Security1 publisher2 min readPublished
Fortify Labs researcher switched off a moving BYD Shark 6's headlights from the roadside
Dan Hreszczuk found that the way into a BYD Shark 6's vehicle functions had no password on it, and over two weeks he reached the doors, wipers, headlights, cabin microphone and live location. The brakes and cameras held.
The Watch · Security desk
What happened
- ABC's Four Corners and Canberra researcher Dan Hreszczuk spent two weeks testing what could be seen and done remotely to a BYD Shark 6, including by anyone with access to BYD's systems in China.
- The brakes and the cameras sat behind stronger security measures, and Hreszczuk was not able to reach either of them during the test.
- He also tracked the car in real time through central Canberra and turned on the cabin microphone, which picked up Grigg reading out a temporary password made from his initials, house number and date of birth.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- exposure The recoverable loss here is spoken data. A one-time password read aloud on a phone call in the cabin becomes a credential sitting in somebody else's audio, and the occupants get no indication the microphone is live.
- constraint There is no CVE, no patch date and no affected-vehicle count to cite, so a fleet buyer has nothing to attach a contractual security condition to and is left writing a usage policy instead.
- decision Operators running these utes now have to decide whether to extend ASIO's rule for officials to their own staff: no work devices paired, no sensitive calls taken in the cabin.
- contradiction Australian policy points two ways at once, with ASIO's warning to officials on one side and the trade minister's public endorsement of the tested model on the other.
There was no exploit chain. According to Security Affairs' account of the Four Corners test, the entry point into the software that controls many of the Shark 6's functions had nothing protecting it, so getting in needed no stolen credential and no proximity to the car [3]. Hreszczuk runs Fortify Labs in Canberra and works on car security for a living [2]. "It was easier than we were expecting," he said [4].
Reporter Angus Grigg drove at about 30 km/h on a straight country road while Hreszczuk worked from a laptop on the shoulder [5]. At that speed the ute covers roughly 8.3 metres a second, so each second the headlights stayed off put about eight metres of unlit road under it [17]. The braking system and the cameras were behind stronger protections, and he could not reach either [8].
The ABC report described the sequence: "First, he locks the doors while I'm inside, blasts music over the speakers and plays images on the BYD's giant infotainment screen" [9]. Then the wipers went to their top setting, the washer sprayed, and the headlights went on and off before going off entirely in the dark [6][7].
Basic access also gave passive collection. Hreszczuk tracked the vehicle in real time as it moved through central Canberra and switched on the cabin microphone [10]. Grigg was on the phone to his mother, helping her set up internet banking, and read out a temporary password built from his initials, his house number and his full date of birth. The microphone picked it up [11].
The account does not identify the endpoint, and it includes no response from BYD and no fix date [18]. That matters for anyone trying to turn this into a purchasing condition: there is no advisory to reference and no count of affected vehicles.
What is available today is a usage rule. ASIO has told ministers and public servants not to discuss sensitive information inside these cars or connect work devices to them, while private buyers face no restriction [14]. Britain's military went further last year, banning Chinese-made EVs from parking within 3 kilometres of its most sensitive sites [12], and China keeps foreign EVs away from its own military and political areas [13]. A distance rule covers a microphone and a location feed; it leaves the vehicle control functions where they were.
Trade Minister Don Farrell drives the same BYD Shark model that was tested, and has publicly described it as the best ute he has ever owned [15].
What to watch
- Whether BYD confirms the unauthenticated endpoint and gives a date for closing it.
- Whether Fortify Labs or Four Corners publish technical detail, or an advisory identifying the endpoint and affected model years.
- Whether Australia moves from ASIO's advisory to a parking or fleet restriction of the kind the UK military applied.