Scientists uncover hundreds of software vulnerabilities in cars that could allow hackers to take over your BRAKES

Scientists have discovered hundreds of software vulnerabilities in cars that could let hackers seize control of your data, personal information, and even the brakes.Researchers from the University of Gothenburg searched through the US National Vulnerabilities Database, a government–operated list of known software flaws.Between January 2022 and September 2023, their analysis revealed 413 previously reported weaknesses affecting internet–connected cars.The researchers warn that hackers exploiting these vulnerabilities could 'compromise vehicle control functions' such as the brakes or steering system.Lead author Dr Srijita Basu told the Daily Mail that cyber–security experts are well aware that this type of attack is 'technically possible'.In 2015, researchers exploited the infotainment system in a Jeep Cherokee to gain control of the car's steering and brakes, triggering a recall of 1.4 million vehicles.Dr Basu added: 'Modern cars contain several interconnected computer systems. Some manage infotainment and communication, while others are responsible for safety–critical functions such as braking, steering and acceleration.'If an attacker exploits a vulnerability in one system and can move from there into another system because security boundaries are inadequate, the consequences could be serious.' Between January 2022 and September 2023, their analysis revealed 413 previously reported weaknesses affecting internet–connected carsIn their paper, published in the Software Quality Journal, the researchers didn't demonstrate control of the brakes or driving functions with any of the 413 vulnerabilities they analysed.However, that doesn't mean that it isn't possible, and Dr Basu says that these vulnerabilities remain a 'critical concern'.She adds: 'Finding a vulnerability does not automatically mean that it can be exploited remotely or that it provides access to safety–critical systems.'That depends on several additional factors, including the attacker's level of access and the vehicle's security architecture.'These vulnerabilities stem from the fact that cars are no longer standalone systems, and instead rely on a network of web applications, cloud computing platforms, mobile apps, and online services.The researchers found that the largest share of weaknesses were found in external applications, which accounted for 36.2 per cent of the dataset.That was followed by 'system–on–chip and embedded software', which includes programs built into the car such as GPS software and remote keyless systems, accounting for 23.5 per cent of vulnerabilities.The researchers also examined software known as 'libraries', which are ready–made core components that programmers will use in their programs rather than writing them from scratch. This comes after cyber–security researchers managed to exploit a flaw in the 2015 Jeep Cherokee's infotainment system to gain control of the steering system and brakes They used five software–scanning tools to examine 20 open–source projects used in automotive software, and found 827 vulnerable libraries.However, when the researchers compared their own data to a previous study covering 2010 to 2019, they also noticed a striking difference.In the past, vulnerabilities were largely located in the computer systems physically embedded in the car, but now the risk has shifted towards the external digital ecosystem.'This means that protecting a modern car is no longer just about securing the computers physically installed in it,' says Dr Basu.Additionally, the proportion of vulnerabilities listed as 'critical' more than tripled from five per cent in 2019 to 16 per cent in 2023.In particular, Dr Basu says she and her co–authors were surprised by the prevalence of vulnerabilities that have been traditionally associated with websites and online services.One of these attacks, known as SQL injection, allows hackers to manipulate an application's connection to its database and potentially access information they should not be able to see.For drivers, that could include vehicle information, trip records, or other sensitive customer data. Of the vulnerabilities analysed, 16 per cent were categorised as a 'critical' risk, as experts warn they could allow hackers to 'compromise vehicle control functions'Dr Basu says: 'What makes this particularly concerning is that these are well–known web security problems, yet they are now part of the automotive cybersecurity landscape.'We also identified vulnerabilities involving privilege escalation and memory corruption, which can be particularly concerning in systems with access to sensitive vehicle functions.'The researchers say there are a few simple steps that drivers can take to protect themselves from a potential cyber–attack.Car owners should install software updates as soon as manufacturers make them available, use strong passwords for car–connected accounts, and be cautious of mobile applications linked to their vehicle.Additionally, drivers should review the privacy settings on their devices and be mindful of personal and location information shared with connected services.However, although these steps can help you stay safe, Dr Basu says the responsibility should ultimately lie with the vehicle manufacturers themselves.She says: 'Drivers cannot reasonably be expected to identify hidden vulnerabilities in complex automotive software.'Manufacturers need to build cybersecurity into vehicles from the earliest design stages, rather than treating it as a final check before release.'