AUTONEWS

Your car’s weakest spot may not be in the car
Modern cars are constantly connected to the outside world. This makes them vulnerable to hackers who want to take control of the vehicle remotely. Researchers at the University of Gothenburg and Chalmers University of Technology have found that IT vulnerabilities have shifted from the car’s own computer systems to apps and cloud services connected to it.
A car is a computer on wheels. It communicates with the car manufacturer’s cloud services, the driver’s phone and charging stations, and when children stream films in the back seat, data travels over the internet. All these connections can become entry points for hackers into the car. Researchers at the University of Gothenburg and Chalmers University of Technology studied 413 reported security vulnerabilities in automotive software between 2022 and 2024 and compared them with the previous decade.
“Ten years ago, most vulnerabilities were found in the cars’ own systems. Now the share found in apps, websites and cloud services has nearly tripled. These systems hold data about where you live, where you drive and when, so the risk is not only that someone could interfere with the car, but that they could get hold of information about your life,” says Srijita Basu, postdoctoral researcher in software engineering at the University of Gothenburg and Chalmers University of Technology.
Driver data in cloud services...A reported IT vulnerability does not mean that a breach has occurred, only that there is a risk of one. In December 2024, it was revealed that data from around 800,000 electric cars from Volkswagen, Audi, Seat and Skoda had been openly accessible on the internet for several months. The data contained precise GPS information and the email addresses, telephone numbers and home addresses of the owners of the cars. This meant that it was possible to see exactly where and when a particular car had been driven. The vulnerability was in the cloud service used by the car manufacturer to upload data from vehicles on the road. The data leak was uncovered by an ethical hacker group after a tip from a whistleblower and was widely reported in the media. The leak was fixed before it was known to have been misused.
“When we compare with the previous decade, we can see that IT vulnerabilities are now most commonly found in apps, websites and cloud services, and that the risks are more often rated as serious and critical. We are surprised by how basic some of the weaknesses in these systems are. They can involve passwords that have not been changed since installation. Hackers can use tried-and-tested old tricks to gain access through a back door,” says Srijita Basu.
Took control of the accelerator and brakes...The car’s audio and media system, commonly known as the infotainment system, is a weak point. Anyone connected to the car’s Wi-Fi network could potentially gain access to the car’s other systems as well if they are not properly separated.
This happened in a test conducted by security researchers to a Jeep Cherokee in 2015. Through the car’s media system, they were able to gain access to other systems in the vehicle and take control of steering, brakes and the accelerator. The new study shows that similar weaknesses still appear nearly a decade later.
“My advice to car manufacturers is to keep systems that control the vehicle strictly separated from infotainment and other connected systems, with strong security around them. They should also learn from the web and IT world, where many of these flaws have been known for years. When the car is constantly connected to the outside world, it also invites the outside world into the car,” says Srijita Basu.
Differences between computer chips...In their review of reported vulnerabilities, the researchers analysed where each vulnerability had originated. Was it in the design of the IT function, in the programming or in the software running on the car’s computer chips? The researchers found that chip manufacturers vary in how well they protect their products against attacks and in how openly they report security flaws. Computer chips from the same manufacturer are often used by several car makers. This means that hackers who have found a back door into the IT system of one car model may be able to use the same method on other cars as well.
“Car owners also have a responsibility to make things more difficult for hackers. It is important to update the software as soon as the car prompts you to do so, and strong passwords are still important. Today we share a lot of personal information with AI assistants for cars, for example when we ask to plan a long journey in an electric car. Like other AI systems, these assistants can be tricked into revealing information they have been given, so it matters what we share with them and what car makers allow them to access,” says Srijita Basu.
The weakest point of your car may not lie within the vehicle itself, but rather in the apps, websites, and cloud services connected to it. A study published in October 2026 by researchers from the University of Gothenburg and Chalmers University of Technology revealed that the proportion of security vulnerabilities found in connected external systems—such as automakers' cloud platforms and drivers' mobile phones—has nearly tripled compared to the previous decade.
Today, cars essentially function as "computers on wheels." This means that security flaws located outside the vehicle's physical chassis create direct pathways for cyberattacks.
A car’s weakest spot may not be physical or mechanical because modern vehicles are increasingly connected computers on wheels.
Research shows that the most vulnerable entry points are often outside the physical vehicle itself, located in:
• Cloud services and apps: Car manufacturers store massive amounts of data and connect vehicles to external servers, apps, and websites. Security flaws in these cloud platforms or companion mobile apps can expose personal data, location tracking history, or remote vehicle controls.
• The infotainment system and Wi-Fi: A car's media and entertainment console is often tied directly into internal communication networks (like CAN buses). If the infotainment system lacks strict digital separation, hackers or local intruders connected to the car's Wi-Fi or Bluetooth can potentially bridge into critical systems like the brakes, steering, or accelerator.
• Third-party supply chains (Computer Chips): Many carmakers use identical computer processors and software components sourced from external third-party chip manufacturers. A single software vulnerability or "back door" discovered in a chip model can affect multiple vehicle brands and models simultaneously.
🌐 The shift in automotive vulnerabilities...Previously, most security flaws resided within the internal physical systems of the vehicles themselves. The current landscape shows a drastic transition driven by constant connectivity:
• Infotainment Systems: Multimedia hubs and integrated Wi-Fi networks remain major entry points. If these systems are not properly isolated from critical vehicle controls, hackers could move from the multimedia interface to gain physical control over the brakes, accelerator, and steering.
• Cloud Data Leaks: The risk is real and involves the exposure of sensitive information. For instance, a case brought to light in December 2024 revealed that GPS location data, addresses, and phone numbers associated with approximately 800,000 electric vehicles remained openly accessible on the internet for months due to a flaw in an automaker's cloud infrastructure.
• Shared Chip-Related Threats: Since different automakers often source computer chips from the same suppliers, a vulnerability discovered in the IT system of one specific model could be exploited by hackers to compromise vehicles from entirely different brands.
🛠️ How to mitigate risks (driver responsibility)...While manufacturers must design a rigid separation between entertainment systems and vehicle control systems, researchers emphasize that car owners also play a crucial role in protection:
1. Prompt Updates: Install software updates as soon as the car’s dashboard or the manufacturer’s app prompts you to do so. These often fix serious security vulnerabilities.
2. Caution with AI Assistants: Avoid sharing overly personal information or passwords with in-car voice assistants. Like other AI systems, they can be manipulated to reveal data that was previously provided.
3. Strong Credentials: Use complex and robust passwords for any apps associated with your vehicle.
University of Gothenburg and Chalmers University of Technology
I need your help to continue doing this work (use the QR code above); thank you very much.













