(Image generated by generative AI and reviewed under professional human supervision.) Connected vehicles are increasingly connected to mobile apps, cloud services, charging networks and other online platforms. These features allow drivers to check battery levels, locate their vehicles, plan journeys and control certain functions remotely. In Hong Kong, growing vehicle connectivity and app-based services raise cyber risk. Weakness in vehicles, local mobile apps, online accounts, cloud platforms and third-party services can expose personal data or enable unauthorised access to connected features. Because cars increasingly depend on apps and cloud services, such as public charging networks or HKeToll, protection must extend beyond the car itself. Owners should secure vehicle accounts, smartphones, charging and toll services, and transfer digital ownership safely when buying and selling. Recent security research [1] has shown that weaknesses in cloud-based vehicle systems could allow an authenticated vehicle or account to access functions or data belonging to another vehicle if access controls are not properly enforced. The attack starts with credentials or session data obtained from one vehicle. These are used to connect to the backend as that vehicle. The attacker then changes the target vehicle identifiers in messages sent through MQTT, HTTPS or SMS to test whether the system allows access to another vehicle. If the system checks only that the connection is authenticated, without checking permission to access the requested vehicle, it could allow unauthorised access. This is an important reminder that secure communication alone is not enough. Every request must also be checked to ensure that the authenticated user or vehicle is authorised to access the specific vehicle’s data or functions. In 2024, researchers found weaknesses in Kia’s dealer systems that could allow an attacker to use a vehicle’s licence plate as a starting point to access the owner’s personal information and gain unauthorised access to connected functions [2]. These included locating the vehicle, unlocking it and starting its engine remotely, without notifying the owner of the access changes. Kia fixed the vulnerabilities by 14 August 2024, and the report stated that there was no evidence of exploitation in the wild. The case shows how weaknesses in online services, backend systems it connected to andaccess controls can affect both vehicle privacy and security, even without compromising the vehicle itself. This does not mean that all connected vehicles are unsafe. Vehicle owners can reduce their risk by following good cybersecurity practices throughout the vehicle’s lifecycle. Common Cybersecurity Risks Outdated vehicle softwareModern vehicles rely on software for infotainment, navigation, charging and connected services. Unpatched vulnerabilities may be exploited if security updates are not installedCompromised vehicle accountsA stolen password could allow an attacker to access personal information, vehicle location or remote functions available through a companion app.Phishing and fake customer serviceFraudsters may impersonate vehicle manufacturers, dealers, charging providers or insurance companies. They may claim that an account, payment, recall or software update requires urgent action.Unofficial apps and aftermarket productsModified apps, unauthorised diagnostic tools and untrusted aftermarket devices may collect data, weaken security controls or create additional ways to access the vehicle.Risks from connected servicesThe security of a connected vehicle also depends on mobile apps, cloud platforms, charging networks and other service providers. A weakness in one part of this ecosystem may affect users elsewhere.Incomplete transfer of digital ownershipIf accounts, paired phones, digital keys and personal data are not removed when a vehicle is sold or returned, a previous user may retain access. Eight Practical Steps for Vehicle OwnersKeep vehicle software up to dateInstall official software, firmware, infotainment, navigation and mobile app updates promptly.Enable automatic updates where available.Do not install software from unknown sources.Check official recall and security noticesRegularly check the manufacturer’s official website for recalls and important notices.Act promptly if a security-related recall or software update is announced.Use only official mobile appsDownload vehicle and charging apps only from official app stores or approved sources.Avoid modified or unofficial versions.Remove apps and connected services that are no longer needed.Protect your vehicle accountUse a strong and unique password that is not reused elsewhere.Enable multi-factor authentication (MFA) where available.Review authorised users, devices and digital keys regularly.Never disclose passwords, verification codes or account recovery information.Secure connected mobile devicesKeep smartphones, tablets and their apps updated.Protect devices with a strong passcode and biometric authentication.Avoid using rooted or jailbroken devices for vehicle access.If a device is lost or stolen, revoke its vehicle access and change the relevant passwords immediately.Watch out for phishingBe cautious of unexpected calls, emails, messages and QR codes.Do not follow links that claim urgent payment, account verification, recall registration or software updates are required.Access services through the official app or by entering the official website address yourself.Never provide passwords or one-time passwords (OTPs) over the phone or through messages.At charging stations, check that a QR code has not been covered by a fraudulent sticker. Buying or selling a used connected vehicle? Connected vehicles hold apps, accounts, and sensitive data. Whether you’re selling, buying, renting, or returning a car, take a moment to secure digital access and confirm support. This checklist shows how to transfer ownership safely and what to ask about security to protect your privacy, reduce risk, and avoid surprises. Transfer digital ownership securelyWhen selling, buying, renting or returning a vehicle:Sign out of all accounts and connected services.Remove paired devices, saved addresses, payment information and digital keys.Revoke access granted to other users and third-party services.Perform an official factory reset where appropriate.Confirm that the manufacturer has updated the vehicle’s registered owner.Used-vehicle buyers should ensure that previous owners no longer have access.Consider cybersecurity before buyingBefore purchasing a new or used connected vehicle, ask:How long will security and software updates be provided?How will owners be informed of vulnerabilities and recalls?Does the connected-vehicle account support MFA?Can authorised users, devices and digital keys be reviewed and removed?Will connected services remain supported throughout the expected life of the vehicle?Has any untrusted aftermarket equipment been installed?
What to Do if You Notice Suspicious ActivityIf you receive an unfamiliar login alert, see an unknown digital key, notice unexplained changes to vehicle settings or suspect unauthorised access:Park safely if the vehicle is behaving unexpectedly.Change the vehicle account password using a trusted device.Revoke unknown devices, users, digital keys and third-party services.Contact the vehicle manufacturer or authorised dealer through an official channel.Keep screenshots or records of suspicious login alerts, unfamiliar digital keys, emails, messages and unusual account activity where it is safe to do so. If you suspect your account or any connected service has been compromised, contact the vehicle manufacturer or service provider immediately. For phishing, account compromise, or other cybersecurity incidents, report to HKCERT at https://www.hkcert.org/form/incident-report-end-user-sme/entryDo not attempt to modify or repair safety-related vehicle systems yourself. Seek assistance from the manufacturer or an authorised service centre. Cybersecurity Is Part of Vehicle SafetyConnected-vehicle security extends beyond the vehicle itself. Vehicle accounts, smartphones, cloud services, charging platforms, digital keys and third-party services all form part of the connected ecosystem.
HKCERT reminds vehicle owners to keep vehicle software up to date, protect connected accounts with strong authentication, remain alert to phishing, review digital access regularly, and securely remove personal data and access rights when selling or returning a vehicle. Treat your connected-vehicle account and digital key with the same care as your physical car key. Referencehttps://www.usenix.org/conference/usenixsecurity26/presentation/liu-yangyanghttps://thehackernews.com/2024/09/hackers-could-have-remotely-controlled.html
——————————————————-
Click Here For The Original Source.
