BYD has moved quickly to address cybersecurity concerns surrounding its popular Shark 6 pickup after an Australian documentary demonstrated how it could be hacked. The Chinese automaker has also explained how the researcher gained control of the plug-in hybrid’s headlights and windshield wipers.
For the ABC’s Four Corners program, cybersecurity specialist Dan Hreszczuk was provided with a Shark 6 for two weeks. During that time, he was able to listen through the cabin microphones, operate the door locks and interfere with the vehicle’s audio. The program withheld the specific hacking method to avoid providing useful instructions to other attackers.
BYD says it has determined how the access was achieved. The company says Hreszczuk breached the infotainment system’s Android Debug Bridge (ADB) using a specialist tool, then installed an untrusted third-party application. BYD reproduced the vulnerability in its own testing, but says accessing the vehicle’s location data and microphone required the driver to approve an on-screen permission request—something the documentary did not reveal.
BYD says it is developing an over-the-air update to close the route used to activate ADB, which is normally switched off. The company has not announced when the update will be available, but says other models will receive the software as well if similar vulnerabilities are identified.
What the Documentary Did Not Tell You
The headlights and windshield wipers raise a separate issue. Four Corners showed the hacker remotely switching on the wipers and turning off the headlights while the Shark 6 was being driven at night. BYD says carrying out those actions involved considerably more than loading third-party software.
According to BYD, the researcher connected to the vehicle’s wiring and reached its internal CAN bus, a process that cannot be completed remotely from a computer. Hreszczuk confirmed in a blog post that he spliced into the Shark 6’s wiring and fitted an inexpensive Raspberry Pi computer—an approach that could be reproduced on many other new vehicles.
To reduce the risk of an OBD device being used to reach critical vehicle functions, BYD says it has added security measures to the OBD interface. The system will now require physical isolation and device authentication.
BYD says a cybersecurity researcher accessed the Shark 6’s infotainment system by enabling Android Debug Bridge and installing an untrusted application, while control of the headlights and wipers required physical access to the vehicle’s wiring and CAN bus. The company is preparing an over-the-air fix, strengthening OBD security and says comparable vulnerabilities in other models will also be addressed.
The Toyota RAV4 remains a popular compact SUV, but its value and capabilities face strong competition from five hybrid alternatives.
Volkswagen has owned Bentley since 1998, but the luxury marque remains closely tied to its historic Crewe factory, where its current models are assembled in England despite their extensive German engineering and component links.
Tesla’s latest Roadster remains unconfirmed for production, but its dramatic debut included airborne stunts that few cars could match.
A fire at Frank Kent Cadillac in Fort Worth, Texas, destroyed six electric SUVs believed to be Cadillac Escalade IQs and took nearly 18 hours to bring under control.
A Ferrari F50 with just 106 miles on its odometer is expected to surpass $20 million at auction on October 31, potentially setting a new record for the model and highlighting its rapid rise in collector value.