Car cybersecurity firm sees consumers emerging as hackers

Add vehicle owners to the growing list of potential cybersecurity threats against automakers in 2023.

Early adopters of new digitized offerings from automakers will find ways to bypass premium features by manipulating their vehicles' systems fraudulently, according to executives from Israeli cybersecurity firm Upstream.

Speaking at a cybersecurity webinar in January, the Upstream team said consumers may push back as automakers launch subscription-based services and features in new vehicles.

Automakers -- from BMW and Tesla to Volkswagen, Toyota and General Motors -- have offered monthly subscriptions for services like heated seats, global positioning systems, music streaming and remote keyless start functions with varying degrees of success.

An April 2022 survey from Cox Automotive suggested that consumers are hesitant to pay extra for apps and subscription services.

"We don't believe in asking people to pay $10 to get heated seats," Volvo Deputy CEO and Chief Commercial Officer Bjorn Annwall recently told Automotive News Europe. "The things we want to sell will provide a distinct consumer benefit. Then you can charge for it."

With fleet operators increasingly dependent on mobility applications, malicious hackers will exploit application programming interface vulnerabilities and leverage the data created by them for financial gain, Upstream executives said. APIs are a set of definitions and protocols that allow different software to communicate.

In 2022, the number of automotive and smart mobility API-related hacks increased by 380 percent over 2021, accounting for 12 percent of total incidents, according to Upstream.

APIs underpin electric vehicle charging stations and will provide another entryway for black hat hackers to attack these systems. The technology and software supporting EV charging stations will need to focus on cybersecurity detection and mitigation, Upstream executives said.

Hacks against EV charging infrastructure made up 4 percent of total auto-related cybersecurity breaches last year.

The threat to fleets' sensitive data coupled with the rise in EV charging infrastructure attacks represents a serious risk to public safety that will lead transportation policymakers and lawmakers to draft next-generation automotive cybersecurity regulations in 2023, Upstream executives said.

Another emerging cybersecurity development for 2023 is increasing automation of virtual security operations centers, which allow automakers to monitor the security of their systems in real-time.