Here is the podcast about this investigation.
On a narrow country road outside Canberra, I'm driving a BYD Shark 6, the hybrid ute loved by tradies and even a cabinet minister.
But while I'm at the wheel, I'm not the only one in control; a hacker has access to the car.
As the 2.6 tonne ute rounds a bend, he gets to work.
...
With the stroke of a key, he kills the headlights, plunging me into darkness.
The attack is not a total surprise. The Shark has spent the past two weeks with Dan Hreszczuk, a cybersecurity expert who specialises in cars.
His task was to hack the vehicle and find out what could be seen and done remotely by the Shark's Chinese manufacturer.
"It was easier than we were expecting," Hreszczuk says.
...
EVs, with all their sensors, cameras and microphones, hoover up and spit out vast amounts of data. Experts say that data poses a greater risk in the hands of Chinese EV makers because they can be compelled by the country's national security laws to co-operate with authorities.
...
Hreszczuk, the co-founder of Fortify Labs in Canberra, was stunned by the BYD Shark's lack of cybersecurity.
"The access we took advantage of didn't even have a password," he says.
"It's a little bit scary how open … the BYD Shark is to a hacker."
...
While sabotage is one worry, the concern most often cited is surveillance due to the array of cameras and microphones on an EV.
Last year, the UK military banned Chinese EVs, even those made with Chinese components, from parking within 3 kilometres of some of its most sensitive locations.
China itself has previously banned foreign EVs from military sites and political enclaves, aware of their surveillance potential.
...
In Australia, there's no blanket ban on Chinese marques by Defence, but ASIO has warned ministers and public servants not to have sensitive conversations in their cars or connect work devices.
...
When I pull into a service station and leave my phone unlocked in the car, Hreszczuk seizes his opportunity.
He's done a simple audio edit, stitching together me saying "Hey Siri" and his voice asking a few questions to get the personal details he needs.
...
Using the car's speaker system, Hreszczuk plays the voice command from his computer into the car.
"Hey, Siri, what is my home address?" the edited audio asks.
Siri replies, without questioning why I don't know where I live.
Hreszczuk repeats this process and quickly extracts my date of birth and age.
Within minutes, he's obtained the internet banking password.
...
Alastair MacGibbon, Australia's former national cyber security adviser, says there needs to be greater protections for the data collected by all connected cars, and clearer rules about what data can be sent overseas.
MacGibbon says a cabinet minister should not be able to own a Chinese EV.
"China has always shown its strong desire to steal things, to surveil," he says.
"No-one should be in any doubt that [Chinese EVs] are used in the same manner.
...
post
As an addition: Remote 'kill switches' in Chinese buses have been found last year in the Netherlands, UK, Denmark, Norway, ...
Here are some articles:
Kill switches: a new way of waging war
There is already evidence found of Chinese kill switches in devices like wind turbines, solar panels, and buses. These are pieces of hardware that allow the manufacturer to disable or disrupt the device. Are we surrounded by ticking time bombs?
Within minutes, he’s obtained the internet banking password.
Why the fuck would that information be available to a car? This makes no sense at all
Experts say that data poses a greater risk in the hands of Chinese EV makers because they can be compelled by the country's national security laws to co-operate with authorities.
[Laughs nervously in Patriot Act]
How about these things just collect NO personal data? Maybe vague anonymous telemetrics about collective vehicle stats or something at the very most.
There needs to be a blanket ban and strict auditing on this mass hoovering of peoples' personal lives by states and corporations.
Spoiler: they couldn’t hack into anything that affected driving the vehicle, but could access the microphone inside.
The original tesla network had zero encryption when they were tying to pitch their cars to the military. These.companies have no idea how to operate in the real world
I realize they can't publish how they "hacked" the vehicle but without this part, the article feels a bit lacking. Can it be done by anyone? Only by someone with physical access? Other than that it's not saying much more than what Mozilla had published about a bunch of cars, not just Chinese. And we already know other governments are also dangerous when it comes to this data.
Oh! This might be good news! When are we getting a car distro of Linux?
Yeah all these big brother devices are riddled with security holes because they are absolute crap being pushed out as fast as possible. This is just "China scary" horseshit. US, and European cars spy on everything, and aren't particularly difficult to hack either.
There has to be a way to not have the thing online all the time surely?
Pull a fuse, unplug something whatever it takes ?
ooh, propaganda showing a foreign made product is bad and motivates law makers to protect local manufacturers! With all the listening and monitoring every other car brand does, I want to see how they hold up.
As an addition: Remote 'kill switches' in Chinese buses have been found last year in the Netherlands, UK, Denmark, Norway, ...
