A cybersecurity researcher’s remote control of a BYD Shark 6 is being read as a China story, but the academic who wrote about it says the weakness runs deeper and wider than one country’s car industry.
Dennis B. Desmond, a lecturer in cyberintelligence and cybercrime investigations at the University of the Sunshine Coast, argues in The Conversation that the ABC’s report of a locked, lit and audio-hijacked BYD ute showed the task was easier than expected for reasons that have nothing to do with nationality.
Modern cars, he writes, are distributed networks of computers. Dozens of ECUs run entertainment, braking, steering, sensors and driver assistance, and they talk to one another while the vehicle also talks to mobile networks, cloud services and the maker’s own infrastructure. The doors in are several: phones and accessories arrive over Bluetooth and wifi, while a built-in SIM or eSIM ties the vehicle itself to mobile networks. Software arrives the same way, which makes fleet-wide update distribution a target in its own right.
The eSIM is rarely the flaw, Desmond notes, but it opens a path into the modem, telematics stack, mobile network and OEM cloud. Researchers have already found weaknesses along that chain while testing Tesla Model 3s and Cybertrucks.
He points to Kaspersky’s August documentation of malware attacking Android head units through a firmware update service, demonstrations against the QNX operating system and a Bluetooth bypass of anti-theft protections in a Nissan Leaf. Risks span safety, identity theft and vehicle theft, and Australia’s eSafety Commissioner has flagged connected cars as tools of coercive control.
Australia has no mandatory vehicle cybersecurity standard. China and the EU do.
