A cybersecurity researcher needed no password to reach the systems of a BYD Shark 6, the plug-in hybrid ute that Australia's trade minister owns. Dan Hreszczuk, co-founder of Canberra firm Fortify Labs, spent two weeks with the vehicle for an ABC Four Corners investigation.
What he found was an exposed access point his team called easier than expected. Hreszczuk locked a journalist inside, pushed audio through the speakers, threw images onto the infotainment display, ran the wipers at full speed and killed the headlights mid-corner. Brakes and cameras held. Almost everything else did not.
The sharper demonstration used the cabin microphone. Hreszczuk recorded a conversation from the moving car, then replayed the driver saying "Hey Siri" to feed a voice assistant commands. It surrendered a home address, a date of birth and enough detail to assemble a banking password.
BYD said the data it collects stays in Australia and that it has not handed Australian data to Chinese authorities.
Australia has no minimum cybersecurity standard for cars. Consultations with industry started recently and rules are years away. Home Affairs and Cyber Security Minister Tony Burke defended the sequencing, saying household connected devices were regulated first. Former national cyber security adviser Alastair MacGibbon wants stronger protections for connected car data, and opposition defence spokesman James Paterson called a Chinese connected EV the highest-risk product on the market.
"I didn't need to pick the lock as BYD left the front door open," Hreszczuk said.
