I’d rather neither collect my data, but in this case it’s worse than that.

Hreszczuk runs Fortify Labs in Canberra and specialises in car security. His job was simple: find out what BYD, or anyone with access to BYD’s systems in China, could see and do to the vehicle remotely. He didn’t expect it to be quick.

“It was easier than we were expecting.” Hreszczuk says.

That wasn’t just an offhand comment. Hreszczuk makes a living finding ways to break into cars, so the fact that he was surprised by how easy it was is significant. Even he didn’t expect to get access so quickly or find so little standing in his way.

The entry point had no password at all. There was nothing protecting it. That one weakness gave Hreszczuk a way into the software that controls many of the car’s functions. After spending two weeks exploring the system and testing what he could do, he was ready to show the results in a real-world demonstration.
“Sitting by the side of the country road, he demonstrates what can be done with remote access to a vehicle. First, he locks the doors while I’m inside, blasts music over the speakers and plays images on the BYD’s giant infotainment screen.” reads the report published by ABC News. “Then, as I drive, he remotely switches the wipers on at top speed, sprays the windscreen with water and turns the lights on and off.”

While Four Corners reporter Angus Grigg was driving the BYD at about 30 km/h along a straight country road, Hreszczuk controlled parts of the vehicle from his laptop. He locked the doors remotely, turned up the music through the speakers and displayed random images on the infotainment screen. He then switched the windscreen wipers to their highest setting, sprayed the windscreen and repeatedly turned the headlights on and off. At the same time, a recorded voice played through the speakers, warning the driver to use low beam.

Then things became more serious. Hreszczuk switched the headlights off completely while Grigg was still driving the car in the dark.

He was not able to control everything. The brakes and cameras were protected by stronger security measures, so he could not access them. But the test still showed what could happen if someone gained remote access to a connected vehicle. Imagine the same attack taking place at 100 km/h, on a winding road at night, with the driver suddenly losing control of the lights and having the wipers running at full speed. The potential danger is obvious.

• https://securityaffairs.com/199460/hacking/a-byd-shark-6-hack-shows-the-risks-of-connected-cars.html