Hundreds of Software Vulnerabilities Found in Connected Cars Could Allow Remote Hacking

Scientists have identified hundreds of previously unreported software vulnerabilities in internet-connected cars, creating potential pathways for hackers to access personal data and even compromise vehicle control systems like brakes and steering.

Researchers from the University of Gothenburg analyzed the US National Vulnerabilities Database between January 2022 and September 2023. Their analysis revealed 413 documented weaknesses affecting modern vehicles that rely on internet connectivity. The study, published in the Software Quality Journal, warns that exploiting these vulnerabilities could lead to hackers compromising essential vehicle functions.

Dr. Srijita Basu, the lead author of the study, stated that cybersecurity experts are aware of the technical possibility of such attacks. She pointed to a 2015 incident where researchers exploited the infotainment system of a Jeep Cherokee to gain control of its steering and brakes, which resulted in a recall of 1.4 million vehicles.

"Modern cars contain several interconnected computer systems," Dr. Basu explained. "Some manage infotainment and communication, while others are responsible for safety-critical functions such as braking, steering and acceleration. If an attacker exploits a vulnerability in one system and can move from there into another system because security boundaries are inadequate, the consequences could be serious."

The researchers did not demonstrate the ability to control brakes or driving functions using the 413 vulnerabilities they analyzed. However, Dr. Basu emphasized that these vulnerabilities remain a significant concern, noting that their exploitability depends on factors like the attacker's access level and the vehicle's specific security architecture.

The shift in vulnerabilities reflects the increasing complexity of modern vehicles, which are no longer isolated systems. They now integrate with external applications, cloud computing platforms, mobile apps, and online services. The study found that external applications accounted for 36.2% of the identified weaknesses, while system-on-chip and embedded software, including GPS and keyless entry systems, comprised 23.5%.

An examination of open-source software libraries used in automotive development also revealed 827 vulnerable libraries. Comparing these findings to previous research indicates a trend: vulnerabilities have moved from being primarily within the car's embedded systems to its broader external digital ecosystem.

Furthermore, the proportion of vulnerabilities classified as 'critical' has more than tripled, rising from 5% in 2019 to 16% in 2023. The researchers noted a surprise in the prevalence of vulnerabilities traditionally associated with websites and online services, such as SQL injection, which could allow unauthorized access to vehicle data.

"What makes this particularly concerning is that these are well-known web security problems, yet they are now part of the automotive cybersecurity landscape," Dr. Basu said. "We also identified vulnerabilities involving privilege escalation and memory corruption, which can be particularly concerning in systems with access to sensitive vehicle functions."

While drivers can take steps to mitigate risks, such as promptly installing software updates, using strong passwords for connected accounts, and being cautious with linked mobile applications, Dr. Basu stressed that the primary responsibility lies with manufacturers. She argued that manufacturers need to integrate cybersecurity from the earliest design stages, rather than treating it as a final check.