Cybersecurity Vulnerabilities in Connected Vehicles

Modern cars are no longer mere mechanical machines; they are now “computers on wheels” heavily connected to networks and devices. From infotainment systems linked to smartphones, to on-board Wi-Fi hotspots and over-the-air software updates, vehicles today offer unprecedented connectivity and convenience. However, this connectivity also exposes critical automotive systems – including the engine, brakes, and navigation – to potential cyberattacks. Hackers can exploit vulnerabilities in connected vehicles to remotely interfere with how a car operates, raising serious safety and privacy concerns. This article explores the risks of remote hacking and manipulation of connected cars, illustrating real-world cyberattacks, explaining the attack vectors used to infiltrate vehicles, and examining how industry and regulators are responding. Throughout, technical concepts are explained in accessible terms to highlight why bolstering vehicle cybersecurity is now an urgent priority.

Real-World Vehicle Cyberattacks and Consequences

Not long ago, the idea of someone remotely controlling a car from afar seemed like science fiction. Yet high-profile demonstrations by security researchers have proven it is possible – and potentially deadly. In one famous case, hackers remotely took over a Jeep Cherokee traveling at highway speeds, exploiting a flaw in its internet-connected entertainment system. They were able to blast the radio, activate the windshield wipers, and ultimately cut the vehicle’s transmission – causing the Jeep to lose power on a busy highway. The hackers’ code allowed them to send commands through the Jeep’s infotainment unit to critical components as if they were the driver. In that controlled experiment, they showed they could affect everything from the engine and brakes to the steering – all from a laptop 10 miles away. This eye-opening stunt prompted a recall of 1.4 million vehicles for a security patch and even inspired proposed legislation on automotive cybersecurity at the time. It also drove home the frightening consequences: if a malicious actor can disable your engine or brakes on the road, the result could be catastrophic accidents or loss of life.

Fortunately, most documented car hacks have been carried out by ethical researchers rather than criminals. However, they reveal what determined attackers could do. For example, in 2022 a team of researchers uncovered vulnerabilities affecting 16 major automakers, allowing remote access to vehicle functions via the manufacturers’ online services. In one instance, a simple bug in a carmaker’s web portal allowed the researchers to track vehicles’ locations, unlock doors, and even start engines without permission. By exploiting a flaw in the Kia Motors website, the team could reroute control of a car’s connected features from the owner’s phone to their own app – letting them locate a car by its license plate number, then unlock it or start the ignition remotely. While this particular hack did not give access to steering or braking systems, the ability to remotely start engines and unlock cars at will posed obvious safety risks and privacy invasions. As one researcher noted, such access could enable stalking or theft – for instance, a hacker could surreptitiously track a target’s car and unlock it to steal belongings. These findings were part of a broader wave of web-based car vulnerabilities found in recent years, affecting millions of vehicles across brands.

Even more alarming, the newest research shows hackers can go beyond unlocking doors – they can command the car’s physical controls. In April 2025, security experts demonstrated a remote compromise of a 2020 Nissan Leaf electric car that effectively turned it into a “remote-controlled” vehicle. By first exploiting a weakness in the Leaf’s Bluetooth connection, the attackers penetrated the car’s internal network and then established a stealthy control channel over the cellular network. With this foothold, they could spy on the driver – tracking the Leaf’s GPS location, capturing screenshots of the dashboard display, even listening in on conversations through the car’s mic. Worse, they managed to take control of critical functions: operating the windshield wipers, locks, horn, lights, and manipulating the steering wheel while the car was moving. In effect, the hackers could have caused the vehicle to turn or veer off the road remotely. This chilling proof-of-concept, disclosed at a Black Hat security conference, underscores that attacks on connected cars are not just theoretical. If malicious hackers gained similar access, they could potentially disable brakes, kill the engine, or steer a vehicle into danger – with passengers powerless to stop it. The potential consequences of such breaches range from stolen vehicles and personal data to multi-vehicle accidents or intentional misuse of cars as weapons. These real-world examples make clear that connected cars, if left insecure, pose a new kind of cyber-physical threat on the road.

How Hackers Exploit Connected Cars: Key Attack Vectors

How exactly do attackers break into a car’s systems from miles away? The answer lies in the many wireless interfaces and digital channels that modern vehicles rely on. Every point of connectivity – whether a cellular telematics unit, Wi-Fi or Bluetooth link, dedicated short-range communications (V2X), or even a smartphone app connected to the car – doubles as an attack surface that hackers can target. One major pathway is through cars’ telematics or infotainment systems, which are essentially on-board computers connected to the internet. In the Jeep Cherokee attack, for instance, the researchers targeted “Uconnect,” a built-in cellular system that enabled features like navigation, phone calls, and a Wi-Fi hotspot. A flaw in the Uconnect software allowed them to remotely scan for a vehicle’s IP address and gain entry via the cellular network. Once inside the infotainment unit, they were able to rewrite its firmware and send commands over the car’s internal communication network (the CAN bus) to devices like the engine control module and braking system. In essence, the hackers bridged the gap between the car’s external connectivity and its internal controls – a fundamental goal of many car cyberattacks.

