Modern cars are no longer static machines once they leave the showroom. Increasingly, they are becoming software-defined vehicles that receive new features, bug fixes, and security patches wirelessly, just like smartphones. But while over-the-air (OTA) updates have made car maintenance easier and cheaper, cyber security experts warn that the technology could become one of the biggest security challenges in the auto industry.
Researchers and policymakers are now calling for stricter oversight as connected cars increasingly rely on remote software updates. Their concern isn’t just about hackers stealing personal data. It is about a person who may interfere with the operation of a moving vehicle.
The convenience of wireless updates comes with new risks
OTA technology allows manufacturers to remotely deliver software updates, firmware upgrades and security patches without requiring owners to visit a retail location. Tesla popularized this concept more than a decade ago when it started rolling out wireless updates to the Model S in 2012. Today, this feature has become commonplace in mainstream and mainstream cars alike.
For consumers, the benefits are obvious. Automakers can quickly fix software bugs, improve battery management, add new infotainment features or improve driving performance without removing expensive memories. According to a CNBC report citing Siraj Ahmed Shaikh, Professor of System Security at Swansea University, OTA updates have become an attractive alternative to traditional operations because they reduce costs and shorten deployment times. Instead of waiting for scheduled maintenance, manufacturers can address problems almost immediately.
However, the same always-connected architecture that enables these updates also creates a large attack surface. Cybersecurity analysts say that internet-connected cars are effectively like roaming computers. If attackers were to compromise the update infrastructure or gain privileged access to the vehicle’s software, the consequences could extend beyond data theft.
Gabriel Lim, Senior Analyst at the Singapore S. Rajaratnam School of International Studies, told CNBC that the issue reflects potential national security concerns. Aside from questions about user privacy, governments are increasingly examining whether foreign manufacturers or malicious actors can remotely tamper with vehicle systems. That concern has prompted many countries to reevaluate how connected cars should be regulated.
Governments are beginning to take this threat seriously
The debate heated up after Norway’s public transport regulator Ruter carried out safety tests on electric buses last year. The company reported that one vehicle’s battery and power management system can be accessed remotely through a mobile network connection. In theory, it concluded, the operator can disable or block the bus remotely.
Although the investigation focused on buses manufactured by the Chinese company Yutong, experts warn that the problem is not confined to any one car maker or country. Instead, they see it as an industry-wide challenge tied to the growing adoption of connected car platforms. The findings prompted authorities in the United Kingdom and Denmark to launch their own investigations, with the UK Department of Transport working with the National Cyber Security Center to assess potential vulnerabilities.
Similar concerns are beginning to shape policy discussions in the United States. Earlier this year, the American Enterprise Institute pointed out that protecting vehicles linked to foreign spies should be a priority. The think tank recommended a strong security review, more transparency about vehicle data collection, and tighter restrictions on imported vehicle software and hardware.
The results extend beyond passenger cars. OTA technology is increasingly finding its way into buses, commercial vessels, rail systems, ships, industrial robots and drones. As critical infrastructure is updated remotely, experts say cybersecurity can no longer be treated as an afterthought. Wireless updates undoubtedly make cars smarter and more capable. But they are also changing the definition of car safety. In the software-defined era, protecting a car increasingly means protecting the code that runs inside it, because the next cyberattack may not target your laptop or smartphone. It can identify the car you are driving.
