Connected cars: reading the risks beyond the dashboard
· BehindLines newsroom
A connected car calls for a wider view of security: a phone application or a remote service also belongs to the vehicle’s digital surroundings. A University of Gothenburg communication dated 21 October brings the issue into focus through research published in September.
What the figures actually describe
The work by Srijita Basu and colleagues, published in Software Quality Journal and listed by Chalmers, examines 413 software vulnerabilities recorded between 2022 and September 2024. It analyses reported weaknesses, rather than counting cars that were successfully hacked.
That distinction matters when reading the number. A vulnerability describes a weakness; an attack requires someone to exploit it under particular conditions. Without knowing the installed software versions, available fixes and access requirements, the total cannot tell a driver how likely an incident is. Nor does it provide a ranking of manufacturers for someone choosing a car.
Where does the vehicle begin and end?
The study maps weaknesses across four groups: onboard components, external services, development tools and communication platforms.
The value of this approach therefore reaches beyond the computer inside the car. One way to understand a connected service is to follow a request: from a phone application to a user account, a remote server and finally a function offered in the vehicle. Every handover raises a separate question: who may request what, with which permission and involving whose data?
This is a way of reading a system, rather than a reconstruction of an attack disclosed today. It helps distinguish exposure of information from interference with vehicle controls, two consequences that the broad word “hacking” can easily blur.
The useful questions then concern responsibility: who maintains each component, who distributes a fix, and how can its application be checked? A vulnerability count draws attention. Those questions help explain what the count can actually mean for the system being examined.