Wireless interfaces such as Bluetooth and Wi-Fi present other avenues. The Nissan Leaf hack began with a Bluetooth vulnerability in the infotainment system. An attacker within wireless range (for example, in a parking lot) could exploit such a flaw to get a foothold, then plant malware or open a backdoor for remote control via the internet. Similarly, researchers have shown that insecure Wi-Fi hotspots or even malicious CDs/USB drives can introduce malware into vehicles, as some infotainment units will execute code from media. Another critical vector is the cars’ companion mobile apps and cloud APIs. Many automakers allow drivers to start their car, unlock doors, or check vehicle status through a smartphone app which communicates with cloud servers. If the cloud backend or API has a security hole (as in the Kia case), hackers can manipulate those commands. The Kia vulnerability was essentially a web application bug – the hackers found they could send commands to Kia’s server pretending to be authorized dealers, reassigning vehicles to themselves. Through that they gained remote control of connected features, all by exploiting poorly secured web systems rather than the car’s onboard software itself.

Beyond these, sensor systems and navigation signals can be attacked in more subtle ways. For instance, vehicles rely on GPS signals for navigation and features like route guidance or even advanced driver assistance. But GPS signals are relatively weak and unencrypted, which makes them susceptible to spoofing. An attacker can use a specialized radio transmitter to send false GPS signals that a car’s navigation system might accept as legitimate. This could result in the vehicle’s navigation system showing the wrong location or directions. Researchers note that conventional GPS is vulnerable to spoofing attacks, and protecting navigation systems from such manipulation is critical. In one demonstration, GPS spoofers fooled a luxury car’s navigation into thinking it was at a different location, potentially misdirecting the driver or an autonomous system. Other sensors in semi-autonomous cars – radar, cameras, LiDAR – have likewise been shown to be tricked or blinded (for example, shining lasers to blind a car’s camera, or jamming radar signals). While these “sensor attacks” differ from hacking the car’s software, they represent another way to manipulate a vehicle’s behavior (for example, making a car’s safety system think an obstacle is present or absent when it’s not).

Another weak point is the over-the-air (OTA) software update process itself. OTA updates are extremely useful for manufacturers to patch bugs and add features remotely, but if not properly secured they can be hijacked. A hacker who manages to spoof the update server or deliver a fake software update could install malicious code in the vehicle. This is why modern OTA systems employ encryption and digital signatures to authenticate updates – any lapse in these protections could open the door to an attacker gaining persistent control through a bogus “update.” In summary, the attack vectors in connected cars include: vulnerable cellular and Wi-Fi modules, Bluetooth exploits, compromised mobile apps or cloud services, malicious USB/OTA updates, and even attacks on the sensor inputs that vehicles trust. Once attackers breach the “cyber” perimeter and access the car’s internal networks, they can attempt to send rogue commands to electronic control units (ECUs) that manage the engine, braking, steering, etc. Many in-vehicle networks lack strong authentication for commands, meaning if a hacker can talk on the CAN bus, the car’s components may obey those commands blindly. This underlines the importance of securing both the entry points and the internal networks of connected cars.

Strengthening Vehicle Cybersecurity: Industry Responses and Best Practices

The growing realization of automotive cyber risks has spurred action from car manufacturers, technology suppliers, and governments. The automotive industry is now moving toward a “security by design” approach – embedding cybersecurity at every stage from vehicle development to production and beyond. For instance, after the Jeep Cherokee incident, Fiat Chrysler issued patches and even recalled vehicles to update software, and manufacturers began isolating critical systems. It’s becoming standard to place firewalls or gateways between infotainment units and safety-critical CAN bus networks, so that a breach in the radio or telematics system cannot directly inject messages to the brakes or engine. Companies like Tesla have implemented cryptographic signing for software updates and firmware, ensuring that only authenticated code can run on the vehicle’s ECUs. This makes it far harder for a hacker to install malware or altered firmware. Likewise, internal network segmentation and authentication are being explored: essentially, requiring ECUs to validate that a command truly comes from an authorized source before acting. If critical modules no longer “trust” any message they receive on the bus without credentials, an attacker’s injected commands would be ignored. Automakers are also investing in intrusion detection systems tailored for vehicles – these monitor the CAN bus and other networks for unusual patterns or unauthorized commands, and could alert the driver or shut down certain functions if a cyberattack is suspected.

