An investigation by Four Corners has found cyber security flaws in one of BYD's top-selling vehicles.
The BYD Shark 6, a plug-in hybrid ute, was found to have no password on a digital access point, allowing a hacker to take control of key functions within the vehicle.
The BYD Shark 6 is a plug-in hybrid ute sold by China's top EV brand.
Rachel Mealey: Chinese electric vehicle maker BYD is one of the most popular brands on Australian roads, but an investigation by Four Corners has found cyber security flaws in one of its top selling vehicles. The BYD Shark 6, a plug-in hybrid ute, was found to have no password on a digital access point, allowing a hacker to take control of key functions within the vehicle. Angus Grigg reports.
Angus Grigg: It's just before midnight on a quiet country road outside Canberra. As I round the bend and gently accelerate, the BYD Shark I'm driving begins to behave strangely.
Car audio: For your safety. Oh, ****! It's a low beam. What is that?
Angus Grigg: First, the wipers come on, then the windscreen is sprayed with water. I've not touched either. Before I have time to react, the headlights go dark. Lights totally out. OK. Sitting by the roadside with his laptop is Dan Hreszczuk, a cyber security expert who specialises in cars. He's remotely accessed the Shark and taken control of some functions.
Dan Hreszczuk: The access we took advantage of didn't even have a password. There's lots of room for improvement there, and it's a little bit scary of how open some of the vehicles, in this case, the BYD Shark, is to a hacker.
Angus Grigg: The lights and wipers were not Dan Hreszczuk's only play. He's able to remotely track the vehicle. And as I drive around Canberra, he's following me in real time.
Dan Hreszczuk: So he's just going past the back of Duntroon and coming into a roundabout.
Angus Grigg: He's also got access to the car's microphone.
Dan Hreszczuk: So he's going to go back down. Looks like Anzac Parade. How we turn on the microphone?
Angus Grigg: When I call my mum, he's listening in. Hey, Mum, Angus here. I just wanted to ring you quickly. You know how you wanted me to set up that internet banking for you?
Mum: Yes, absolutely. You realise I'm not very good on that.
Angus Grigg: As the conversation continues, I detail how I've set up the password. Dan Reschuch has been recording, and by exploiting another vulnerability in the car, he cracks the password. Alastair McGibbon is Australia's former national cyber security advisor.
Alastair MacGibbon: On the whole, connected vehicles by their nature have functionality that can be abused.
Angus Grigg: Mr McGibbon says a malicious actor could exploit these functions. But he's also concerned China's security agencies could gain this type of access through BYD.
Alastair MacGibbon: It doesn't need to hack these vehicles to make them into a listening device or a surveillance device on the outside of the vehicle. It's a feature of the vehicle.
Angus Grigg: In a statement, BYD says it has not and would not transfer any data of Australians to Chinese authorities. This is despite China's national intelligence law requiring companies to cooperate with authorities if requested.
Rachel Mealey: Angus Grigg with that report, and you can catch the full story on Four Corners tonight at 8.30 on ABC1 or anytime on iView.
Chinese-made EV vulnerable to hacking
Security flaws in top-selling BYD EV
PM launches bid for UN Security Council seat
Protecting Australia's interests in AI race
Coalition proposes fuel excise triggers
Ukraine launches massive drone attack on Moscow
Four domestic violence deaths shock NSW
Discover more podcasts
Download the ABC listen app to hear more of your favourite podcasts
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
