An investigation by ABC News into Chinese electric vehicles, specifically BYD and Xpeng, revealed significant cybersecurity and data privacy concerns. Researchers demonstrated that these vehicles collect extensive data, including location, speed, seat occupancy, and steering wheel angle, which may be accessible to manufacturers in China.
Cybersecurity expert Dan Hreszczuk successfully hacked a BYD Shark 6 pickup truck after identifying a vulnerability that lacked password protection. He gained control over vehicle functions such as lights, wipers, and door locks while the car was in motion. Furthermore, he accessed the vehicle's interior microphones to record audio.
By manipulating the car's audio system, the hacker triggered voice commands on a connected iPhone. This allowed access to sensitive personal data, including the user's date of birth, phone number, and contacts. The report notes that Australian government officials currently use BYD and Xpeng models.
The Australian Security Intelligence Organisation has advised officials against discussing sensitive information inside vehicles. While some nations have restricted Chinese vehicles from sensitive sites, data privacy issues extend beyond Chinese brands. A 2023 Mozilla study found that 25 major car brands failed to adequately protect consumer data.
