Why millions of connected vehicles need automated cyber security

The spectacular, but ultimately harmless, hacking of the My Volkswagen app by an Indian cyber researcher last year continues to raise serious questions about cyber security for millions of connected vehicles, triggering demands for more rigorous secure-by-design approaches.

Serious flaws in the My Volkswagen app made it all too easy for the researcher, Vishal Bhaskar, to gain access to large amounts of personal and vehicle data.

It was after he bought a second-hand VW vehicle and tried to register it on the app that Bhaskar found there was insufficient protection against brute force attacks for the one-time-password verification endpoint.

He was able to arrive at the correct combination of four digits through automation. He then uncovered internal usernames, passwords, tokens and credentials for third-party ...