Modern cars face hacking risks and cabin conversations leaked
Australia (ANTARA) - An Australian-made documentary has highlighted the emerging cybersecurity risks associated with the increasing prevalence of modern electric vehicles.
Carscoops reported on Friday (25/9) local time that the documentary demonstrates how automotive companies have access to vast amounts of information from every vehicle. Modern cars are capable of collecting massive datasets, not only regarding the vehicle’s condition while being driven but also potentially impacting the users themselves.
The investigation specifically highlights two Chinese electric vehicle brands, namely Xpeng and BYD. Regarding Xpeng, an unnamed internal company source was allegedly able to monitor an Xpeng G6 obtained by ABC News. The source could reportedly determine the vehicle’s location, speed, seat occupancy, steering angle, and various other details. This information and other data are also allegedly accessible by companies in China.
The ABC report delved deeper into the issue by demonstrating what hackers could achieve if they gained access to a vehicle. Dan Hreszczuk, a cybersecurity expert specialising in vehicles, was given a BYD Shark 6 pickup truck for two weeks. After discovering security loopholes, he was able to access the car’s system quite easily.
“The access we exploited did not even require a password,” said Hreszczuk.
Hreszczuk was able to lock the driver inside the car, play music at high volumes, and manipulate the wipers and lights while the vehicle was in motion. While such actions are disruptive and potentially dangerous, a more concerning issue arises when hackers can listen via the microphones inside the car.
He was not only able to overhear potentially sensitive information, such as telephone conversations, but also recorded the journalist’s voice and captured his iPhone’s activation commands to later play them through the Shark 6’s speakers. When the “Hey Siri” command was triggered, the hacker inserted his own commands, causing the iPhone to reveal various information. The exposed data included the user’s date of birth, phone number, and even contacts stored in his phonebook, one of which happened to be the Australian Prime Minister’s number.
Nevertheless, a member of the British Parliament noted last year that the Chinese government has the legal right to access data collected by cameras, sensors, and radar systems on vehicles manufactured using Chinese technology.
On the other hand, automotive security issues are not new, and these concerns are not limited to Chinese cars. A 2023 Mozilla study found that all 25 car brands studied received a “Privacy Not Included” warning label due to poor handling of consumer data. Two brands, Nissan and Kia, were even cited for monitoring drivers’ “sexual activity” and information regarding the owners’ “sexual lives.” Furthermore, 84 per cent of the surveyed brands also sell the data they collect to third parties.
Several cases of vehicle hacking have been reported previously, including involving Tesla, Kia, and Subaru, where hackers allegedly gained various forms of access to the vehicles.