A presentation titled “Compromising Modern Vehicles” may create the expectation that you will watch a dramatic demonstration of a hacked car suddenly stopping or skidding under the control of a malicious actor. When you understand the subject, you may be a little disappointed to learn that “only” the infotainment system of the vehicle is vulnerable, not the critical driving systems. But despite this unexpected situation, read on to understand the importance of PCAutomotive’s research presented at Black Hat Europe 2024 by Danila Parnishchev and Artem Ivachev.
Two security researchers have detailed how malicious actors can exploit various flaws in infotainment units to control a vehicle’s microphone, record passengers and play the recording back through the same system, exfiltrate personal data, track the vehicle and its speed via the built-in GPS, and steal a contact list uploaded via a connected device.

But somehow this feels less invasive than, say, an attack on a smartphone that would allow an attacker to track the device, control its microphone, and exfiltrate data and contacts. The prospect of being able to hack a car provides a visual image of disaster, a threat to the lives of those in the car and others, so it feels like a relief when it turns out the problem “only” involves privacy and personal data. But that doesn’t mean the potential privacy implications should be underestimated.
The mechanics of a car hack
When you first connect a smartphone to a car’s infotainment system, you usually have the option to upload and sync contacts directly to the car’s system. This gives you seamless access to the contacts on screen and allows you to make calls when needed. The researchers discovered that by uploading a modified contact list, they could exploit a vulnerability in the system and issue remote commands (remote code execution – RCE).

Once the car is hacked, they can control elements of the infotainment system and exfiltrate data, as mentioned above. The vulnerabilities disclosed by the team at the conference affected 1.4 million vehicles, they explained. All 21 vulnerabilities have been patched with updated software through the relevant manufacturers.

However, the privacy concerns highlighted are significant, as is the opportunity for exploitation. Imagine a controlling partner monitoring their lover and accessing their communications and other data. This happens through the car’s infotainment system and without the victim’s knowledge or consent. There’s also the equally disturbing espionage angle, as I’m sure you can imagine how this sort of car hack could be used for large-scale surveillance and intelligence gathering.

Approaching Evolution with Caution
The title of the presentation, and others like it, can unintentionally mislead minds and even cause distrust in what we should be embracing. The automotive industry is evolving, and such depictions of risk can even undermine public trust in these innovations.

For example, I recently experienced riding in a Waymo self-driving taxi in Phoenix. You request it through an app, the vehicle pulls up, you get in, and you conveniently press the button to begin your journey: I drove from a hotel to the airport and shot a short video to share with friends and family (look, there was no driver). The common response was, “Never for me, did you feel safe?”

I’m sure a psychologist could explain these feelings in detail, but for me, it’s about trusting a regulatory process, a risk assessment, and the talented engineers who developed it. Waymo’s vehicles are not haphazard prototypes; they’ve been tested, reviewed by regulators and safety advocates, and insurers have deemed the risk acceptable, which is a huge accomplishment.

When asked about the presentations I attended at Black Hat Europe this year, I won’t say “someone showed how to hack a car.” More accurately, I’ll say “someone showed how to hack a car’s infotainment system.”

This distinction is important. We shouldn’t fear technology, but embrace its evolution. Imperfections and subsequent fixes are part of evolution, and we need to approach change with a sense of openness but also, I admit, a bit of caution.