Modern cars are constantly connected to the outside world. This makes them vulnerable to hackers who want to take control of the vehicle remotely. Researchers at the University of Gothenburg and Chalmers University of Technology have found that IT vulnerabilities have shifted from the car’s own computer systems to apps and cloud services connected to it.
A car is a computer on wheels. It communicates with the car manufacturer’s cloud services, the driver’s phone and charging stations, and when children stream films in the back seat, data travels over the internet. All these connections can become entry points for hackers into the car. Researchers at the University of Gothenburg and Chalmers University of Technology studied 413 reported security vulnerabilities in automotive software between 2022 and 2024 and compared them with the previous decade.
“Ten years ago, most vulnerabilities were found in the cars’ own systems. Now the share found in apps, websites and cloud services has nearly tripled. These systems hold data about where you live, where you drive and when, so the risk is not only that someone could interfere with the car, but that they could get hold of information about your life,” says Srijita Basu, postdoctoral researcher in software engineering at the University of Gothenburg and Chalmers University of Technology.
Driver data in cloud services
A reported IT vulnerability does not mean that a breach has occurred, only that there is a risk of one. In December 2024, it was revealed that data from around 800,000 electric cars from Volkswagen, Audi, Seat and Skoda had been openly accessible on the internet for several months. The data contained precise GPS information and the email addresses, telephone numbers and home addresses of the owners of the cars. This meant that it was possible to see exactly where and when a particular car had been driven. The vulnerability was in the cloud service used by the car manufacturer to upload data from vehicles on the road. The data leak was uncovered by an ethical hacker group after a tip from a whistleblower and was widely reported in the media. The leak was fixed before it was known to have been misused.
“When we compare with the previous decade, we can see that IT vulnerabilities are now most commonly found in apps, websites and cloud services, and that the risks are more often rated as serious and critical. We are surprised by how basic some of the weaknesses in these systems are. They can involve passwords that have not been changed since installation. Hackers can use tried-and-tested old tricks to gain access through a back door,” says Srijita Basu.
Took control of the accelerator and brakes
The car’s audio and media system, commonly known as the infotainment system, is a weak point. Anyone connected to the car’s Wi-Fi network could potentially gain access to the car’s other systems as well if they are not properly separated.
This happened in a test conducted by security researchers to a Jeep Cherokee in 2015. Through the car’s media system, they were able to gain access to other systems in the vehicle and take control of steering, brakes and the accelerator. The new study shows that similar weaknesses still appear nearly a decade later.
“My advice to car manufacturers is to keep systems that control the vehicle strictly separated from infotainment and other connected systems, with strong security around them. They should also learn from the web and IT world, where many of these flaws have been known for years. When the car is constantly connected to the outside world, it also invites the outside world into the car,” says Srijita Basu.
Differences between computer chips
In their review of reported vulnerabilities, the researchers analysed where each vulnerability had originated. Was it in the design of the IT function, in the programming or in the software running on the car’s computer chips? The researchers found that chip manufacturers vary in how well they protect their products against attacks and in how openly they report security flaws. Computer chips from the same manufacturer are often used by several car makers. This means that hackers who have found a back door into the IT system of one car model may be able to use the same method on other cars as well.
“Car owners also have a responsibility to make things more difficult for hackers. It is important to update the software as soon as the car prompts you to do so, and strong passwords are still important. Today we share a lot of personal information with AI assistants for cars, for example when we ask to plan a long journey in an electric car. Like other AI systems, these assistants can be tricked into revealing information they have been given, so it matters what we share with them and what car makers allow them to access,” says Srijita Basu.
Software Quality Journal
Data/statistical analysis
Mapping the landscape of software vulnerabilities in connected vehicles
12-Sep-2026