The ABC News investigation into BYD vehicle security demonstrates that connected vehicles can create material safety, privacy, espionage and governance risks. A cyber security researcher gained remote access to a BYD Shark 6 through an interface that reportedly did not require a password.
Build Your Demise?
https://www.abc.net.au/news/2026-09-21/byd-hacked-by-cyberse…
+1 physical access trumps all
As it should.
Yep, just an odd hit piece on BYD for some reason.
This is what happens when the libs stack ABC's management with ex sky and fox execs - rage bait journalism aimed at things like renewables, indentity politics and China.
It did strike me as something SkyNews would do.
Wait till you see how much power you can unleash when you have physical access to the ECU.
It's been done over and over again
True, hear they went via the CANBUS. While watching I was thinking.. shh.. don't tell them about the ODB port.
Mumbo number 5
I see you are adding value again…:)
Just a hit piece against BYD for low IQ people. ABC do better.
By the end it's just devolved into a generic 'china bad' article and no longer even talks about the cyber risks of modern cars.
If it was a commercial news outlet I'd assume it was funded by some US centric think tank.
ABC has "Correspondents" coming from Ass-pee (ASPI, funded by US Govt and weapons manufacturers). They are pretty rife even in "Left wing" circles. They do daily regular hit jobs on anything China as part of their agreements.
agreed. Typical sinophobia being pushed by USA and our spineless major parties who still think this is good foreign policy
Better and healthier to stay away from the news these days.
Not just BYD, all Chinese Ev's
One bad article doesn't mean defunding the whole thing. In general their work is far higher quality and less biased than the majority of other news sources.
It would be truly a sad day if it closes, suggestive of society really going downhill.
What makes inadequately secured car ict systems a hit piece?
Is the complaint it is false, or that they didn't also test every other car?
What makes you think the car's ICT system is inadequately secured? There's no evidence of that in the article - in fact, it would appear that despite being given 2 weeks physical access to the (presumably unlocked) car, their "expert" still could not access anything considered critical like cameras or brakes.
There's no evidence of that in the article
Yes there is.
Hreszczuk, the co-founder of Fortify Labs in Canberra, was stunned by the BYD Shark’s lack of cybersecurity.
“The access we took advantage of didn’t even have a password,” he says.
Does that sound like it is adequately secured?
@tenpercent: And what access did they take advanage of?
"With access like this, I could sideload a youtube app!"
"Could you access critical systems like the cameras or driving functions"
"Well no, but I could change their dashboard background to an australian flag, how good's that?"
"Is this replicatable on any car that's running an android based infotainment system?"
"Well yeah, but they're not Chinese so we don't care about that"
Does that sound like it is adequately secured?
All and every password is a "crackable password". In particular when having full unrestricted physical access and unlimited time. Since circa 1940s
Meaningless.
@LFO: May as well just use password123 for all your passwords and 80085 for all your card PINs?
And don't get me started on locks. Locks have been pickable for hundreds of years. No point locking the front door when you leave home, right?
/s
Meaningless
Yes that's about it.
@tenpercent: Not quite.
Not that trivial.
Just remember: the safest door has no locks.
It is not the password nor the lock it is more about not to allow access to even use the password … nor the lock.
"Access".
@LFO: So you need to put up a fence with a locked gate and not even bother with a lock on your front door, right? But then you will say something profound like "the safest gate has no locks" and on and on we will go until your house is on an asteroid surrounded by the vast emptiness of space to deny "access".
@tenpercent: Oh dear …
One is a proverb to highlight the fact if there is nothing of (perceived) value safety is guaranteed.
Passwords were used in the context of the "described hack": inside a vehicle having full access for unlimited time with unlimited resources.
You brought locks into the chat. Similarly having "access" to the lock is the key (pun intended).
Anyhow, whatever …
@tenpercent: Your getting roasted, you still have not learned what a CANBUS is, it was designed to be a trusted connection, doesn't have the ability to have a password.
100% the car you drive has a CANBUS and guess what you can plug right in.
What your asking is to integrate a password mechanism into every canbus component, eg: windscreen wiper switch so it can talk to the canbus to control the wipers…lol.
@UltimateAI: I stopped counting. What is this? 6 or 7? Higher?
Can I get sauce with it? It's becoming very bland.
