Could a car’s entertainment system provide a route to its brakes?
In 2015, security researchers demonstrated that possibility in a Jeep Cherokee. They remotely accessed its infotainment system, which runs in-car entertainment, and interfered with driving functions.
Fiat Chrysler subsequently announced a recall covering approximately 1.4 million vehicles across the US to install a software update that fixed the flaw.
That attack targeted a system built into the car. A recent study examines a wider network, including the apps and online services connected to vehicles.
Researchers at Sweden’s University of Gothenburg and Chalmers University of Technology analyzed 413 previously reported automotive software vulnerabilities. External applications accounted for the largest share, at 36.2 percent.
Their study, published in Software Quality Journal, also identified a shift toward externally connected software compared with earlier research.
“The striking point is that technologies widely used in ordinary online services are now part of the automotive security landscape,” software engineering researcher Srijita Basu, who works at both institutions, told ScienceAlert.
The wider network includes mobile and web applications and cloud services, which store or process data on remote computers.
Apps and cloud services linked to a car can store data on where it travels and how it is used, and sometimes data on its owner, Basu explained. Poor security could allow outsiders to access that data.
The consequences can also depend on connections within the vehicle. Basu noted that its entertainment and telematics systems, the software that logs and transmits data about how the car is running, can exchange data with other vehicle components.
“If a vulnerability is exploited and security boundaries between these systems and safety-critical functions are insufficient, an attacker may potentially progress beyond the initial component,” Basu cautioned.
To investigate where weaknesses were concentrated, the researchers collected automotive-related records covering January 2022 through September 2024 from the US National Vulnerability Database, cross-checking additional security sources.
The flaws were categorized by the software affected, severity, and where they originated during software development.
They compared their findings with research covering 2010–2019. Applying the earlier study’s method to the newer records also showed an increased share involving external software.
The team examined another way flaws can enter automotive software, through ready-made code components called libraries. Developers use these components to perform tasks without writing every function themselves.
Using five scanning tools, the researchers examined 20 open-source projects used in automotive software or its development. This separate investigation identified 827 vulnerable libraries.
The paper also identified libraries shared across projects. A weakness in one widely used component could therefore affect multiple systems.
Basu suggested manufacturers should know which components go into their software, regularly scan libraries obtained from other developers, watch for newly reported flaws, and have a plan for applying fixes.
The analysis found the largest group of vulnerabilities was linked to the stage when code is written. The next largest group was associated with design.
Security, Basu said, “should be built in from the beginning and tested throughout a vehicle’s lifetime.”
Her recommendations include separating driving systems from entertainment and externally connected components, so a breach in one of them does not automatically reach driving functions.
Basu emphasized that the findings do not mean every reported flaw is remotely exploitable or provides access to driving controls. The research also can’t establish what share of cars could be hacked.
Only 17 automotive-relevant vulnerabilities from the study period appeared in the US cybersecurity agency’s catalog of flaws known to have been exploited, and most in the dataset didn’t show up in the exploitation sources the team checked.
The paper also notes that the 20 scanned projects may not represent the entire industry.
For owners, Basu recommended keeping software current, choosing strong passwords used only for connected-car accounts, securing linked phone apps, and checking which services have permission to access location and personal details.
“However, the main responsibility for preventing and containing software vulnerabilities rests with manufacturers and their suppliers,” Basu added.
The research has been published in Software Quality Journal.
This article was fact-checked by Rebecca Dyer and edited by Rebecca Dyer. While we pride ourselves on our process, we are only human. If you spot a mistake, please let us know.
