The BYD Shark 6 is a 2.6-tonne plug-in hybrid ute (Australian for pickup) that’s become popular with Australian tradespeople and at least one federal cabinet minister. It also turns out to be a pretty good listening device.
Australia’s ABC gave a Shark 6 to Dan Hreszczuk, co-founder of Canberra-based Fortify Labs, for two weeks and asked him to find out what could be seen and done to the truck remotely. His verdict, as told to ABC’s Four Corners: the access point he used had no password at all. “I didn’t need to pick the lock as BYD left the front door open,” he said.
Before anyone starts ripping telematics fuses out of their own truck, it helps to separate what was actually shown from what wasn’t.
What the demonstration actually showed
Everything below comes from the Four Corners account.
Sabotage-style control. On a country road outside Canberra, with reporter Angus Grigg at the wheel, Hreszczuk sat on the shoulder with a laptop and:
- Locked the doors with Grigg inside
- Blasted music and pushed images to the infotainment screen
- Ran the wipers at full speed and fired the washer fluid
- Switched the headlights on and off, then killed them entirely while the truck rounded a bend at night
Grigg was doing about 30 km/h on a fairly straight road. The same trick at highway speed on a winding road would be a different story.
Related articles
- Today in Automotive History: September 24, 1948 — Honda Is Founded With 1 Million Yen and a Bicycle Engine
- 1,043 Radiators, Declared at $5.54 Each. The Parts Weren’t Fake — the Importer Was.
Surveillance. Back in Canberra, Hreszczuk tracked the truck’s location in real time from his lab. Then he switched on the cabin microphone while Grigg called his mother and read out a temporary banking password built from his initials, house number, and date of birth.
The Siri trick. This is the clever part. Hreszczuk recorded Grigg saying “Hey Siri,” spliced that clip together with his own voice asking questions, and played the result through the truck’s speakers while Grigg’s phone sat unlocked in the cabin. The phone answered with his home address, his date of birth, and a contact’s phone number. The truck never had to hack the phone. It just had to talk to it.
What he couldn’t reach. Hreszczuk said the brakes and cameras were well protected, and he didn’t get into them.
What the demonstration didn’t show
This is where a skeptic should slow down.
The attack path wasn’t published. Four Corners doesn’t say whether the password-free access point was reachable over the cellular network, through short-range wireless, or only after hands-on work during the two weeks the truck sat in Hreszczuk’s shop. That’s the most important question for an owner.
- If the first step requires physical access, the risk looks like a theft or planted-device scenario, which is bad but limited.
- If it works over the air, it scales to every Shark 6 on the road.
The report doesn’t say whether BYD was told in advance or has fixed it. It doesn’t mention any patch or disclosure timeline either.
BYD’s response focused on data, not the hack. In the report, BYD said Australian data is stored in Australia and that it has not and would not hand Australians’ data to Chinese authorities. That answers the “where does my data go” question. It doesn’t address whether a stranger with a laptop can listen to your phone calls.
Why your wipers are on the same network as your music
The pattern of what Hreszczuk reached is telling. Locks, lights, wipers, audio, the screen, and the microphone are all comfort and convenience functions, the kind a modern touchscreen can command. Brakes and cameras, which he couldn’t reach, belong to more safety-critical systems.
That’s consistent with a basic design idea in modern cars: keep the infotainment side separated from the systems that stop and steer the car, with some kind of gateway or firewall between them. The separation appears to have held here. But the demo shows something that’s easy to miss.
Every function a manufacturer moves onto the touchscreen is a function the infotainment computer is allowed to command. If headlights, wipers, and door locks can be operated from the screen, then whoever controls the screen can operate them too. Moving physical controls onto a tablet isn’t only a cost-saving move. It widens the reach of whatever breaks into that tablet.
The microphone is the other lesson. A car cabin is built to pick up voices clearly for hands-free calls and voice commands. Wired to a network, that same microphone is a clear channel into your private conversations.
The industry has made this mistake before
In 2015, Fiat Chrysler recalled about 1.4 million 2013–2015 vehicles with Uconnect 8.4-inch radios after security researchers showed they could remotely access and manipulate vehicle networks. That’s documented in NHTSA’s investigation file.
NHTSA’s findings say the fix included FCA and its cellular carrier, Sprint, running a nationwide campaign to block a radio communications port that had been left open by accident, plus software updates. An open port in 2015. No password in 2026. Eleven years apart, the root cause is the same: someone forgot to close the door.
Why rules depend on where you live
Four Corners reports that Australia has no minimum cybersecurity standards for cars, so BYD isn’t required to keep its software updated or maintain a system for managing cyber risk in its vehicles. Australia regulates connected washing machines more than it regulates connected utes, according to the program. The government has only just started industry consultations on car cybersecurity rules, and those likely won’t take effect for years.
Other markets have moved further:
The United Nations standard. UN Regulation No. 155 makes a certified cybersecurity management system part of vehicle type approval in the countries that apply it, according to the EU’s published text. That’s the direction Australia now appears to be heading.
The United States. The Commerce Department’s Bureau of Industry and Security finalized a rule in January 2025 that targets the issue at the source. According to BIS’s announcement:
- Starting with model year 2027, it bans connected-vehicle software with a sufficient connection to China or Russia.
- Starting with model year 2030, it bans the related hardware.
- Also starting with model year 2027, it bars manufacturers with a sufficient connection to China or Russia from selling new connected vehicles in the US, even if the vehicles are built in America.
So a truck like the Shark 6 isn’t coming to US dealerships under the current rules.
Government security agencies. The Four Corners report says the UK military banned Chinese EVs from parking within 3 kilometers of some sensitive sites last year. In Australia, the domestic intelligence agency ASIO has warned ministers and public servants not to hold sensitive conversations in their cars or connect work devices to them. Meanwhile, Trade Minister Don Farrell drives a Shark 6.
Practical takeaways for any connected-car owner
Most of this applies to every brand, not just BYD.
Lock your phone and restrict voice assistants on the lock screen. The Siri attack only worked because the phone was left unlocked in the car. Turning off voice-assistant access while the phone is locked closes that door.
Don’t treat the cabin as a private room. If a phone call would be a problem for someone else to hear, have it outside the car. That advice isn’t unique to Chinese brands. Any connected car with a cabin microphone creates the same exposure if it’s compromised.
Related Articles
- Florida County Has No Idea Where Mysterious LPR Cameras Came From
- Staged Car Crash Bill: What H.R. 10269 Would Actually Change
Install software updates promptly and ask the dealer what’s in them. A patch is often the only fix for this kind of flaw. If a manufacturer can’t tell you whether an update includes security fixes, that tells you something about how seriously it takes security.
When you shop, ask about updates and security policy. Ask how long the manufacturer promises security updates for the model, and whether it runs a vulnerability disclosure or bug bounty program. A company that invites researchers to report flaws is more likely to fix them before someone else finds them.
Check the privacy settings. Look through the infotainment and companion app for options to limit location sharing, data collection, and remote access features you don’t use.
The bottom line
Nobody drove off a cliff and the brakes stayed out of reach, so this isn’t a doomsday scenario. But a researcher spent two weeks with a best-selling truck, found an entry point with no password, and walked away with control of the lights, the locks, the wipers, and a live microphone. The fix for that isn’t complicated. The question is who’s going to require it.
Images Via: BYD