BMW hackers rewarded for flagging security flaws
Security company uncovers vulnerabilities in several BMW models, enabling the marque to issue software patches
A team of ‘white hat’ hackers has uncovered 14 software and hardware vulnerabilities in a range of BMWs after carrying out what BMW says is the “most comprehensive and complex testing ever conducted” by a third-party company.
The hackers found a range of vulnerabilities in the BMW i3 and X1, as well as the previous-generation 5 Series and 7 Series. Eight of the flaws related to the cars’ infotainment systems, four were linked to their telematics units, and two concerned the vehicles’ on-board diagnostics’ gateway.
The Chinese cyber-security firm that uncovered the flaws, Tencent Keen Security Lab, said “these attack chains could be utilized by skilled attackers at a very low cost”, adding they would allow hackers to “trigger or control car functions over a wide-range distance”.
While nine of the attacks required a physical connection to be made between the cars and hacking equipment, five could be enacted remotely by exploiting weak points in Bluetooth and GSM connections, as well as BMW’s ConnectedDrive infotainment services.