Car Hacking: Fewer Software Flaws, but Attacks Shift to Apps and Cloud

Researchers at the University of Gothenburg and Chalmers University of Technology have documented 413 software vulnerabilities in cars for the years 2022 to 2024. That looks like a lot, yet an earlier analysis counted 363 flaws in 2019 alone. The number of known vulnerabilities per year has therefore been falling since then. The authors say that is no reason to relax, because the nature of the weaknesses has changed.

Attack surface moves outside the vehicle

"Ten years ago, most vulnerabilities were found in the vehicle's own systems," says lead author Srijita Basu. "Today the share of weaknesses found in apps, websites and cloud services has almost tripled." Such back-end systems can expose a lot of personal data, including home address, workplace, hobbies or children's school. This happened at Volkswagen in 2024, according to the study.

Infotainment is supposed to be strictly separated from safety-critical functions such as ABS, ESP and driver assistance. That is not always the case. In 2015, researchers remotely controlled the brakes, accelerator and door locks of a Jeep Cherokee via its infotainment system. The paper argues the industry has not learned enough since: infotainment and telematics systems, traditionally seen as non-critical, often serve as a bridge to more sensitive in-vehicle networks. Most flaws trace back to third-party software.

Basu says the team was surprised how basic some problems are, for example passwords that were never changed after installation. The most vulnerable product was the open-source tool Grafana, and the most common attack methods were SQL injection and cross-site scripting.

Why it matters

The more cars connect to their surroundings, for instance by streaming video or communicating with charging stations, the larger the attack surface becomes. And the more drivers rely on assistance systems, the more serious a successful attack could be. Better encryption alone would not close the gaps. A deeper issue is missing authorization checks: users log in, but the system often does not verify whether that person may access the requested vehicle and trigger the requested function.

Basu advises carmakers to learn from the web and IT world, where many of these flaws have been known for years. Drivers should use strong passwords and install software updates regularly.