questionable sense of morality. Today, thieves hardly need to leave the comfort of their own sofa.

Modern vehicles are computers on wheels that communicate with your smartphone, other cars, satellites, and cloud servers to navigate, entertain, and even drive for you. It’s all very convenient, until someone with less than honorable intentions finds a way into your vehicle’s digital conversation.

A new study by researchers at the University of Gothenburg and Chalmers University of Technology in Sweden has found that the biggest cybersecurity risks facing modern vehicles now lie less within core vehicle operations and increasingly outside the cars themselves. And some of the weaknesses are embarrassingly basic.

Researchers examined 413 software vulnerabilities affecting connected vehicles between January 2022 and September 2024, comparing their findings to security issues documented over the previous decade.

They discovered a surprising change in where problems appear.

Decades ago, car thieves needed to have physical access to a vehicle to steal it. Since then, attack patterns have evolved to become more remote. External applications (including websites, apps and cloud services) now account for more than a third of identified weaknesses. That’s almost three times the proportion found in previous research.

The consequences are not pretty. Vulnerabilities in software can lead to attacks that compromise your entire ability to drive safely, meaning safety is no longer just a matter of keeping your car safe. It’s about you staying alive.

In 2015, security researchers demonstrated how they could remotely interfere with the steering, brakes and accelerator of a Jeep Cherokee after gaining access through its infotainment system.

More than a decade later, weaknesses in entertainment and communication systems remain a cause for concern.

A documented vulnerability in a Škoda infotainment system, for example, could allow an attacker connected to the vehicle’s Wi-Fi to crash the system under certain conditions.

It’s not a Hollywood-style highway hijacking, but it’s not a feature you’d expect to find in the brochure.

While some more nefarious syndicates may hold your leadership or brakes for ransom, a much more common target is your private information. Your direction, your movements, your daily routine, and potentially even where you park when you’re supposed to be at work.

The risks are not entirely hypothetical. In December 2024, researchers revealed that location information associated with around 800,000 vehicles across Volkswagen Group brands had been left accessible online.

The attackers exploited unsecured Amazon Web Services credentials used by a third-party provider to collect precise GPS locations and personal details, which could allow someone to reconstruct a driver’s movements.

Fortunately, the exposure was fixed before any malicious exploits became known. However, our privacy is only part of the problem. The study also found a worrying change in the severity of reported vulnerabilities. Nearly 45% were classified as high severity, and another 16% were classified as critical. In comparison, a previous study found that only 5% of vulnerabilities fell into the critical category.

That doesn’t mean hackers are now seizing millions of cars. A vulnerability is a potential opportunity, not evidence that someone has successfully exploited it.

Researchers have identified hidden problems in third-party software libraries used by automotive developers, highlighting how security flaws can reach vehicles long before they leave the factory. The findings point to a simple lesson for manufacturers: security should be built into every stage of development, not thrown in as an afterthought.

Keeping entertainment systems isolated from safety-critical controls would also help ensure that a compromised playlist doesn’t become a compromised vehicle.

For drivers, the advice is familiar: install software updates, use strong passwords, and think carefully about personal information shared with connected services.

After all, your car already knows where you’ve been. There’s no reason for everyone else to know it too.

This research was published in Software Quality Magazine

Source: TechXplore