Abstract:
As cars become increasingly networked and intelligent, the cybersecurity risks faced by vehicles are undergoing major changes. New research shows that the weakest security link in modern cars is increasingly not in the vehicle itself, but in the apps, websites and cloud services connected to the car.
A research team from the University of Gothenburg and Chalmers University of Technology in Sweden analyzed 413 publicly reported automotive software security vulnerabilities between 2022 and 2024 and compared the results with data from the previous decade. Research has found that attackers are shifting their focus from internal vehicle systems to digital infrastructure outside the vehicle.
Researchers pointed out that ten years ago most security vulnerabilities existed mainly in the vehicle's own system, but now the proportion of vulnerabilities in applications, websites and cloud platforms is nearly three times that of previous studies. This means that hackers are increasingly likely to carry out attacks or steal data through the car manufacturer's online services rather than directly accessing the vehicle.
As cars become highly connected devices, they are in constant communication with the manufacturer's cloud platform, the owner's smartphone, charging facilities and Internet services. Every connection point is a potential entry point for intrusion. Researchers pointed out that these external systems store a large amount of user information, including residence locations, driving routes, parking locations, and daily activity patterns. Once compromised, the consequences may not only be limited to vehicle safety, but also involve serious privacy leaks.
The study cited a typical case. In December 2024, data related to approximately 800,000 vehicles from multiple brands of the Volkswagen Group was found to be accessible on the Internet. The data includes precise GPS location information as well as the vehicle owner's email address, phone number and home address. Because the vulnerability exists in the cloud service system that vehicle data upload relies on, outsiders can even see when and where a specific vehicle has appeared. Fortunately, the vulnerability was fixed before it was confirmed to be maliciously exploited.
The research team said they were surprised by how basic some of the vulnerabilities are. Some issues even stem from traditional security flaws such as default passwords that are not changed after deployment, allowing attackers to gain access to the system using long-standing common attack vectors.
In addition to cloud services, in-vehicle infotainment systems remain one of the important sources of risks. Researchers pointed out that if there is insufficient isolation between different systems inside the vehicle, attackers may gain access to the infotainment system by connecting to the vehicle's Wi-Fi network and further gain access to other critical systems.
The most famous case in the field of automotive cybersecurity occurred in 2015. At that time, security researchers successfully took over some control functions of a Jeep Cherokee remotely through the vehicle's entertainment system, including steering, braking and acceleration controls. This incident has shocked the entire automobile industry and prompted major automobile companies to strengthen network security construction.
However, research points out that the more common threat today is not necessarily remote control of vehicles, but theft of personal information. The large amount of location and behavior data generated by vehicles every day can reveal the car owner’s living habits, work location and travel patterns. This type of information is extremely valuable to cybercriminals.
Research results show that as cars gradually evolve into "computers on wheels", network security is no longer just a matter of preventing vehicle theft, but an important issue related to user privacy, data protection and even driving safety. Researchers call on automakers to strengthen the security of in-vehicle systems while also strengthening the security protection of application services, cloud platforms and backend infrastructure to cope with the expanding digital attack surface.
Learn more:
https://link.springer.com/article/10.1007/s11219-026-09787-y
Comments