Unauthenticated BYD Shark 6 Flaw Enables Remote Vehicle Control and Cabin Audio Access

Security researcher Dan Hreszczuk of Fortify Labs demonstrated remote access to a BYD Shark 6 through an allegedly unprotected, passwordless entry point. In a controlled test near Canberra, he manipulated door locks, headlights, windscreen wipers and washer, infotainment display, audio volume, and music while the vehicle was being driven; he also tracked its location and activated the cabin microphone. The vehicle’s brakes and cameras were not accessible in the demonstration.

The test showed that captured in-cabin voice audio could be used to interact with Siri on an unlocked phone and obtain personal information. The exposure highlights privacy and safety risks in connected vehicles and has renewed attention on Australia’s lack of mandatory automotive cybersecurity standards, while the government consults on potential requirements.