Connected Car Hacks Range From a 2015 Jeep to a 2024 Kia Plate Flaw

In 2015, researchers took complete control of a Tesla Model S. By the time they presented the work at the DEF CON hacking conference, Tesla had pushed a fix to every Model S in the world overnight, the first proactive mass security update delivered over the air to vulnerable cars.

That outcome was the good ending. A modern car is a network of small computers wired to radios, phones and servers, and every link is a place where a flaw can sit.

What is a connected car?

A connected car is one that can communicate in both directions with systems outside itself. The link can serve passengers with music, navigation and local business listings, or it can support self-driving features through coordination with other cars, software updates and ride-hailing integration. For safety-critical uses, cars are expected to rely on dedicated short-range communications or cellular radios in the 5.9 GHz band, which offers very low latency.

The first connected-car features reached the market in 1996 with OnStar in the Cadillac DeVille, Seville and Eldorado. General Motors built it with Motorola Automotive, and its purpose was safety: a cellular call routed to a call centre, where an agent sent help after a crash. At first it carried only voice, but once cellular networks added data it could send GPS location to the call centre as well. Other carmakers followed with similar programmes, usually with a free trial on a new car and a paid subscription after that.

Remote diagnostics arrived in 2001. By 2003 services included vehicle health reports and turn-by-turn directions, and data-only telematics, sending telemetry with no voice call, started in 2007. In the summer of 2014 Audi became the first automaker to offer a 4G LTE Wi-Fi hotspot, and General Motors made the first mass deployment of 4G LTE. OnStar was soon handling requests by the billion: 1 billion had been processed by 2015.

A car can be connected in seven ways, grouped as vehicle to everything, or V2X: to infrastructure, to other vehicles, to the cloud, to pedestrians, to devices such as phones, to a cell network, and to the power grid. Vehicle to grid lets an electric car both draw power and send it back, so parked cars can act as decentralised energy storage.

The hardware is either built in or brought in. Built-in telematics boxes usually have their own mobile connection through a GSM module and are tied into the car's IT system. Brought-in devices mostly plug into the OBD port, which supplies power and access to vehicle data, and either borrow the owner's phone for internet or carry their own GSM module. In Europe the built-in kind was driven largely by rules for an automatic emergency call, eCall, which is mandatory in the EU.

A modern car is a network of small computers wired to radios, phones and servers, and every link is a place where a flaw can sit.

What does a connected car transmit?

Quite a lot. Its location goes to emergency services after a crash. Diagnostic data, vehicle condition and usage data flow to the maker. Phone apps let owners unlock the car, check the battery of an electric one, find where it is parked and start the climate control remotely. Insurers receive real-time data on speed, routes and time of travel, and predictive modelling and machine learning based on it are changing how they work.

Cooperative safety systems would transmit far more often. The proposal from the US National Highway Traffic Safety Administration, for which rulemaking began on 13 December 2016, was to mandate dedicated short-range communications in new light vehicles. Each car would broadcast a basic safety message up to ten times per second giving its location, heading and speed. In March 2017 General Motors became the first US automaker to fit the technology as standard on a production car, the Cadillac CTS. The United States has the IEEE 802.11p standard, and Europe has a harmonised frequency and a standard called ETSI ITS-G5. The EU has not moved to make manufacturers fit it, and discussions on privacy and security rules are ongoing.

How is a modern car wired?

Inside the car sit electronic control units, or ECUs, which process everything from engine and brake control to the touchscreen. They began appearing in the early 1970s, when integrated circuits and microprocessors made them cheap to produce at scale. Since then the number has climbed, to as many as 100 per vehicle by one count.

The units talk over several networks. The Controller Area Network, CAN, links components such as the engine and brakes. A Local Interconnect Network covers low-cost links, from door locks to cabin lights, while Media Oriented Systems Transport serves infotainment, and FlexRay carries high-speed data for things like active suspension and active cruise control. Bluetooth, 4G hotspots, Wi-Fi and radio-frequency links, for example in tyre-pressure sensors, are added on top.

CAN is the most common network and the one used for safety-related messages, because it works in real time and is simple and cheap. That is why most real-world attacks have targeted ECUs on a CAN network. It is a bus, so every node on it hears all of the traffic.

Researchers call the ways into a car attack surfaces and sort them by range. LTE and the short-range radio used for vehicle-to-vehicle messages count as long-range. Bluetooth and Wi-Fi are short-range, and USB, the OBD-II port and anything needing physical access are local. An attacker able to strike from a distance is rated more dangerous than one who has to touch the car.

Can cars be hacked?

Researchers have shown it repeatedly. The attacks fall into a few categories. Sniffing means listening to traffic on the network, which is easy on a bus where every node hears everything. Denial of service makes a network or a single control unit unavailable, either by abusing the way CAN decides which message goes first or by flagging a victim's messages as faulty so that it shuts itself off. Spoofing means sending messages that pretend to come from another node, either by replaying captured traffic or by writing new messages.

