BYD to fix Shark 6 'flaw' after vehicle successfully hacked

Australia (ANTARA) - BYD has acknowledged a software ‘flaw’ in its Shark 6 double-cabin pickup, which allowed a researcher in ABC’s Four Corners programme to track the vehicle remotely and access the microphone on one of the pickups while in use on public roads.

Drive reported on Thursday (1/9) local time that the findings will be addressed with a software update for the Shark 6 once a process of ‘rigorous validation’ is complete. BYD is also determining whether similar updates are required for other BYD vehicles.

However, BYD stated that footage showing the hacker disabling headlights and activating wipers required ‘direct access to the vehicle’s wiring’. Such actions cannot be performed remotely without prior physical access to the vehicle.

An episode of the ABC television programme, Four Corners, which aired earlier this month, discussed Chinese internet-connected vehicles. In the programme, a BYD Shark 6 was used by Dan Hreszczuk, one of the founders of cybersecurity firm Fortify Labs, for two weeks.

Hreszczuk was initially shown successfully accessing the Shark 6’s infotainment system, which he claimed was not password-protected, to listen to phone conversations and search for sensitive personal information.

The researcher was then shown disabling headlights, activating windscreen wipers, and locking doors during a demonstration on the road while the vehicle was being driven.

Although the accelerator, brakes, and steering could not be accessed, BYD conducted an investigation into the ‘claims’ presented by the programme, involving technical teams in both Australia and China.

In a statement, BYD confirmed that access to the infotainment system was achieved through Android Debug Bridge (ADB), a tool within the Android software used by the Shark 6’s multimedia system. ADB is typically used to install applications during the development process or for debugging purposes. This feature is disabled by default when vehicles leave the factory.

BYD stated that ADB ‘can only be accessed by authorised parties using specialised tools’. According to BYD, Hreszczuk ‘exploited a software loophole to activate ADB and subsequently installed untrusted third-party applications’.

‘BYD engineers, in their investigation, successfully reproduced the software loophole used to activate ADB as well as the process of installing these untrusted third-party applications,’ said BYD.

‘When an application requests access to specific information or functions, such as vehicle location or the microphone, the infotainment system displays a permission request. The requested permission can only be granted after the user manually approves the request through the infotainment interface,’ BYD added.

‘The updated software will be implemented as part of a software update for the Shark 6 infotainment system via Over the Air (OTA) in the future, and only after the updated software has undergone rigorous validation. BYD is also investigating whether a software update is required for other BYD vehicles sold in Australia,’ the company stated.

In addition to the flaw in the infotainment system, BYD found that accessing the headlights and wipers ‘requires direct physical access to the vehicle’s internal CAN bus by connecting it to the vehicle’s wiring’.

BYD ensured that such actions can only be performed with physical access to the vehicle, as seen with the Shark 6 featured in the ABC programme and used by the cybersecurity researcher for two weeks.

This means that the hacking demonstrated in the programme was ‘limited to vehicles that had been physically accessed’. Other BYD Shark 6 vehicles on the road cannot be controlled remotely using the same tools without physical contact.

BYD stated that if a vehicle cannot be physically accessed via wiring, the only way to access the ‘relevant vehicle network’ is through the On-Board Diagnostics (OBD) interface.

The company has implemented several security measures, such as ‘device authentication and physical isolation’, supported by ‘safeguards’ in accordance with United Nations regulations to protect the OBD interface.

BYD has also commenced further ‘risk assessments’ to examine the ‘technical necessity and feasibility of additional measures’.