It doesn't, the ABC did it for Toyota and Jeep - BYD fan boys having a hissy fit, I don't remember Toyota owners having the same hissy fit
@arkie0: I don't think Toyota owners get social credit points for defending Japan's corporations' honour.
Yeah but Jeeps are shit.
Won't someone please think of the Jeeps!
If Stellantis update the Avenger I might be tempted.
i think we should give them extra funding with performance incentives based on the number and quality of hit pieces they make on jeep.
Has "pentest" ever been mentioned in the article? Nowhere is "how" mentioned at all. The hacker has physical access to the vehcle over 2 weeks — could he gain access through OBD2 port or install an app via ADB? In that case it would not even be qualified as pentest. Installing a backdoor via physical access at most.
Still. There are many things BYD should do prevent unauthorised physical access to the car to overtake the entire computer system. However the vulnerability is not just limited to BYD or electric vehcles though — how many cars were stolen via OBD2 these days?
ABC did the same test on Toyota at the start of the year with the rise in car thefts via that method. Toyota have now implemented changes, though only standard on newer models
Laughs in VF Commodore
BYD drivers laughing at fuel prices
My 2007 A-class Mercedes even has a physical headphone connection to play music from my iPhone.
My Toyota GS350 has a CD player :)
The articles the ABC has been publishing on this read like a fear-mongering witch-hunt on Chinese EV's to me. No specifics at all, let alone a comparison to EV's from other countries.
Nowhere is "how" mentioned at all.
If they published the "how" you would be here whinging that they are irresponsible for publishing blueprints how to hack these cars. FFS
Although they did allude to the "how"
“The access we took advantage of didn’t even have a password,”
Didn't have a password — to what?
Your fridge does not have a password either but I don't have access to it. Some developers don't put password behind resources because either (1) it sits behind something that's presumably stronger (physical access for example), or (2) fake security by obscurity. Either way it's bad, and BYD should take the blame. However we do not know how severe it is due to lack of details in the ABC report.
They did explicitly state in the video, they gained access via the CANBUS.
Ofcourse the can bus doesn't have a password, it's the cars physical wiring\nervous system, if it did you could never add a third party accessory.
to me, it sounds like BYD cutting corners … trying to do things on the cheap (hence no password/etc).
Rather than any deliberate attempt at AU espionage (as the 2nd later ABC article - mentioned further down - tries to allude to).
I half agree. Definitely cutting corners, minimising costs.
But not having a password wouldn't even prevent them using all these cheap devices for espionage. If I were running China and had their ambitions I would be using all the cheap tech exported to the West for opportune espionage purposes too.
@tenpercent: But having no password != Backdoor.
majority of intentional espionage == backdoors hidden in code.
This is just sloppy/cheap coding work.
No password, means anyone - china, Russia, Iran, heck even US can do what they want.
@simplystu: I doubt the average byd driver has much to fear from the CIA, chinese intelligence, russians etc. "Hey lets send a crack team to australia to physically break into this plumbers BYD and see what station his radio is tuned to." If they want you that bad it won't be the brand of car that stops them.
@simplystu: So it's even worse than the ABC article implied. It's not one state actor to worry about, it's potentially all of them. But let's be honest, there's one country that had physical access to these cars for far more than 2 weeks.
@tenpercent: Or none !!!
Otherwise it would've already happened by now.
Have read articles in Tech forums - it's been openly/widely known atleast since start of year (and sec gov prob long before that).
If if some country wanted to maliciously use this as an attack - they would've done so by now.
Otherwise it would've already happened by now.
How would anyone know they haven't already hoovered up heaps of data about sensitive locations or aren't presently still doing it as opportunities arise?
@tenpercent: If you want functionality and convenience then you run risks. I certainly don’t trust China but I think Israel is a bigger security problem at the moment. They will hack into anything given half a chance.
@tenpercent: My annoyance with a lot of shoddy product security is the holes they accidentally leave for others rather than the malicious intent of the company itself.
We have a couple of Tapo cameras we use for security at the front of our property. We can see these cameras remotely via the internet. These are street facing so if someone hacks in for surveillance it isn't that much of a biggie, however, it could be an issue if we had it inside the house or a stalker was monitoring me.
@simplystu: "If if some country wanted to maliciously use this as an attack - they would've done so by now"
playing the long game, once US devolves into a dictatorship…….
.
