Four stories crossed the automotive security desk this week and, read together, they describe something more useful than any single bug: almost nothing that went wrong happened inside the car.
Tata Motors owners got a CERT-In advisory over four high-severity flaws in the iRA apps, the worst of them hardcoded service credentials shipped inside the download that anyone can unpack. The attackers never needed the vehicle; they needed a copy of the software that holds an owner’s authority.
The fixes cannot reach the parts that matter
The eSync Alliance’s warning points the same way. Over-the-air systems were built around the infotainment screen and the connectivity unit, while the braking and steering controllers arrive from separate suppliers on separate update paths. A recall becomes the patch mechanism.
Excelsior Springs found its bagged plate cameras still logging plate characters, which is a vendor-hardware lesson about what off actually means. In Chicago, nine locked cars left the street in three weeks, and the likeliest tool was a legitimate key programmer sold to locksmiths.
Ford, meanwhile, published a promise not to sell driving data to insurers. A pledge is worth what the settings menu is worth next year, and several specialists said so plainly.
What to ask for
Three questions follow. Can the security-critical controller on your car receive a signed update without a workshop visit? Does the phone app carry secrets in its package? And does a stop command at the vendor, a city council or a settings screen actually stop the flow?
None of these are answered by a stronger firewall around the vehicle. They are answered by whoever writes the software above it, and by the length of the supplier list behind them.
