BYD Shark 6 Software Defect Confirmed: OTA Update Incoming Following Hacking Investigation

BYD Australia has committed to deploying an over-the-air (OTA) software update for the Shark 6 plug-in hybrid ute after an internal investigation confirmed a defect within its infotainment system. The investigation followed an ABC Four Corners broadcast, during which Canberra-based cybersecurity firm Fortify Labs demonstrated unauthorized access to the vehicle's location, intercepted phone calls, and manipulated exterior hardware.

According to BYD’s technical analysis, the breach of the heavily customised, Android-based 'DiLink' infotainment system was achieved by exploiting the Android Debug Bridge (ADB)—a developer tool typically used for debugging that is disabled by default when the vehicle leaves the factory.

"The researcher exploited a software defect to enable the ADB and subsequently install an untrusted third-party application," BYD stated. The automaker noted that accessing the ADB required special tools and initial physical access to the vehicle. Furthermore, accessing vehicle data such as the microphone or location triggered on-screen permission prompts. “The requested permissions could only be granted after the user manually approved the request through the infotainment interface,” BYD confirmed.

To resolve the vulnerability, BYD is finalising an OTA update. "The corrective action will address the identified ADB-related software issue and remove the unintended pathway that allows ADB to be enabled through the infotainment system user interface, thereby eliminating the access path identified during the investigation," the company stated. The update will be released once rigorous validation testing is complete, and BYD is investigating whether similar updates are required across its broader Australian vehicle lineup.

Hardware Manipulation and CAN Bus Security

The most dramatic elements of the Fortify Labs demonstration—disabling the headlights and activating the windscreen wipers while the vehicle was in motion—were achieved through entirely separate means.

“BYD’s technical analysis has confirmed that the demonstrated control of the vehicle’s headlights and windscreen wipers required direct physical access to the vehicle’s internal CAN bus by tapping into the vehicle wiring,” the automaker stated. Because the test vehicle spent two weeks with Fortify Labs prior to the demonstration, researchers were able to physically tap into the wiring harness. “This method requires physical intervention on the target vehicle and is limited to the individual vehicle that has been physically accessed," BYD clarified.

BYD confirmed it is conducting a dedicated risk assessment to explore additional verification measures for CAN messages, highlighting that its On-Board Diagnostics (OBD) interface already utilises device authentication and physical isolation in accordance with UN R155 cybersecurity standards.

Addressing the broader industry context, BYD Australia Chief Operating Officer Stephen Collins emphasized that vehicle security is treated with the highest priority and that personal data generated by BYD vehicles in Australia is stored locally.

"We have publicly called for purpose-built connected vehicle legislation in Australia – a clear, enforceable standard applying equally to every brand in this market," Collins said. "We welcome that scrutiny and would comply fully with any such framework."