A connected car is like a computer on wheels, communicating with the manufacturer's cloud services, the driver's mobile operator and charging stations. But every connection can also be an entry point for hackers.
In a study in the Software Quality Journal, researchers from the University of Gothenburg and Chalmers University of Technology analysed 413 reported security flaws in automotive-related software between 2022 and 2024. They compared these with flaws reported over the previous decade. Reporting a vulnerability does not mean a breach has occurred, but that there is a risk.
“Banal weaknesses”
The results show that the proportion of risks found in apps, websites and cloud services has tripled compared with ten years ago, when IT vulnerabilities were more often found in cars' own systems. Apps and cloud services contain data such as where the driver lives and where and when the car is driven - information that a hacker could obtain.
According to the researchers, the risks are increasingly being assessed as serious.
"We are surprised by how banal the weaknesses are in the systems. It could be passwords that have not been changed since installation," says Srijita Basu, a researcher at the Department of Computer and Information Technology at the University of Gothenburg, in a press release.
Took control
The researchers also warn that the car's audio and media system is vulnerable, and that anyone connected to the car's Wi-Fi network could gain access to its other systems.
In a test security researchers conducted on a Jeep Cherokee in 2015, they were able to access the car's systems via its media system and take control of the steering, accelerator and brakes.
According to the new study, similar vulnerabilities still exist, and the researchers advise car manufacturers to separate control systems from all other IT systems.