Car Hacking Risks: Why Connected Cars Are Vulnerable

August 6, 2025 — One cybersecurity researcher, a laptop, and less time than a coffee run: that's all it took, according to a demonstration aired by Australia's ABC this week, to seize control of a BYD Shark 6 hybrid pickup. The researcher unlocked its doors, flashed the headlights, and took over the infotainment screen. The task, he said, was "easier than we were expecting." The demo rattled anyone already nervous about Chinese-built cars. But the bigger lesson for American drivers is simpler: these weaknesses are universal, and no badge is immune.

The Shark 6 is the messenger, not the problem

The Shark 6 isn't officially sold in the U.S., so it would be easy to wave this off as someone else's story. It isn't. The architecture exposed in the demo — dozens of onboard computers sharing data, a cellular connection that reaches straight back to the manufacturer, and an entertainment system sitting just a short jump away from safety-critical controls — is the same foundation under virtually every new car sold in America.

The ABC report also resurfaced a familiar worry: that BYD and other Chinese automakers may share sensitive data, including audio, video, and location information, with the Chinese government. Washington has already taken notice. In late 2024, the Commerce Department proposed rules to restrict Chinese and Russian connected-vehicle software and hardware over national-security concerns, and lawmakers have pushed to keep Chinese-made connected vehicles off U.S. roads entirely.

But data flows in two directions. The same connection that lets a car phone home can let an attacker phone in, whether the vehicle was built in Shenzhen, Stuttgart, or Detroit.

Every modern car is a network of computers

The family sedan has evolved from an analog machine into a distributed network on wheels. A typical vehicle now carries dozens of computers, each handling specific jobs: some manage entertainment and wireless connections, while others control braking, steering, engine output, sensors, and driver-assistance systems. These controllers talk to one another constantly, and the whole cluster talks to the outside world through Bluetooth, Wi-Fi, and a built-in SIM or eSIM that keeps the car permanently connected to the internet and the automaker's cloud.

Software now arrives the way it does on a smartphone — over the air, often overnight, with no trip to the dealership. That's convenient. It also means a compromise in the car's connectivity chain can ripple through the entire system, and a flaw in the update pipeline can reach thousands or millions of vehicles at once.

The weak links are everywhere

Security researchers have repeatedly pried open modern vehicles. Kaspersky recently documented a malware campaign targeting Android-based head units — the dashboard display that also controls some vehicle functions — distributed through what looked like a routine firmware-update mechanism. Other researchers have demonstrated multiple attack paths into cars running the widely used QNX operating system. A separate team bypassed anti-theft protections and used Bluetooth vulnerabilities to gain deep access to a Nissan Leaf's systems.

Meanwhile, testing of Tesla's Model 3 and Cybertruck has turned up weaknesses in the cellular-and-cloud chain that connects cars to their maker. Similar flaws, researchers note, very likely exist in other brands — they just haven't all been found, published, or patched yet.

Cars are a uniquely stubborn target. They're assembled from a long supply chain, some of which still ships legacy components never designed for permanent internet connectivity. And a car's usable life — 15 years or more — is far longer than the support window of most consumer tech. A vulnerability discovered today can linger in the field, unpatched, for a decade.

Why hackers want into your car

Some attacks are about the vehicle itself: stealing it, or the data inside it. But a compromised car can also turn into a keyhole into your life — home addresses, work routines, phone contacts, even garage-door opener signals can be synced or extracted.

Then there's the physical threat. If an attacker can reach the controllers that manage steering, brakes, or lighting, a digital intrusion stops being a data problem and becomes a safety defect. The FBI and automotive security researchers have repeatedly warned that remote compromise of safety-critical systems is no longer theoretical.

Connected-car features also have a darker domestic use. Trip histories, geolocation data, and app-controlled functions like locks, climate, and the horn have all been used by abusive partners to track, harass, and intimidate victims. Regulators and consumer advocates have flagged this repeatedly: a car is now a surveillance device that comes with a pink slip.

The U.S. regulatory gap

This is where the U.S. falls behind. The European Union and China require automakers to demonstrate how they will manage cybersecurity risk and protect software updates over a vehicle's entire lifetime. America, by contrast, relies mostly on voluntary commitments. NHTSA first published its "Cybersecurity Best Practices for Modern Vehicles" guidance in 2020 — and it remains guidance, not a binding rule.

There are signs of movement. NHTSA has signaled that cybersecurity defects creating an unreasonable safety risk can be addressed through the recall process, and it has encouraged automakers to maintain software bills of materials — essentially, an ingredient list for the code in every vehicle, so flaws can be traced and fixed. The industry's collective defense runs through the Automotive Information Sharing and Analysis Center, where competing manufacturers share threat data. That's useful, but it's voluntary, uneven, and largely invisible to consumers.

What U.S. buyers should actually check

You can't buy a new car in 2025 without taking on some cybersecurity and data-privacy exposure. But you can do a few things to shrink it.

Ask what the automaker does after the sale. Is there a public security-disclosure page? A way to report a vulnerability and get a real response? An automaker that answers quickly is usually an automaker that patches quickly.

Update everything, religiously. Over-the-air fixes are meaningless if software is outdated. Enable automatic updates in both the vehicle and the manufacturer's mobile app, then go through the app's privacy settings — many collect more than they actually need.

Treat your phone as a second key. The vehicle app controls locks, location, and remote start, so protect it the way you'd protect the car itself: strong screen lock, biometrics, and two-factor authentication on the account it's linked to.

If you're buying or selling used, do a full factory reset. Delete stored profiles, location history, phone pairings, garage-door settings, and home addresses from both the infotainment system and the cloud account — and make sure the previous owner's app access is revoked before the keys change hands.

Finally, stop treating country of origin as the whole debate. Chinese brands raise legitimate data-sovereignty questions, but a Korean, Japanese, German, or American car with poor security hygiene isn't automatically safer. The question isn't just where a car was made. It's how seriously the manufacturer — wherever it's headquartered — defends the computers underneath the hood.