Connected Vehicles Face Rising Cybersecurity Risks

Connected vehicles are becoming more susceptible to cybersecurity threats, according to a study by researchers at the University of غوتنبرغ and جامعة تشالمرز للتكنولوجيا in Sweden. The research indicates that vulnerabilities are increasingly found outside the vehicles themselves, particularly in external applications.

The study examined 413 software vulnerabilities affecting connected vehicles from January 2022 to September 2024. It found that more than a third of identified weaknesses now originate from external sources, a significant increase compared to previous research.

Historically, car thieves required physical access to vehicles to steal them. However, attack patterns have evolved, allowing criminals to exploit vulnerabilities remotely. This shift raises serious concerns, as software vulnerabilities can compromise a vehicle’s ability to drive safely.

In 2015, security researchers demonstrated the potential for remote interference with a Jeep Cherokee’s steering and brakes through its infotainment system. Today, weaknesses in entertainment and communication systems continue to pose risks.

For instance, a vulnerability in a Škoda infotainment system could allow an attacker connected to the vehicle’s Wi-Fi to crash the system under certain conditions. This highlights the potential for serious security breaches.

While some hackers may attempt to hold vehicle controls for ransom, personal information remains a more common target. Data such as a driver’s address, movements, and daily routines can be exploited.

In December 2024, researchers revealed that location information for around 800,000 vehicles from Volkswagen Group brands was left accessible online due to unsecured Amazon Web Services credentials used by a third-party vendor. This incident underscores the importance of securing sensitive data.

The study also noted a concerning trend in the severity of reported vulnerabilities, with nearly 45% classified as high severity and 16% as critical. This is a stark contrast to earlier findings, where only 5% of vulnerabilities were deemed critical.

Although these vulnerabilities present potential opportunities for hackers, they do not necessarily indicate successful exploitation. The researchers identified issues in third-party software libraries used by automotive developers, emphasizing the need for security to be integrated at every stage of vehicle development.

To mitigate risks, manufacturers should ensure that entertainment systems are isolated from safety-critical controls. This approach would help prevent a compromised entertainment system from affecting vehicle safety.

For drivers, remaining informed about potential vulnerabilities and advocating for robust security measures in connected vehicles is essential.

Source: New Atlas