_Sport_wagon_(2015-05-29)_01.jpg){kind=link}
The easiest way to hack a modern car may not go through the car at all. Swedish researchers counted 413 reported security flaws in car-related software from January 2022 to September 2024. Compared with the decade before, the share found in apps, websites and cloud services has nearly tripled.
The study comes from the University of Gothenburg and Chalmers University of Technology, which announced it on October 21. Its message for drivers is that car hacking is now as much about personal data as about steering. “These systems hold data about where you live, where you drive and when,” lead researcher Srijita Basu said in a Chalmers release.
What the 413 flaws show about car hacking
The paper ran this year in Software Quality Journal. Basu, a postdoctoral researcher in software engineering, wrote it with four colleagues, according to the university’s research record.
The team sorted the 413 flaws by where they sat and how serious they were. Companion apps, web portals and other external applications made up more than a third, New Atlas reported. Nearly 45% carried a high severity rating and 16% a critical one. In an earlier study, the critical share was about 5%.
The researchers also scanned 20 open-source automotive software projects. They found 827 vulnerable software libraries. Those are the reusable building blocks that developers pull in rather than write themselves. So a carmaker can write careful code and still ship someone else’s flaw.
The team has posted its list of vulnerabilities on GitHub for other researchers to check.
A reported flaw is a risk, not proof of an attack. The study doesn’t show that anyone exploited these 413 weaknesses. Nor does it show that any of them gives remote control of a car’s brakes or steering.
Old web tricks still work on new cars
“When the car is constantly connected to the outside world, it also invites the outside world into the car,” Basu said. What struck the team was how ordinary many of the ways in were. Basu said she was surprised by how basic some weaknesses are, such as passwords nobody changed after installation.
“Hackers can use tried-and-tested old tricks to gain access through a back door,” she said. Her advice to automakers is to learn from the web and IT world, where many of these flaws are years old.
Chips are another weak point. The researchers found that chipmakers vary in how well they protect their products. They also vary in how openly they report flaws. Several car brands often buy chips from the same supplier, so a method that works on one model may work on others.
The university pointed to a real cloud leak. In December 2024, data from about 800,000 electric cars from Volkswagen, Audi, Seat and Skoda sat openly online for months. It included GPS locations and owners’ contact details. The leak was fixed before anyone was known to have misused the data.
The Jeep hack that set the US precedent
Fear of hackers taking the wheel comes from a real test. In 2015, researchers Charlie Miller and Chris Valasek remotely took over a Jeep Cherokee through its Uconnect entertainment system. They changed its speed and worked its brakes, transmission and wipers, CBS News reported. The pair had first told the company about their research the previous October.
Fiat Chrysler then recalled about 1.4 million US vehicles with the same 8.4-inch touchscreen. The list included Ram pickups, Jeep Cherokees and Grand Cherokees, and Dodge Chargers. The National Highway Traffic Safety Administration opened an inquiry into the fix. “It sets an important precedent for how NHTSA and the industry will respond to cybersecurity vulnerabilities,” the agency said.
The Swedish team says the same design mistake still turns up. If the infotainment system isn’t walled off, anyone on the car’s Wi-Fi could reach other systems too, the Chalmers release says.
Washington already polices some car software
The federal government now treats connected-car code as a national security issue. In January 2025, the Commerce Department’s Bureau of Industry and Security finalized a rule on Chinese- and Russian-linked car technology. It bans certain software from those countries in cars sold in the US.
The agency said such technology “could allow our foreign adversaries to extract sensitive data.” It also warned of remote control of vehicles. The software ban starts with model year 2027, and hardware rules follow with model year 2030. It covers passenger vehicles under 10,001 pounds. It also bars carmakers tied to China or Russia from selling connected cars here, even ones built in the US.
That rule is about who writes the code. The Gothenburg study points at a different problem. Its flaws sit in apps, cloud services and shared parts, wherever they come from. They look like the everyday bugs that keep turning up in home Wi-Fi routers.
What drivers can do now
As with the “Black October” incidents, most of the fixing falls to companies, not owners. Drivers can still make an attacker’s job harder. Basu’s advice is to install software updates as soon as the car prompts you, and to keep using strong passwords.
In practice, treat the car’s app account like a bank login. Give it a unique password, and turn on two-step sign-in if the app offers it. Install updates when the car or the app asks, including the ones that arrive over the air.
Be careful with in-car AI assistants, too. Drivers share trip plans and personal details with them. “Like other AI systems, these assistants can be tricked into revealing information they have been given,” Basu said. What drivers share with them, and what carmakers let them reach, both matter.
For automakers, Basu’s fix is structural. She wants the systems that control the vehicle kept “strictly separated from infotainment and other connected systems.” The next US checkpoint is model year 2027, the first year the Commerce Department’s software ban applies.