In 2010 researchers attacked an ECU directly, which needed physical access, and used it to override the car's controls. They took charge of every safety and automotive system they tried, brakes included, and could stop the engine. A follow-up paper in 2011 showed physical access was not even necessary. Remote exploitation was feasible through mechanics' tools, CD players, Bluetooth and cellular radio, allowing long-distance control, location tracking, recording of in-cabin audio and theft. A hacker could reach the vital controls through almost anything that connects to the car.

What was the Jeep hack?

The best-known demonstration came in 2015, when Charlie Miller and Chris Valasek remotely accessed a wide range of controls on a Jeep Cherokee. They controlled the radio, the climate controls and the windscreen wipers, along with some engine and brake functions. Fiat Chrysler's UConnect system, the internet-connected feature that runs the infotainment and navigation and sits on over 1.4 million cars, contained vulnerabilities that let attackers scan for cars with the system, connect to them and embed malicious code.

Miller's method involved a pre-programmed chip on the CAN bus, which let him send arbitrary messages onto it, and he pointed to the danger of a bus that broadcasts its signals to everything attached. All of it was done remotely, with no physical interaction. Miller said that any of roughly 1.4 million US vehicles was within reach wherever it was, provided it had been switched on. The work replicated earlier academic work from 2010 and 2011, but it reached a far wider public.

In the Tesla case that year, Marc Rogers and Kevin Mahaffey found a series of remote and local entry points and chained them together. After exploitation they could control the car from an iPhone and install a backdoor for persistent access, a technique more usually associated with ordinary computers. They worked with Tesla to resolve the issues before disclosure.

Apps and keys have been targets too. A flaw in the General Motors OnStar RemoteLink app let hackers impersonate the victim and use every feature available to the owner, including locating, locking, unlocking and starting the car. Samy Kamkar built a device that captures signals from key fobs and could then unlock doors and start the engine.

How do thieves get into connected cars?

Real theft has used simpler routes. Since 2021, social media videos have shown post-2010 Kia and post-2014 Hyundai vehicles without engine immobilisers being stolen with a USB plug cable or pliers. Kia started fitting immobilisers in 2022.

In 2022, thieves armed with a counterfeit gadget bought on the dark web forced a headlamp open, reached the CAN bus and simulated the signals that start the vehicle. The attack needs time and privacy, because it requires removing vehicle hardware, sometimes bumpers. The only way to stop determined and knowledgeable thieves might be for designers to scramble the traffic on the CAN bus with encryption.

On 11 June 2024, a group led by Sam Curry found a weakness in Kia's web portal that let them take over the online features of any Kia built after 2013. It did not reach the driving systems, but with a custom application they could scan a licence plate and then track the car, unlock it, sound the horn or start the ignition. The cause was inadequate authentication in the dealer system, which led to an owner's name, phone number and email address. Replacing the email on an owner's account made the attackers secondary users with no alert to the owner, since there was no notification system. Kia patched the portal quickly, and the same group found similar problems at a number of other makers, including Ferrari, BMW, Rolls Royce, Porsche and Toyota.

Researchers at PCA Cyber Security disclosed PerfektBlue in July 2025: four linked flaws in OpenSynergy's BlueSDK Bluetooth stack, which is common in infotainment systems. Chained, they could let someone within Bluetooth range run code on the car's infotainment unit after, at most, a single user action, with possible exposure of GPS position, in-car audio and stored contacts. Proof-of-concept attacks worked on units from Mercedes-Benz, Volkswagen and Skoda. Patches had gone to OpenSynergy's customers in September 2024.

How do makers approach connected car security?

Countermeasures have been proposed since the early 2000s, and the most common are layered.

• Sub-networks keep the most critical control units away from those that can be reached remotely.
• Secure gateways, or firewalls, stop messages crossing between sub-networks unless they were meant to.
• Intrusion detection systems put a node on each critical sub-network to read all traffic and flag messages that break the rules.
• Authentication protocols add proof of origin on networks that lack it, such as CAN, by letting part of each message's data vouch for the message.
• Hardware security modules sit between a control unit and the network, because many units are too weak to run encryption in real time.
• Intrusion detection and forensic measures are reactive, addressing basic weaknesses after the fact.

Over-the-air updates are a defence of their own, as the Model S patch shows. Regulation is arriving as well. The UN's European economic commission put out R155 and R156 in June 2020; they set performance and audit requirements that carmakers must meet on cybersecurity and software updates.

Where this goes next

The regulatory framework is described as the main obstacle to the cooperative applications that depend on cars talking to one another, because questions of privacy and security still need answers. The British weekly The Economist argues that the whole matter is regulation-driven. In the United States, the Michigan Department of Transportation announced in 2020 a pilot of a connected-autonomous-vehicle lane along Interstate 94 between Ann Arbor and Detroit; construction began in 2023, upgrading 3 mi (4.8 km) of the left lane. Over-the-air tune-ups, which need collaboration among dealers, manufacturers and service centres, are among the services described as under development.