cross-posted from: https://scribe.disroot.org/post/11438860
Here is the podcast about this investigation.
On a narrow country road outside Canberra, I’m driving a BYD Shark 6, the hybrid ute loved by tradies and even a cabinet minister.
But while I’m at the wheel, I’m not the only one in control; a hacker has access to the car.
As the 2.6 tonne ute rounds a bend, he gets to work.
…
With the stroke of a key, he kills the headlights, plunging me into darkness.
The attack is not a total surprise. The Shark has spent the past two weeks with Dan Hreszczuk, a cybersecurity expert who specialises in cars.
His task was to hack the vehicle and find out what could be seen and done remotely by the Shark’s Chinese manufacturer.
“It was easier than we were expecting,” Hreszczuk says.
…
EVs, with all their sensors, cameras and microphones, hoover up and spit out vast amounts of data. Experts say that data poses a greater risk in the hands of Chinese EV makers because they can be compelled by the country’s national security laws to co-operate with authorities.
…
Hreszczuk, the co-founder of Fortify Labs in Canberra, was stunned by the BYD Shark’s lack of cybersecurity.
“The access we took advantage of didn’t even have a password,” he says.
“It’s a little bit scary how open … the BYD Shark is to a hacker.”
…
While sabotage is one worry, the concern most often cited is surveillance due to the array of cameras and microphones on an EV.
Last year, the UK military banned Chinese EVs, even those made with Chinese components, from parking within 3 kilometres of some of its most sensitive locations.
China itself has previously banned foreign EVs from military sites and political enclaves, aware of their surveillance potential.
…
In Australia, there’s no blanket ban on Chinese marques by Defence, but ASIO has warned ministers and public servants not to have sensitive conversations in their cars or connect work devices.
…
When I pull into a service station and leave my phone unlocked in the car, Hreszczuk seizes his opportunity.
He’s done a simple audio edit, stitching together me saying “Hey Siri” and his voice asking a few questions to get the personal details he needs.
…
Using the car’s speaker system, Hreszczuk plays the voice command from his computer into the car.
“Hey, Siri, what is my home address?” the edited audio asks.
Siri replies, without questioning why I don’t know where I live.
Hreszczuk repeats this process and quickly extracts my date of birth and age.
Within minutes, he’s obtained the internet banking password.
…
Alastair MacGibbon, Australia’s former national cyber security adviser, says there needs to be greater protections for the data collected by all connected cars, and clearer rules about what data can be sent overseas.
MacGibbon says a cabinet minister should not be able to own a Chinese EV.
“China has always shown its strong desire to steal things, to surveil,” he says.
"No-one should be in any doubt that [Chinese EVs] are used in the same manner.
…
The original tesla network had zero encryption when they were tying to pitch their cars to the military. These.companies have no idea how to operate in the real world
Or jeep where you could kill it remotely with no physical access
https://www.wired.com/2015/07/hackers-remotely-kill-jeep-highway/
Oh! This might be good news! When are we getting a car distro of Linux?
OK, now try to hack a Slate truck
Yeah all these big brother devices are riddled with security holes because they are absolute crap being pushed out as fast as possible. This is just “China scary” horseshit. US, and European cars spy on everything, and aren’t particularly difficult to hack either.
ooh, propaganda showing a foreign made product is bad and motivates law makers to protect local manufacturers! With all the listening and monitoring every other car brand does, I want to see how they hold up.
You need more valid reasons to hate… let me check my notes… ah yes, slave labour enjoyers, BYD? One of the worst satisfactory survey losers? That BYD?
Chinese sympathiser bot spotted. Please do tell me how everything we heard about China is western propaganda! I love that story.
We don’t have local manufacturing of cars, so all cars are foreign. If there is nothing to protect can it just be an investigation again instead?
Within minutes, he’s obtained the internet banking password.
Why the fuck would that information be available to a car? This makes no sense at all
If you say it in the car, and the car has a microphone, it’s available.
But why would you say a password out loud?
It’s not, he used the personal details obtained from the car to do a password reset
According to the article he recorded the driver sharing the internet banking password with his mother during a call. It’s just a sensationalized way to show he has access to the microphone.
Spotify and the like on a car, subscriptions to ‘features’ like heated seats (iirc just bmw for that) in car web browser, to name a few
Experts say that data poses a greater risk in the hands of Chinese EV makers because they can be compelled by the country’s national security laws to co-operate with authorities.
[Laughs nervously in Patriot Act]
How about these things just collect NO personal data? Maybe vague anonymous telemetrics about collective vehicle stats or something at the very most.
There needs to be a blanket ban and strict auditing on this mass hoovering of peoples’ personal lives by states and corporations.
Laughs nervously in Assistance and Access Act 2018 (Cth).
Australia has the exact fucking same laws, but China scary!
I fully agree. There must be no kill switches. But it is nevertheless clear that they pose a greater greater risk in the hands of Chinese EV makers as they can be compelled by the Chinese government to “co-operate.” China is well-known for all kinds of coercion.
So not worried about it if just an American company flaw?
https://www.wired.com/2015/07/hackers-remotely-kill-jeep-highway/
Tesla is every bit as concerning as BYD.
The US has the ability to compel companies just like China does.
Neither country is trustworthy and one is completely insane.
You have 16 upvotes with whataboutism while the other guy is negative. Fucking Lemmy.
Whataboutdeez nuts
Both are completely insane. But I agree with the rest of your comment.
I realize they can’t publish how they “hacked” the vehicle but without this part, the article feels a bit lacking. Can it be done by anyone? Only by someone with physical access? Other than that it’s not saying much more than what Mozilla had published about a bunch of cars, not just Chinese. And we already know other governments are also dangerous when it comes to this data.
As an addition: Remote ‘kill switches’ in Chinese buses have been found last year in the Netherlands, UK, Denmark, Norway, …
Here are some articles:
Kill switches: a new way of waging war
There is already evidence found of Chinese kill switches in devices like wind turbines, solar panels, and buses. These are pieces of hardware that allow the manufacturer to disable or disrupt the device. Are we surrounded by ticking time bombs?
American stuff also has kill switches. Everything is cloud connected and the US has coerced companies into cutting off the ICC.
It’s BYD… It’s a CCP (Communist) owned company. They block their country from the Internet, most Western apps like Google Tictok FB ect are banned, and they monitor all mobile communication. They even threaten your family if you’re studying abroad and post negative shit about Xi or the CCP.
Are you seriously that nieve to believe your Chinese EV isn’t tapped for easy listening?
You dare offend the glorious Chinese People Republic on Lemmy??? No wonder you’re getting downvoted.
Spoiler: they couldn’t hack into anything that affected driving the vehicle, but could access the microphone inside.
Couldn’t hack in during the allotted time.
Couldn’t break into the most safety-critical systems or potential surveillance features yet but that doesn’t mean they won’t or that the government whose citizens built the systems can’t. Still demonstrated significant risks.
There has to be a way to not have the thing online all the time surely?
Pull a fuse, unplug something whatever it takes ?
Here’s an easier step, don’t buy it. Just buy literally anything else not related to BYD, unfortunately that pool is shrinking fast because people keep buying byd…
It’ll have at least one eSIM, and pulling the fuse will probably disconnect the entertainment, air conditioning, and other systems managed by the console, and potentially make it impossible to start the car at all.
Best you can do is toggle off the access, but that’s just a software toggle, and even then there’s probably a secondary eSIM for the emergency responder system.
Only way to get a car that doesn’t connect to the internet is to buy an old one.