Spot on, surprised they didn't go down the privacy path more. I do think the "connected" aspect is a security risk, but the ABC security expert clearly couldn't exploit it within the two week period.
It's actually not that hard, as many users have weak, easily guessable passwords on their cloud accounts, no MFA. They could have demonstrated a POC with a weak or common password. Many people still re-use passwords across systems.
There are also a few compromised HOME ASSISTANT deployments via community plug-ins, that have leaked users car cloud credentials. So much for their security expert.
"Community plugins", "Their security expert" - I think you misunderstand nabu casa's security model.
Don’t get me started on people not understanding nabu casa, the exploits / malware I was referring to was just standard plugins/extensions and weak passwords on their BYD / Tesla / MG accounts.
Saw this response from a Facebook BYD group. Here's the link and here's the copy 'n' paste:
The demonstration had prerequisites that don't exist in the real world.
The expert had unsupervised physical possession of the vehicle for two weeks before anything worked. That's the buried headline. Every result shown - the lights, the wipers, the microphone, the speakers sits downstream of an access condition that no ordinary driver's car is in.
A threat model that begins with "first, surrender your ute for a fortnight" is not a threat model; it's a lab setup. The piece never quantifies how much of the two weeks was spent establishing access versus mapping functions once access existed, and that distinction is the whole argument.
The article never actually specifies the attack vector.
We're told there was an access point with no password and that the software controlling functions was "unpicked." We're not told what that interface was, whether it's reachable over the air or only via physical connection, whether it's exposed on a production vehicle or a diagnostic/service interface, or whether any modification was made to the car during those two weeks. Without that, the claim "a hacker can do this to your car" is unsupported by what was shown. The honest version of the demo is: a specialist with extended physical access found a weak internal interface. That's a real finding, but it's a much narrower one than the framing implies.
Both participants were cooperating, which contaminates every result.
The driver knew the attack was coming, drove at 30 km/h on a straight road, deliberately narrated banking credentials aloud, then deliberately left an unlocked phone in the car. A genuine adversary controls none of these variables. The demo shows that if someone has access and the victim behaves in precisely the required way, harm follows. That's a statement about scripting, not about risk.
The Siri segment is an Apple problem wearing a BYD costume.
The chain was: replay a recorded voice command through a loudspeaker to an unlocked iPhone left unattended. That works through any speaker: a Bluetooth boombox, a phone on a desk, a smart TV. The vulnerability is that iOS honoured voice commands from an unlocked device without speaker verification. The car was the amplifier. Attributing it to Chinese manufacturing is a category error, and including it inflates the apparent severity of the actual car findings.
The most serious systems held.
Brakes, steering and cameras were protected and stayed protected. That's reported in a single line and then immediately walked past with "it doesn't take much imagination." Imagination isn't evidence. What was demonstrated is annoyance-grade: wipers, lights, audio, screen. Meaningful, worth fixing, but the security architecture drew the line where it matters most, which is an argument that the engineering isn't absent, just uneven.
The surveillance concern isn't specific to EVs or to China.
Microphones, cameras, GPS and cellular modems are standard in modern ICE vehicles too; every mainstream brand with connected services has them. And every person in the car is already carrying a device with better microphones, continuous location history, a contact list, message content and a browser. If the concern is data volume flowing to a foreign jurisdiction, the phone in the driver's pocket dwarfs the ute it's sitting in. Singling out the EV is a framing choice, not a risk assessment.
The location-tracking claim is weak on its own terms.
Driving past the War Memorial and down Anzac Parade is not sensitive intelligence. Street-level imagery of essentially every Australian road is publicly available, and anyone's routine movements are already legible through phone telemetry, tolling, and payment records. The genuinely sensitive cases defence facilities, ministers' movements are exactly the cases already covered by ASIO guidance and site-access rules, which the article confirms exist.
The regulatory gap argument undercuts the China argument.
The piece's own strongest finding is that Australia sets no minimum cybersecurity standard for any car. That's a vendor-neutral failure. If the fix is standards, the standards apply to Toyota and Tesla as much as BYD, and the nationality framing becomes decorative. MacGibbon's own summary is telling: capability yes, intent unknown. That's a candid admission that the second half of the case is missing."
Fantastic summary that raises the few obvious points I saw while reading, and in retrospect makes the article look very sensationalist. And while it's good to raise awareness of some real issues, there are far more responsible and nuanced ways to do this.
