Cybersecurity researcher remotely disables BYD Shark ute, exposing Chinese EV vulnerabilities
A Canberra-based expert demonstrated that he could lock doors, control lights and audio, and access the microphone of a BYD Shark 6 hybrid ute without a password.
In a test outside Canberra, cybersecurity specialist Dan Hreszczuk hacked a BYD Shark 6 hybrid ute, a model popular with tradespeople and even a cabinet minister. After two weeks of analysis, he discovered the vehicle’s remote interface required no password, allowing him to lock the doors, flash the headlights, control the wipers and play audio while the driver was inside. He further activated the car’s microphone, recording a phone call and using the captured “Hey Siri” command to retrieve the driver’s home address, date of birth and contacts, including a former prime minister.
While he could not manipulate the brakes or cameras, the demonstration showed how low-level access could still pose serious safety and privacy risks. The episode underscores concerns that Chinese-made EVs, whose software is managed from China, could be compelled to share data under national security laws. Australia currently lacks mandatory cybersecurity standards for vehicles, prompting the government to begin consultations on future regulations.
Why it matters
It shows how easily Chinese-made EVs can be remotely accessed, raising safety and privacy concerns for drivers.
In this story
