A two-week test by Australian broadcaster Four Corners and Canberra-based researcher Dan Hreszczuk reportedly showed how a BYD Shark 6 could be remotely accessed. Hreszczuk said the entry point had no password, allowing him to control several vehicle functions from a laptop. During a demonstration, he locked the doors, played music, displayed images on the infotainment screen, operated the windscreen wipers, sprayed the windscreen and repeatedly switched the headlights on and off.
While a reporter drove at about 30 km/h, Hreszczuk also turned the headlights off completely. The brakes and cameras were protected by stronger security controls and were not accessible in the test.
The researchers also tracked the vehicle’s location in real time and activated its cabin microphone. Audio captured a conversation containing a temporary internet-banking password. Hreszczuk then used a recording of the driver saying “Hey Siri” to prompt the driver’s phone, via the car’s speakers, to reveal personal details and a contact’s telephone number.
The report presents this as a demonstration of potential surveillance and data exposure, not evidence that the capability was being used maliciously against customers.
The article says Australia has no minimum cybersecurity standards for cars requiring manufacturers to patch software or maintain formal risk-management processes. The government is consulting industry on new rules, but they are years from taking effect. BYD said Australian customer data is stored in Australia and that it has never handed data to Chinese authorities.
Australian intelligence officials have advised ministers and public servants not to discuss sensitive information inside such vehicles or connect work devices to them.