A cybersecurity researcher has remotely hacked a BYD Shark 6 plug-in hybrid ute, demonstrating the ability to kill headlights, lock doors, blast music, control windscreen wipers and track the vehicle’s location in real time, in an investigation conducted for the ABC’s Four Corners program that raises serious questions about the security and surveillance risks posed by Chinese-manufactured connected vehicles. Dan from Fortify Labs spent two weeks analysing the vehicle before conducting a live demonstration on a country road outside Canberra, describing the experience as easier than expected and expressing concern at how open the Shark was to outside intrusion. The most alarming finding was that a key access point into the vehicle’s digital systems had no password protection at all, allowing Dan to work through the software controlling various vehicle functions without needing to defeat any meaningful authentication barrier. While he was unable to access more critical systems such as brakes and cameras, which he described as well protected, the level of control he did obtain over a vehicle in motion was sufficient to create serious distraction and danger, particularly at higher speeds or on more demanding roads.
The surveillance dimension of the investigation proved equally troubling. In a separate demonstration, Dan remotely activated the vehicle’s microphone while the journalist drove through central Canberra and conducted a phone call with his mother discussing internet banking details including a temporary password constructed from personal information. Dan recorded the entire conversation from his lab without any indication to the occupant that the microphone had been activated. He also tracked the vehicle’s precise location in real time throughout the drive. The demonstration illustrated how the array of cameras, microphones and sensors standard in modern connected vehicles, particularly electric and hybrid models, can function as a comprehensive surveillance platform if accessed by an unauthorised party or, as security experts warn, by the manufacturer or a government able to compel the manufacturer’s cooperation under national security laws.
The findings carry particular weight in the Australian context. Chinese brands now account for more than half of the electric and hybrid vehicles being sold in Australia, with EVs and plug-ins making up almost a third of all new car sales so far this year. BYD is China’s dominant EV brand and its vehicles are in widespread use. ASIO has previously warned ministers and public servants against having sensitive conversations in their cars or connecting work devices, but no blanket ban on Chinese EVs exists for Australian government or defence personnel, in contrast to the United Kingdom where the military has prohibited Chinese EVs and vehicles with Chinese components from parking within three kilometres of sensitive sites. China itself has banned foreign EVs from military installations and political enclaves.