October 30, 2026, 4:32 pm | Read time: 2 minutes
The more connected modern cars are, the larger the attack surface for cybercriminals becomes. A study shows that security issues are increasingly shifting from the vehicle itself to apps and cloud services.
Security Gaps Are Shifting
Modern vehicles are essentially computers on wheels. They communicate with manufacturer servers, transmit data over mobile networks, and can sometimes be unlocked or controlled via smartphone apps. This connectivity offers many practical functions but also creates additional vulnerabilities.
According to a report by “BasicThinking,” researchers examined 413 reported vulnerabilities in automotive software from 2022 to 2024 and compared them with cases from the previous decade. A significant shift was observed: the proportion of security gaps in apps, websites, and cloud services has nearly tripled. As a result, not only vehicle functions but also personal information, such as stored home addresses, travel routes, or travel times, are at risk.
Also of interest: Why you should hold the car key to your head
Ancient Flaw Unpatched? Hacker Exposes Microsoft
CarPlay Gets AI Chatbots–What This Means for Users
Old Mistakes Meet Modern Cars
Successful attacks apparently do not always require new or particularly sophisticated methods. In their analysis, researchers found passwords that had not been changed since installation. Such basic errors provide cybercriminals with known entry points into connected systems.
Researchers view the infotainment system as particularly critical. It handles navigation, music, and other digital services. Problems arise when this technology is not sufficiently separated from security-relevant areas. A successful attack on the infotainment system could theoretically open the way to other vehicle systems.
When Hackers Reach Vehicle Control
Such attacks are fundamentally possible, as security researchers demonstrated in 2015. Through a vehicle’s media system, they accessed other areas and took control of steering, brakes, and the accelerator. The current study found similar vulnerabilities in the period from 2022 to 2024.
Researchers therefore see automakers as primarily responsible. Systems responsible for actual vehicle control should be consistently separated from infotainment, apps, and other connected services. Additionally, securing particularly sensitive areas is necessary. With each additional online function, the digital attack surface of a car potentially grows.