Here are some articles:
Kill switches: a new way of waging war
There is already evidence found of Chinese kill switches in devices like wind turbines, solar panels, and buses. These are pieces of hardware that allow the manufacturer to disable or disrupt the device. Are we surrounded by ticking time bombs?
OK, now try to hack a Slate truck
This guy fancies himself as a script writer. That was painful to read and they need to get to the point.
It's BYD.... It's a CCP (Communist) owned company. They block their country from the Internet, most Western apps like Google Tictok FB ect are banned, and they monitor all mobile communication. They even threaten your family if you're studying abroad and post negative shit about Xi or the CCP.
Are you seriously that nieve to believe your Chinese EV isn't tapped for easy listening?
The real issue here is how BYD will react to this. Technical failure is not something to be ashamed of. Not acting on it to address it is.
good thing all other cars are safe from hacking
So it's just like any other new car?
I am not going to say this is a one country specific problem. However, we for sure need to start a much needed scrutiny regarding cars in general and privacy/security, and we need to start somewhere
At this point just get an e-bike or a normal bike if you have calories to burn.
I'd say this is by far the biggest issue with EVs. Well, not necessarily with EVs, but with new cars in general, most of which happen to be EVs, and their share will only continue growing.
Sure, it's a nice car, somewhat better for the environment, pretty cool. But it's also a giant surveillance device that gathers more information on you than your smartphone, smart tv, and computer combined.
And it has a kill switch, too. If the government being able to remotely shut down your car wasn't bad enough - this research shows that virtually any hacker may be able to do so as well.
"China has always shown its strong desire to steal things, to surveil," he says.
"No-one should be in any doubt that [Chinese EVs] are used in the same manner.
Just more sinophobic shit. All that vegemite rot all Aussie brains.
They had the car for two weeks, and the best they got was being able to remotely activate the windscreen wipers, and flash the lights and radio
I've never seen the abc do this with a tesla btw
It's probably similar with all these new "high tech" cars. Although I would like to know, it's a shame they only talked about it with one specific model from one specific brand.
They probably hoped people would infer it's the same with all Chinese cars, but for some reason not western cars.
Holden cars meanwhile remain hack-proof. Another win for the Australian auto industry.
;)
They are purposely building surveillance into all vehicles. I’m not sure the Chinese vehicles are going to be much worse.
I think this goes for most connected card. None of them specialize in security and software.
Ok, yes, not surprised. How can I learn to hack my own car? I have a number of changes I'm interested in making, e.g. I would like the music controls on the left 1/3 of the screen, and the map on the right 2/3s. It's currently the reverse. Simple stuff like that, to start.
Is this the reason they want to/are banning Chinese EVs in the US? Or is it just to protect profits? Or is it both?
So what, your own government sanctioned EVs will do the same data mining with shit security, applies to Australia, US and every other country too. Nobody is writing hit pieces on domestic spyware cars, just the affordable Chinese ones
As an addition: Remote 'kill switches' in Chinese buses have been found last year in the Netherlands, UK, Denmark, Norway, ...
Here are some articles:
Kill switches: a new way of waging war
There is already evidence found of Chinese kill switches in devices like wind turbines, solar panels, and buses. These are pieces of hardware that allow the manufacturer to disable or disrupt the device. Are we surrounded by ticking time bombs?
so they accessed the CAN bus from inside the car? sure, chinese cars spy on you and are easy to hack once you're given two weeks of full access inside the car, but so do western cars spy on you and are easily hacked with full access
everyone's bad and the solution is better privacy regulation and enforcement that companies can't weasel out of or plan into their budget.
lol shit skirts around how they got access. 100% some bullshit with full access to the physical computer exaggeration and more of the same electronics bullshit to sound scary to idiots too lazy to inquire. Such lazy journalism looking to create fear about an actual issue that has nothing to do with security at all.
Ok. I'm not questioning the artocle and such, but:
within minutes, he's obtained the interne bankong password.
Unless this was a simple combination of where he lives and his birthday, how?
if it had good crash test results, was smaller, and custom firmware was possible I would consider it anyway
Great! We might finally get some open source software on cars too.
As an addition: Remote 'kill switches' in Chinese buses have been found last year in the Netherlands, UK, Denmark, Norway, ...
Here are some articles:
Kill switches: a new way of waging war
There is already evidence found of Chinese kill switches in devices like wind turbines, solar panels, and buses. These are pieces of hardware that allow the manufacturer to disable or disrupt the device. Are we surrounded by ticking time bombs?
Do american, japanese or korean cars have software?
The Shark has spent the past two weeks with Dan Hreszczuk
I think you could do this to any car if you has physical access to its OBD2 port?
Alternate discussion on reddit.
Cybersecurity aside, wow is that an ugly wankpanzer in the image.
all 6 comments