I can understand that the article doesn't disclose the precise attack vector used, but they should have been far more explicit about pointing out that any device left in untrustworthy hands for two weeks has an extreme risk of being compromised.
Thanks AI
Point 5: Turning the LIGHTS off is NOT annoyance-grade issue. That should have been secured better.
Funny excuses like anyone will believe it.
Most hackers do scouting, recon and time their attacks two weeks is nothing. Once vuln is found same applies to all models
Staying dormant for two weeks is called short
One year free access more like
The Shark has spent the past two weeks with Dan Hreszczuk, a cybersecurity expert who specialises in cars.
That's not recon. An ICE car would have been two states over with false plates or burned out on the side of the road after two weeks with your average ice fiend.
Going to learn sign language so I can communicate with my family in front of my TV and while driving the car.
I could take full control of a 1970 VW Beetle!
Herbie was an advanced hack.
Most VW beetles prior to 1965 used pretty much the same key. The key for my 1956 beetle opened and started my 1958 beetle and open and started my 1961 beetle.
You reckon it would take 2 weeks to repeat it on another BYD Shark they hadn't had prior access to now that they figured out all (at least some of) the attack vectors and vulnerabilities?
Quite possibly. Remote vulnerabilities in cars are a serious issue. But the ABC article has shown nothing.
You reckon they should have published a whitepaper with step by step instructions?
@tenpercent: Cyber-security 101. If a bad actor gets physical access to your device, its game over. Data encryption helps if a device is stolen, but not if accessed unknown to you.
@tenpercent: Why not if they think there is an issue? We could then assess the extent of the actual risk. Without knowing what he did, or a comparison with other cars with computer technology, we can’t see the extent of the issue. We might find that OMG extends much further than one EV from China.
Maybe I can rent my 2007 Merc A-class to the Government. I’m pretty sure nobody’s hacking into that.
They didn't though, seems like they couldn't get anywhere over two weeks, so installed a wireless adaptor on the canbus. You can do this on almost any car manufactured over the last 20+ years.
.#4
When I pull into a service station and leave my phone unlocked in the car, Hreszczuk seizes his opportunity.
He’s done a simple audio edit, stitching together me saying “Hey Siri” and his voice asking a few questions to get the personal details he needs.
Do you know what else you can do with an unlocked phone instead of spending two weeks hacking someone's car to get a voice recording of them to use Siri to answer a few questions?
Just pick up the damn phone and start searching their emails.
Anyway, I found an easy way to protect my BYD just in case someone steals my car then magically returns it a few weeks later and starts turning the lights on and off - I removed the sim card.
What model do you have? Does it have a physical sim? I always assumed they'd have e-sims built in.
This is definitely a feature worth advertising haha
Most BYDs should have a physical standard SIM card (not micro / nano) located in obscure locations differ by the model. Shark 6 for example, can be found under the driver seat behind floor carpet. Not mentioned in the manual — I only knew through googling…
Great tip - thanks @scotty. Might consider a BYD now
Atto 3, that one is in the glovebox (take it out and there's a little panel in there) - I just followed a youtube video.
The only thing I miss is the ability to turn on the heater remotely. It's handy on a cold day and the Atto 3 has a real problem with fogging up. Seems that the heat pump retains humidity, so when you turn it on that blasts out and fogs everything - they somewhat fixed it with a software update but it's still annoying at times.
Atto 3 has a physical SIM accessible via the glove box. YouTube will show you how hidden it is.
But then you can't use the app for convenience and may not get OTA updates.
The ABC often has strong journalism but this is the kind of junk that really pisses me off.
If they had taken a selection of cars, some traditional brands like Ford and Toyota and compared them with Chinese cars and found that BYD was poor, well that's fair.
This reads like a brand hit job for clicks.
They did Toyota already in Feb.
To be fair pretty much every modern Toyota has a major security defect, they all need to be recalled.
In the BYD instance they appear to have physically attached a wireless dongle to the CANBUS. So it's really just the CANBUS doing what it is designed to do, on every car by every manufacturer in the last 20+ years.
Really does amaze me how you can even get a Toyota insured these days.
Even more reason it should be a comparison then!
I'm sure the editors at the ABC look forward to your sternly worded letter advising them how to improve.
Most cars would be the same once you have physical access to the odb port or andoid adb