Loading story…
Security researcher Dan Hreszczuk of Fortify Labs demonstrated remote access to a BYD Shark 6 through an allegedly unprotected, passwordless entry point. In a controlled test near Canberra, he manipulated door locks, headlights, windscreen wipers and washer, infotainment display, audio volume, and music while the vehicle was being driven; he also tracked its location and activated the cabin microphone. The vehicle’s brakes and cameras were not accessible in the demonstration.
The test showed that captured in-cabin voice audio could be used to interact with Siri on an unlocked phone and obtain personal information. The exposure highlights privacy and safety risks in connected vehicles and has renewed attention on Australia’s lack of mandatory automotive cybersecurity standards, while the government consults on potential requirements.
Track how attackers are adapting to this technology.
3 events from the most recent confirmed update back to the earliest known activity.
The Australian government began industry consultations on prospective automotive cybersecurity requirements, as Australia reportedly lacks mandatory car-specific cybersecurity standards. The report said implementation of the proposed rules remains years away.
Hreszczuk replayed a recording of reporter Angus Grigg saying “Hey Siri” and sent further spoken queries through the vehicle speakers to activate Grigg's unlocked phone. The demonstration retrieved Grigg's home address, date of birth, age, and a contact number for former Prime Minister Malcolm Turnbull.
During a two-week Four Corners security test, Fortify Labs researcher Dan Hreszczuk found a BYD Shark 6 entry point with no password protection and used it in a controlled demonstration outside Canberra. He remotely controlled door locks, infotainment, audio, wipers, windscreen washer and headlights, tracked the vehicle, and activated its cabin microphone; the brakes and cameras remained protected.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers at the University of California San Diego disclosed severe flaws in the dealer-installed aftermarket **KARR Security System**, a Bluetooth-enabled alarm and anti-theft device estimated to be present in more than **2 million U.S. vehicles**. The vulnerabilities allow an attacker within Bluetooth range to silently unlock doors, disable alarms, trigger horns and lights, and even block the engine from starting, creating both theft and roadside immobilization risks. The researchers said the issue stems in part from a shared embedded authentication key used across KARR devices, which they extracted by reverse-engineering the official mobile app and validating with a proof-of-concept Android tool. The findings also raised privacy concerns because KARR devices broadcast identifiable Bluetooth signals that could be correlated with public WiGLE data to estimate deployment and potentially infer vehicle movements or frequently visited locations. **Acrisure Protection Group**, which sells the KARR system, released a firmware update after responsible disclosure, but remediation requires owners or dealerships to identify the hardware and manually apply the patch through the KARR smartphone app. Researchers warned that many drivers may not realize the device is installed, because it is often added by dealerships and can remain in vehicles after resale.
Aug 5, 2026
Researchers disclosed a critical flaw in Subaru’s **STARLINK** connected vehicle platform that allowed takeover of an employee-facing admin portal and unrestricted access to customer accounts in the United States, Canada, and Japan. The attack chain reportedly combined an unauthenticated password-reset endpoint, user enumeration, and a client-side-only two-factor authentication barrier that could be bypassed, enabling attackers to look up drivers using identifiers such as name and ZIP code, email address, phone number, VIN, or a VIN derived from a license plate. With admin access, an attacker could remotely perform actions including **locking or unlocking doors**, starting or stopping supported vehicles, adding themselves as an authorized user, and tracking a car’s real-time and historical location data for up to a year. The exposed records also included PII, emergency contacts, billing-related details, vehicle PINs, support history, odometer readings, prior ownership, and sales history; researchers demonstrated unlocking a friend’s Subaru without any user notification. Subaru said it patched the issue within 24 hours of disclosure, and the researchers reported no evidence of malicious exploitation.
Jul 23, 2026
A newly disclosed vulnerability, **CVE-2026-18411**, affects Acrisure **KARR BT** and **DR-100** automotive anti-theft systems by using a shared hard-coded Bluetooth authentication key across devices. The flaw, classified as **CWE-321**, allows an attacker within Bluetooth range to send unauthorized commands without prior privileges or user interaction, creating a direct path to compromise protected vehicle functions. Security reporting and government advisories warn that successful exploitation could let an attacker unlock doors and interfere with engine immobilization on affected vehicles. The issue carries a **CVSS v3.1** score reflecting high integrity and availability impact (`AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H`), and has been referenced by both a **CISA ICS advisory** and a **CERT-PY** notice covering the Bluetooth product vulnerability.
Aug 8, 2026