Show summary Hide summary
Cars today are increasingly networked computers, and a new study shows the greatest cybersecurity dangers are moving away from mechanical parts and into the digital services that surround vehicles. The shift raises direct safety and privacy concerns for drivers as remote weaknesses grow more common.
Risk migrating off the car and into the cloud
Researchers from the University of Gothenburg and Chalmers University of Technology reviewed 413 software vulnerabilities affecting connected vehicles between January 2022 and September 2024. Their analysis found a clear change: many of the most serious flaws now originate outside the vehicle itself.
Post Salt Bikernet issues weekly edition for August 28, 2026
Light-powered e-paper display powers wall art without an external charger
More than one-third of identified weaknesses were tied to external applications — including websites, mobile apps and cloud services. That share is nearly three times higher than earlier research had shown, the study reports.
Real incidents underline the threat
Remote attacks on vehicle systems are not theoretical. In 2015, security researchers demonstrated remote control over steering, brakes and acceleration in a Jeep Cherokee after intruding through its infotainment system.
Similar classes of vulnerabilities remain relevant. For example, the study cites a flaw in a Škoda infotainment system that could let an attacker connected to the vehicle’s Wi‑Fi crash the system under certain conditions.
Privacy exposures and a major data lapse
Beyond potential control of vehicle functions, attackers often target personal data. The study notes instances where location and user data were exposed.
In December 2024, researchers disclosed that location information for roughly 800,000 vehicles from Volkswagen Group brands had been left accessible online. The exposure was linked to unsecured Amazon Web Services credentials used by a third‑party vendor, which allowed collection of precise GPS locations and related personal details. The data was secured before any known malicious use.
Severity is rising
The study also documents a concerning increase in severity. Nearly 45% of vulnerabilities were classed as high severity and about 16% as critical. By contrast, an earlier study had reported only 5% of issues in the critical category.
A vulnerability represents an opportunity, not evidence of widespread exploitation. Still, more high‑severity flaws increase the potential for serious outcomes.
Supply‑chain problems and development practices
Researchers found many issues rooted in third‑party libraries that automotive developers include in their software. Flaws in these components can be introduced long before a vehicle leaves the factory.
The authors draw a clear implication for manufacturers: security must be integrated throughout development, rather than added later. Isolating entertainment and communication systems from safety‑critical controls is a practical step to reduce risk.
Practical steps for drivers
The study’s advice for vehicle owners echoes standard cybersecurity guidance: keep software updated, use strong passwords and limit the personal information you share with connected services.
Your car already collects sensitive data. The researchers warn there is no reason to make that information easy for others to access.
The research appears in Software Quality Journal. Source: TechXplore.
