The biggest threat to your car was once a coat hanger combined with a questionable sense of morality. Today, thieves barely need to leave the comfort of their own couch.
Modern vehicles are computers on wheels, communicating with your smartphone, other cars, satellites, and cloud servers to navigate, entertain, and even drive for you. It's all so convenient, right up until somebody with less-than-honorable intentions finds a way into your vehicle’s digital conversation.
A new study by researchers at the University of Gothenburg and Chalmers University of Technology in Sweden has found that the biggest cybersecurity risks facing modern vehicles are now found less within the vehicle’s core operations and increasingly outside of the cars themselves. And some of the weaknesses are embarrassingly basic.
The researchers examined 413 software vulnerabilities affecting connected vehicles between January 2022 and September 2024, comparing their findings with security issues documented over the previous decade.
They discovered a striking change in where the problems are turning up.
Decades ago, car thieves needed to have physical access to a vehicle to steal it. Attack patterns have since evolved to become more remote. External applications – including websites, apps, and cloud services – now account for more than a third of identified weaknesses. That's nearly three times the proportion found in earlier research.
The consequences aren’t pretty. Vulnerabilities in software can result in attacks that compromise its entire ability to drive safely, meaning security is no longer just a matter of keeping your car safe. It’s about you staying alive.
In 2015, security researchers famously demonstrated how they could remotely interfere with a Jeep Cherokee's steering, brakes, and accelerator after gaining access through its infotainment system.
More than a decade later, weaknesses involving entertainment and communication systems remain a concern.
One documented vulnerability in a Škoda infotainment system, for example, could allow an attacker connected to the vehicle's Wi-Fi to crash the system under certain conditions.
Not quite a Hollywood-style highway hijacking, but hardly a feature you'd expect to find in the brochure.
While some more nefarious syndicates might hold your steering or brakes for ransom, a far more common target is your private information. Your address, your movements, your daily routine, and potentially even where you park when you're supposed to be at work.
The risks aren't entirely hypothetical. In December 2024, researchers revealed that location information associated with around 800,000 vehicles from Volkswagen Group brands had been left accessible online.
Attackers exploited unsecured Amazon Web Services credentials used by a third-party vendor to collect precise GPS locations and personal details, potentially allowing someone to reconstruct a driver's movements.
Fortunately, the exposure was addressed before any known malicious exploitation. Yet our privacy is only part of the problem. The study also found a worrying shift in the severity of reported vulnerabilities. Nearly 45% were classified as high severity, with another 16% listed as critical. By comparison, an earlier study found just 5% of vulnerabilities fell into the critical category.
That doesn't mean hackers are now commandeering cars by the millions. A vulnerability is a potential opportunity, not evidence that somebody has successfully exploited it.
The researchers identified problems lurking in third-party software libraries used by automotive developers, highlighting how security flaws can find their way into vehicles long before they leave the factory. The findings point to a simple lesson for manufacturers: security needs to be built into every stage of development, not bolted on as an afterthought.
Keeping entertainment systems isolated from safety-critical controls would also help ensure a compromised playlist doesn't become a compromised vehicle.
For drivers, the advice is familiar: install software updates, use strong passwords, and think carefully about the personal information shared with connected services.
After all, your car already knows where you've been. There's no reason to let everyone else know, too.
This research was published in Software Quality Journal
Source: TechXplore