On August 27, 2026 in All, Automotive, IoT, Security by Poornima Apte
Modern vehicles can contain roughly 100 million lines of code, reflecting the growing software complexity of connected and automated automotive systems.[1] The assumption that vehicles are manufactured hunks of metal rolling down the road is long outdated. The growing dominance of software in the automotive sector has expanded the attack surface of modern vehicles, placing connected vehicle platforms increasingly in the crosshairs of cyber threat actors.
However, software is no longer the sole target of cyber criminals. Automotive hardware systems now also require cybersecurity. Hardware-level attacks such as laser fault injection (LFI) have attracted increasing attention. In an LFI attack, a precisely targeted laser pulse induces faults within a semiconductor device, potentially leading to instruction skips, authentication bypasses, or other unintended behavior. Such attacks might seem improbable until they are not.
This blog explores why automotive cybersecurity must encompass both software and hardware components.
Understanding the Growing Attack Surface of Modern Vehicles
To understand why cybersecurity must embrace hardware alongside software, it helps to trace how the industry has changed over the last decade.
As automotive technologies have advanced, the number of electronic control units (ECUs) has proliferated, each with complex code and circuitry. Today's vehicles routinely incorporate advanced driver-assistance systems (ADAS), a broad category of technologies that includes lane-keeping, automatic emergency braking, adaptive cruise control, and other perception and control functions. In addition, cars are becoming more connected, receiving real-time traffic information and messages. One of the operating principles of smart cities is that connected vehicles should coordinate with one another for smoother traffic flow. Any of these systems is a likely target for cyberattacks.
As vehicle architectures evolve toward more centralized and zonal designs, principles such as segmentation, isolation, and controlled communication paths become increasingly important. While the approach simplifies cybersecurity implementation, a successful breach could have more catastrophic consequences.
Threat actors can also ride on the coattails of communication protocols. In 2025, researchers disclosed a zero-click wireless CarPlay attack chain in which vulnerabilities in Bluetooth® pairing and iAP2 session setup could be leveraged to access a vulnerable AirPlay software development kit (SDK) path over Wi-Fi®, enabling compromise of affected infotainment systems.[2] In 2015, a pair of researchers demonstrated just how easy it was to take control of a Jeep's infotainment system, ultimately leading to control of key functions like steering and braking.[3] Vehicles use over-the-air (OTA) software updates, vehicle-to-vehicle (V2V) communication, and Bluetooth, cellular, and Wi-Fi connections. Such an assortment requires more gatekeeping to ensure security.
Sources
[1] https://unece.org/sustainable-development/press/un-regulations-cybersecurity-and-software-updates-pave-way-mass-roll
[2] https://cyberinsider.com/apple-carplay-flaws-enable-zero-click-vehicle-hacking-via-bluetooth/
[3] https://fractionalciso.com/the-groundbreaking-2015-jeep-hack-changed-automotive-cybersecurity/
[4] https://diconium.com/en/blog/cybersecurity/automotive-cybersecurity-regulations-and-standards; https://unece.org/wp29-introduction; https://www.iso.org/standard/70918.html
[5] https://www.cyber.gc.ca/en/guidance/top-10-security-actions-no-5-segment-and-separate-information-itsm10092
>>Read the entire article at Mouser
