An Australian documentary has examined the potential cybersecurity risks linked to the country’s rapidly growing number of Chinese electric cars. It showed how automakers can access a wealth of information from each vehicle, with modern cars capable of collecting extensive data about driving conditions and, potentially, the people inside them.
The investigation focused primarily on two Chinese EV makers, Xpeng and BYD. In the case of Xpeng, an unnamed company insider allegedly monitored a G6 supplied to ABC News. They could report its location, speed, seat occupancy, steering-wheel angle, and other details. The company in China allegedly had access to this information and more.
The report also explored the potential national-security implications of Chinese vehicles, including the possibility that sensitive data could be sent to China. The concern is heightened when government officials drive these cars. The Australian Security Intelligence Organisation has advised ministers and public servants not to hold sensitive conversations in their vehicles or connect work devices to them, but there is no guidance specifying which cars they may purchase. Australia’s trade minister, Don Farrell, owns a BYD Shark 6, while the minister for climate change and energy, Chris Bowen, drives an Xpeng G6.
The Hacking Risk
ABC’s investigation went further by demonstrating what a hacker might do with unsupervised access to a vehicle. Dan Hreszczuk, a car cybersecurity specialist, was given a BYD Shark 6 pickup for two weeks. After finding a vulnerability, he was able to enter the vehicle’s systems with little difficulty. “The access we took advantage of didn’t even have a password,” he said.
Hreszczuk could lock the driver inside the vehicle, play music at high volume, and interfere with the wipers and lights while it was being driven. More seriously, he accessed the microphones inside the cabin. That allowed him to listen to potentially sensitive conversations, including phone calls, record a journalist’s voice, and capture the wake-up command from the journalist’s Apple phone before playing it through the Shark’s speakers.
After the hacker triggered “Hey Siri,” he added his own commands, prompting the iPhone to disclose various details. These included the user’s date of birth, telephone number, and the contact numbers stored in the phone—including the number of the Australian prime minister.
Should Drivers Be Worried?
The national-security concerns have already led countries including the UK and Poland to prohibit Chinese cars from sensitive sites. However, there is currently no evidence that China has instructed its automakers to spy on other nations. UK lawmakers did note last year that Chinese law gives the government legal rights to access data gathered by the cameras, sensors, and radar systems used in vehicles built with Chinese technology.
The investigation underscores serious questions about how modern cars collect, process, and protect data. But does that mean Chinese vehicles are inherently untrustworthy?
Automotive cybersecurity concerns are not new, and they are not limited to Chinese brands. A 2023 Mozilla study gave all 25 car brands it assessed its “Privacy Not Included” warning for their handling of consumer data. Nissan and Kia were found to monitor drivers’ “sexual activity” and owners’ “sex life,” respectively. The study also found that 84 percent of the brands surveyed sold collected data to third parties.
There have also been numerous reported cases involving hackers allegedly accessing vehicles from brands including Tesla, Kia, and Subaru. As cars and other connected devices gather increasing amounts of information about their users, the report suggests that every automaker may deserve closer scrutiny over its privacy and security practices.
Buick’s Chinese lineup is about to gain a smaller Electra GS plug-in hybrid, highlighting the kind of electrified sedan GM lacks in America.
Kia honored Rafael Nadal with a full-size EV4 GT sculpture made using clay from the courts where the tennis legend earned his “King of Clay” nickname.
Toyota is preparing a specially equipped bZ electric crossover for Waymo’s driverless ride-hailing fleet, with operations planned to begin in Japan in 2027 before expanding to the UK and other supported markets.
Nissan’s SEMA lineup now totals six concepts, led by an especially radical open-top Armada built for extreme off-roading.
Nismo Nick is bringing two radically different ladder-frame Pathfinder projects—the Trackfinder and Trailfinder—to SEMA in celebration of the nameplate’s 40th anniversary.