BMW ConnectedDrive hack sees 2.2 million cars exposed to remote unlocking

BMW has patched a security flaw which meant hackers could remotely unlock the doors of more than two million Rolls-Royce, Mini and BMW vehicles.

Researchers from ADAC, a German motorist association, created a fake mobile phone network and tricked nearby cars into connecting to it. From there, they could intercept communications with BMW's ConnectedDrive service and unlock the doors.

ConnectedDrive uses a SIM card installed in the car to connect to a smartphone app over the internet. The owner can use the app to remotely switch on the heating or air conditioning, sound the horn, and lock or unlock the car.

BMW said the researchers had "reverse engineered some of the software that we use for our telematics. With that they were able to mimic the BMW server."

The company said it has begun issuing an over-the-air software update to the 2.2 million affected vehicles, adding HTTPS encryption to the connection between the vehicles and BMW's server.

BMW added that it has not come across any cases where the hack had been used maliciously.

The vulnerability was unearthed as car makers seek to embed more technology than ever, prompting security experts to raise concerns over how safe the systems are.

Speaking to IBTimes UK last year, Mark O'Neill of software company Axway warned: "I think we are going to see more malicious attacks [on connected vehicles]. If someone finds a vulnerability in an internet-enabled car you could have the same situation that you have now for browsers...it doesn't take much imagination to think of the abuse this could cause."

But just as connected cars face the threat of malware and hacking, it also means software updates can be quickly distributed without calling vehicles back to the dealership. Tesla boss Elon Musk recently said the Model S P85D electric car will gain faster acceleration through a future software update.

Tesla also offers some control of its cars over the internet. Owners can log into an iPhone and Android app to control the heating, check how charged the batteries are, monitor the car's speed and position on a map, and unlock the doors.