Modern vehicles are increasingly vulnerable to cyberattacks through the apps, websites and cloud services connected to them, according to a study by researchers at the University of Gothenburg and Chalmers University of Technology. Their analysis of 413 reported automotive software vulnerabilities between 2022 and 2024 found that security weaknesses have increasingly moved away from vehicles’ internal computer systems towards their connected digital services.
Today’s cars exchange data with manufacturers’ cloud platforms, drivers’ smartphones and charging stations. In-car entertainment systems also use internet connections to stream films and other media. While these features provide convenience, they create additional potential entry points for hackers seeking access to vehicle systems or the personal information associated with them.
“Ten years ago, most vulnerabilities were found in the cars’ own systems. Now the share found in apps, websites and cloud services has nearly tripled. These systems hold data about where you live, where you drive and when, so the risk is not only that someone could interfere with the car, but that they could get hold of information about your life,” says Srijita Basu, postdoctoral researcher in software engineering at the University of Gothenburg and Chalmers University of Technology.
The findings highlight how cybersecurity risks in connected vehicles extend beyond the possibility of someone remotely interfering with driving functions. Weaknesses in digital services can also expose sensitive information about owners’ movements, routines and personal lives.
Cloud Services Expose Sensitive Driver Information
The researchers found that vulnerabilities in automotive software are now more commonly reported in apps, websites and cloud services than they were during the previous decade. These weaknesses can create opportunities for attackers to access information collected from vehicles, including data that reveals where drivers live and travel.
A reported IT vulnerability does not necessarily mean that a security breach has occurred. Instead, it indicates that a weakness exists that could potentially be exploited.
One example emerged in December 2024, when it was revealed that data from approximately 800,000 electric vehicles manufactured by Volkswagen, Audi, Seat and Skoda had been openly accessible on the internet for several months. The exposed information included precise GPS data, as well as vehicle owners’ email addresses, telephone numbers and home addresses.
The data made it possible to determine exactly where and when a particular vehicle had been driven. The vulnerability originated in the car manufacturer’s cloud service, which uploaded information collected from vehicles on the road.
An ethical hacker group uncovered the exposure following a tip from a whistleblower. The incident received widespread media coverage, and the leak was fixed before it was known to have been misused.
Basu said the researchers were surprised by the basic nature of some of the weaknesses identified in their review.
“When we compare with the previous decade, we can see that IT vulnerabilities are now most commonly found in apps, websites and cloud services, and that the risks are more often rated as serious and critical. We are surprised by how basic some of the weaknesses in these systems are. They can involve passwords that have not been changed since installation. Hackers can use tried-and-tested old tricks to gain access through a back door,” says Srijita Basu.
The researchers’ findings suggest that manufacturers need to pay greater attention to the security of the digital services that support connected vehicles, particularly as these systems handle increasingly sensitive driver information.
Weak Links Between Vehicle Systems Can Enable Attacks
The car’s infotainment system, which manages audio and media functions, is another potential point of vulnerability. If vehicle systems are not properly separated, someone connected to the car’s Wi-Fi network could potentially gain access to other systems within the vehicle.
A widely reported example of this risk occurred in 2015, when security researchers demonstrated that they could remotely compromise a Jeep Cherokee through its media system. They gained access to other vehicle systems and were able to take control of the steering, brakes and accelerator.
The new study indicates that similar security weaknesses continue to appear nearly a decade later.
“My advice to car manufacturers is to keep systems that control the vehicle strictly separated from infotainment and other connected systems, with strong security around them. They should also learn from the web and IT world, where many of these flaws have been known for years. When the car is constantly connected to the outside world, it also invites the outside world into the car,” says Srijita Basu.
Connected vehicles are also increasingly incorporating AI assistants that can help drivers plan journeys and perform other tasks. However, these systems may have access to personal information, creating additional privacy concerns if they are manipulated into disclosing data.
“Car owners also have a responsibility to make things more difficult for hackers. It is important to update the software as soon as the car prompts you to do so, and strong passwords are still important. Today we share a lot of personal information with AI assistants for cars, for example when we ask to plan a long journey in an electric car. Like other AI systems, these assistants can be tricked into revealing information they have been given, so it matters what we share with them and what car makers allow them to access,” says Srijita Basu.
Read More :
Sridhar P