Study finds rising cyber risks in connected car apps and cloud services

In a paper published in Software Quality Journal, scholars from Göteborgs universitet and Chalmers tekniska högskola reviewed 413 documented security vulnerabilities in car-related software between 2022 and 2024. Their analysis shows that, unlike ten years ago when most issues were found in the vehicle’s internal systems, today the majority arise in external components like mobile apps, web portals and cloud services, with the proportion of such risks tripling.

These external systems store sensitive information, including driver residence and trip details, which could be accessed by attackers. The authors highlight that many of the flaws are basic, such as default passwords that have never been changed. They also warn that a car’s infotainment and media systems can serve as entry points for hackers, citing a test where researchers accessed a 2015 Jeep Cherokee’s media interface to control steering, throttle and brakes. The study recommends that manufacturers isolate critical driving functions from other IT components.