BYD has closed the internal investigation it opened after an ABC Four Corners report showed its Shark 6 ute being accessed by a Canberra security firm, and it has settled on a cause: a software defect in the infotainment system.
The company said on October 1 that the weakness let a researcher switch on Android Debug Bridge through the infotainment interface and load an untrusted third-party application. Its engineers reproduced both steps. The permissions that followed, location and microphone among them, unlocked only after a person accepted a prompt on screen, BYD said.
The carmaker also pushed back on the more dramatic half of the demonstration. Its engineers concluded that control of the headlights and windscreen wipers required someone to physically tap the vehicle’s CAN bus wiring, a method limited to the single car touched. Reaching that network through the diagnostic port would instead have to clear device authentication and physical isolation, protections BYD says it built to satisfy UN R155.
Remediation is underway. A corrective action removes the pathway that allowed ADB to be enabled from the infotainment UI, and the revised software will ship as an over-the-air update once validation finishes. No timeline was given, and BYD is still checking whether other models need it.
Separately, the automaker opened a risk assessment into CAN message authenticity, integrity and freshness – the checks that would make a tapped bus harder to abuse. The researcher’s firm said it was simulating the access a manufacturer already holds, not breaking in from outside.
