Leading up to BYD’s response, Four Corners asked for the help of cybersecurity expert and co-founder of Fortify Labs, Dan Hreszczuk, to see how he can hack a Chinese electrified vehicle given that its software is controlled from China.

After two weeks with a BYD Shark DMO, the researcher found an unprotected (no password) digital access point on the vehicle. This flaw allowed remote tracking and access to the in-car microphone while being driven on public roads with Hreszczuk noting “it was easier than [they] were expecting.”

In a demonstration staged for Four Corners, Hreszczuk showed that he was capable of listening into in-car conversations and even got to eavesdrop on info such as internet banking details. He was also able to get the driver’s home address.

Even more worrying, Hreszczuk was able to issue vehicle commands such as locking/unlocking doors, playing music over the speakers and even displaying images onto the infotainment screen. He could even turn the lights on and off and operate the wipers.

For its part, BYD says it took the cybersecurity claims of the investigative program very seriously and acknowledged the issue surrounding the Shark 6 DMO’s so-called Android Debug Bridge or ADB. ADB, while disabled by default and can only be accessed by special tools, allows a person to install an untrusted third-party application.

BYD engineers in their investigation were able to reproduce both the software defect used to enable ADB and the subsequent installation of an untrusted third-party application.

That said, when the application requested access to certain information or functions, such as the vehicle’s location or microphone, the infotainment system displayed a permission prompt. The requested permissions could only be granted after the user manually approved the request through the infotainment interface.

Regarding the operation of in-vehicle controls, BYD maintains that control can only be done via direct physical access to the vehicle’s internal CAN bus. This method requires physical intervention on the target vehicle and is limited to the individual vehicle that has been physically accessed. Without physically tapping into the vehicle wiring, any external device seeking to access the relevant vehicle network would need to do so via the On-Board Diagnostics (OBD) interface.

Here, BYD reiterates that it has implemented security measures for the OBD interface, including device authentication and physical isolation, and has established corresponding cybersecurity safeguards in accordance with the requirements of UN R155.

Moving forward, BYD will initiate corrective action, especially with regards to the ADB-related software. In a planned Over-the-Air (OTA) update, it will remove the “unintended pathway” that allows ADB to be enabled through the infotainment system user interface.

Meanwhile, regarding CAN bus cybersecurity. BYD has also initiated a dedicated risk assessment. This assessment will evaluate the necessity and technical feasibility of additional measures relating to CAN message authenticity, integrity, and freshness verification. Any further technical improvements will be determined based on the outcome of this assessment.

Curiously, in the days after Four Corners asked BYD to respond to its privacy policy questions, BYD removed any reference to “China” and “surveillance” from its privacy policy, in Australia at least.

The original policy gave the company almost unlimited powers to collect data on its Australian vehicle owners and broad discretion over how it could disclose it.

It said the data could be gathered “in connection with suspected illegal or improper activities” and that this could be done through “surveillance activities”.

The policy named China as one of 16 countries where Australians’ data could be sent.

The new policy was uploaded to BYD’s Australian website just an hour and 16 minutes before the company sent it to Four Corners.

Confusingly, the website said its new policy no longer applied to vehicles and directed users to a separate document on its app.