Connected-car vulnerabilities shift toward cloud services

A review of 413 reported automotive software vulnerabilities found that security weaknesses have shifted away from systems installed inside vehicles and toward the apps, websites and cloud services to which cars increasingly connect. Researchers at the University of Gothenburg and Chalmers University of Technology compared vulnerabilities reported between 2022 and 2024 with those documented during the previous decade. The share found in external software environments nearly tripled, while reported weaknesses were also more often rated serious or critical.

The finding describes the reported vulnerability landscape; it does not show that every weakness was exploited or that connected cars generally became less secure in a direct, fleet-wide measurement. Modern cars communicate with manufacturers’ cloud services, drivers’ phones and charging stations, and can provide internet access for passengers. Each connection can become a potential entry point for hackers.

The researchers’ comparison indicates that a security failure does not necessarily require physical access to a vehicle or a direct break into its onboard electronics. A weakness in an app, website or cloud service can affect a connected car and the information processed through that service. The study examined where reported vulnerabilities originated and whether the severity of the documented problems changed across the two periods.

The distinction between a vulnerability and an actual breach is central to interpreting the results. A reported IT vulnerability indicates a risk, not proof that an attack succeeded. In December 2024, it was revealed that data from around 800,000 electric cars from Volkswagen, Audi, Seat and Skoda had been openly accessible on the internet for several months.

The data included precise GPS information and the email addresses, telephone numbers and home addresses of owners, making it possible to see where and when a particular car had been driven. The vulnerability was in the cloud service used by the car manufacturer to upload data from vehicles on the road, not in the cars’ own computer systems. The incident was uncovered by an ethical hacker group after a tip from a whistleblower and was widely reported in the media.

The leak was fixed before it was known to have been misused. The case illustrates the type of exposure the study’s authors associated with the move toward connected services: the affected system held information about vehicle location and owner details, while the route to the information ran through an external cloud service. Instead, it documented reported weaknesses and their locations in the larger connected-car environment.

Basu said the comparison with the previous decade shows that IT vulnerabilities are now most commonly found in apps, websites and cloud services, and that the risks are more often rated serious and critical. She said the researchers were surprised by how basic some weaknesses in these systems were. They can involve passwords that have not been changed since installation, allowing hackers to use established techniques to gain access through a back door.

The cloud example shows why the location of a vulnerability matters: data from connected cars can be uploaded to services that hold extensive information about where owners live, where they drive and when they travel. The review also found that vulnerabilities continue to occur in the interfaces between infotainment systems and other vehicle systems. In a security test conducted in 2015, researchers used the audio and media system of a Jeep Cherokee to access other systems in the vehicle and take control of the steering, brakes and accelerator.

That earlier demonstration showed how a connection to the car’s infotainment system could provide a route to functions with physical consequences. The new study shows that similar weaknesses still appeared nearly a decade later. Infotainment systems are particularly important because they can connect otherwise separate parts of a vehicle.

Anyone connected to the car’s Wi-Fi network could potentially gain access to other onboard systems as well if they are not properly separated. The new analysis identifies improper separation and weak protection around connected systems as recurring concerns in the reported vulnerabilities. It also examines whether weaknesses arose in the design of an IT function, in programming, or in software running on the car’s computer chips.

The result is a view of automotive software security as a matter involving several layers of hardware and software, rather than a single controller inside the vehicle. The researchers found differences among chip manufacturers in how well they protect their products against attacks and how openly they report security flaws. Computer chips from the same manufacturer are often used by several car makers.

This means that hackers who have found a back door into the IT system of one car model may be able to use the same method on other cars as well, the researchers said. The finding identifies a potential common point of exposure across vehicle models and brands. The study used data and statistical analysis of reported vulnerabilities.

Its primary evidence came from 413 reported security vulnerabilities in automotive software between 2022 and 2024, with the previous decade serving as the comparison period. This approach allows researchers to assess where disclosed weaknesses were located and how they were rated, including the nearly threefold increase in the share involving apps, websites and cloud services. The findings therefore describe documented vulnerability patterns, not the complete number of attempted or successful cyberattacks against modern vehicles.

For manufacturers, the results support keeping systems that control the vehicle strictly separated from infotainment and other connected systems, with strong security around them. Basu also advised car manufacturers to learn from the web and IT industry, where many of the same kinds of flaws have been known for years. The study’s broader implication is that a car connected continuously to the outside world also gives that outside world more opportunities to interact with the vehicle and the information it carries.

Addressing that connection therefore requires attention to the services, interfaces and systems around the car, not only to software running on its internal computers. Car owners also have a role in making unauthorized access more difficult, according to the researchers. It is important to update software when the car prompts the owner to do so, and strong passwords remain important.

The study also draws attention to AI assistants in cars, including systems used to plan long journeys in electric vehicles. Like other AI systems, these assistants can be tricked into revealing information they have been given. Basu said it therefore matters what information users share with the assistants and what access car manufacturers allow them to have.

The review’s findings and these recommendations concern the changing distribution of documented automotive software vulnerabilities, including weaknesses in connected services, infotainment systems, vehicle interfaces and shared computer chips; they do not quantify the probability that any particular car will be hacked.

Subject of Research: Analysis of reported software vulnerabilities in connected vehicles

Article Title: Your car’s weakest spot may not be in the car

Article References: Your car’s weakest spot may not be in the car. Original publication (Bibliographic details unavailable.)

Image Credits: AI Generated

DOI: Not provided

Keywords: connected cars, automotive cybersecurity, cloud vulnerabilities, infotainment systems, vehicle software, cloud security, automotive chips, personal data exposure, security research, Your, weakest, spot