In addition to technical measures, the industry has embraced greater collaboration on security. Information sharing is key: in 2015, major automakers jointly established the Auto-ISAC (Automotive Information Sharing and Analysis Center) to confidentially exchange information about threats and vulnerabilities. This means if one company discovers a new attack method, others can be warned to check their own systems. Best practices are also being codified. The U.S. National Highway Traffic Safety Administration (NHTSA) has published cybersecurity best-practice guidelines for modern vehicles, urging a “layered approach” to defense. This approach recommends securing all potential entry points (both wireless and wired) and building multiple overlapping security layers so that no single failure leads to total compromise. Concretely, NHTSA suggests manufacturers prioritize protecting safety-critical systems, implement rapid incident detection and response capabilities, design systems to be resilient and recoverable if a breach occurs, and share threat intelligence across the industry. These principles aim to reduce the chance of a successful attack and limit the impact if one does happen. Automakers have also launched bug bounty programs in some cases, inviting independent researchers to report vulnerabilities so they can be fixed before criminals exploit them.

Regulators worldwide are now stepping in to enforce minimum cybersecurity standards for vehicles. In Europe and many other markets, a landmark UN regulation (WP.29 UN R155) requires that new vehicles from 2024 onward are built under an approved Cybersecurity Management System (CSMS). In practice, this means automakers must demonstrate how they manage cyber risks in design, how they secure vehicles on the road, and how they will update and respond to new threats throughout the car’s life. Alongside it, a companion regulation (UN R156) mandates secure Software Update Management Systems, ensuring that OTA updates are done safely and cannot be tampered with. Failure to meet these could prevent a manufacturer from selling cars in those jurisdictions. In the United States, while there isn’t yet a binding federal vehicle cybersecurity law, NHTSA’s guidance and the threat of liability are pushing companies in the right direction. Industry standards like ISO/SAE 21434 (published in 2021) provide an engineering framework for building cybersecurity into the vehicle lifecycle, from initial design risk assessment to testing and incident response. Following such standards helps manufacturers systematically harden their vehicles against attacks. Additionally, data privacy laws (like GDPR in Europe) compel automakers to safeguard the troves of personal data that connected cars generate, adding another incentive to secure their systems against breaches.

For the everyday driver, many of these protections operate behind the scenes. Still, there are best practices that owners and operators of connected vehicles should keep in mind. First, it’s critical to keep the vehicle’s software up to date. When the manufacturer issues a recall or software update (whether via a dealer or over-the-air), applying it promptly ensures known vulnerabilities are patched. Treat your car’s software like you would a smartphone or PC – running outdated software can leave you exposed. Also, be mindful of what you connect to your car. Avoid plugging in unknown USB drives or devices into the car’s ports, and be cautious with aftermarket devices that connect to the OBD-II diagnostic port, since these could introduce malware or create new vulnerabilities. Use official mobile apps provided by the manufacturer rather than third-party apps that claim to interface with your car, and keep those apps updated as well (as they are part of the overall system). Finally, if your car allows it, consider disabling features you don’t use – for example, if you never use the Wi-Fi hotspot or Bluetooth, turning them off can reduce your attack surface. Good cyber hygiene, combined with the robust measures being implemented by automakers, will collectively improve security. Yet, even with all precautions, one should remain aware that no system is 100% invulnerable – which is why ongoing vigilance and improvements in vehicle cybersecurity are so important.

Securing the Road Ahead

Connected vehicles undoubtedly offer tremendous benefits – from real-time navigation and safety assists to remote convenience features – but they also introduce cybersecurity risks that were unheard of in the automotive world just a decade ago. The ability for hackers to remotely interfere with a car’s engine, brakes, or steering is not just a theoretical threat; security researchers have shown it can be done, and malicious actors could attempt to replicate these feats for nefarious purposes. The stakes are incredibly high: a successful cyberattack on a vehicle could endanger lives, undermine consumer trust, and disrupt transportation systems. The auto industry, together with regulators and cybersecurity experts, is racing to fortify cars against these threats by redesigning system architectures, patching vulnerabilities, and establishing rigorous security processes. Progress is being made – new models are emerging with security built-in from the ground up and regulations are driving accountability. However, as cars become even more software-driven (and ultimately autonomous), the challenge of securing them will only grow. Vigilance and proactive defense must continue at every level, from the manufacturers down to individual owners. By recognizing the vulnerabilities in connected vehicles and taking action – through better design, strong standards, and user awareness – we can enjoy the conveniences of modern cars while keeping the risks at an acceptable minimum. The road to fully secure connected cars is long, but it’s a journey that the industry cannot afford to take lightly, as the safety of drivers and the public depends on getting cybersecurity right.