Automotive security researchers have spent the past decade proving that modern cars are also computers, and computers can be hijacked. Some exploits needed nothing more than a vehicle identification number typed into a browser, while others required a nearby laptop or a cheap device bought online. Here are ten vehicles researchers showed they could unlock, start or steer without ever touching them.
1. Infiniti Q50: Hacked Wide Open By Its VIN
A 2023 audit of automakers’ systems found the Infiniti Q50 could be remotely unlocked, started, tracked and made to honk its horn using nothing more than its vehicle identification number. Researchers probing the shared backend behind Honda, Nissan, Infiniti and Acura’s telematics apps found the same bypass worked across the lineup, the Q50 included.
Anyone who copied a VIN off a windshield or a parking receipt could reach the car over the internet from anywhere. The automakers fixed the flaw after the researchers disclosed it, but the finding showed how much of a car’s security rested on one number stamped in plain view.
2. Kia Telluride: A Portal Flaw Exposed Everything
Kia’s web portal held a flaw that let researchers remotely lock or unlock the Telluride, start or stop its engine, flash its headlights, sound its horn and pull up its 360-degree camera feed, all from a VIN alone. The bug, detailed in the security disclosure, amounted to a full account takeover requiring no password.
A stranger with the right number could watch through the car’s own cameras before ever touching a door handle. Because the exploit lived in Kia’s servers rather than the vehicle, it could be patched centrally, but every connected unit stayed exposed until the fix shipped.
3. Hyundai Tucson: One Email Address, Total Control
Researchers found they could take over a Hyundai owner’s connected-car account using nothing but the email address tied to it, then use that access to remotely control the Tucson’s locks, engine, horn, headlights and trunk. The account-takeover method worked on Hyundai and Genesis vehicles built after 2012.
No VIN, password guess or malware was required to trigger it. Because the flaw hinged on an email address rather than anything on the car, an attacker could target a specific owner. Hyundai fixed the underlying account-verification issue once it was reported.
4. Nissan Altima: A Bug That Hit The Whole Fleet
A separate bug, classified as a mass-assignment vulnerability, let researchers send remote commands to essentially every internet-connected Nissan on the road, the Altima included. Unlike the VIN- and email-based exploits found elsewhere in the same industry investigation, this one worked at the fleet level.
Mass-assignment bugs happen when a server trusts more data fields than it should from a user request, letting an attacker set values, like vehicle-command permissions, that were never meant to be adjustable. Nissan closed the hole after disclosure, but a single backend mistake had exposed an entire model line.
5. Tesla Model S: Steered By Nothing But A Phone
At the DEF CON security conference, researchers Marc Rogers and Kevin Mahaffey showed they could take remote control of a Tesla Model S using nothing more than an iPhone, exploiting weaknesses in the car’s onboard software. The DEF CON demonstration proved a modern electric sedan could be commandeered the way a laptop might be.
Tesla responded by issuing the company’s first proactive, mass over-the-air security update, patching every affected car remotely rather than waiting for owners to bring vehicles into a shop. The episode became an early template for handling connected-car flaws fleet-wide.
6. Jeep Cherokee: Killed On The Highway By Remote
Security researchers Charlie Miller and Chris Valasek remotely killed a Jeep Cherokee while it drove on a highway, seizing control of its steering, brakes and acceleration through a flaw in its Uconnect infotainment system. The attack, detailed on Miller’s research profile, worked over a cellular connection from miles away.
No physical access to the vehicle was needed at any point. The demonstration forced an industry reckoning: a car’s entertainment system, not just its engine or brakes, could become the entry point for an attacker to seize safety-critical functions.
7. Chrysler 300: Every Unit Sat Exposed Online
The same Uconnect vulnerability that doomed the Cherokee demonstration sat, in the researchers’ own words, inside every Chrysler vehicle with Uconnect built between late 2013 and early 2015, the Chrysler 300 among them. The flaw, confirmed on Uconnect’s technical history, let an attacker reach the car over a standard internet connection.
For owners of the 300, the danger was less about one flashy hack and more about scale: any unit sold in that window carried the same opening, whether or not its owner heard about the research that first surfaced it. The flaw sat in the car’s cellular-connected head unit.
8. Ram 1500: Fixed Only By USB Stick
The Ram 1500 shared the identical Uconnect-era flaw that exposed the Jeep and Chrysler lineups, and fixing it was inconvenient: owners had to install a patch from a USB stick themselves or bring the truck to a dealer. No over-the-air fix existed yet for this Uconnect hardware.
That gap between disclosure and repair mattered because the underlying weakness let an attacker reach a truck’s dashboard systems over the internet, not just its radio. Until an owner ran the patch, an affected Ram 1500 stayed reachable the way the Cherokee in the original demonstration had been.
9. Jeep Grand Cherokee: Steering And Brakes, Up For Grabs
Built inside the same 2013-to-2015 window, the Jeep Grand Cherokee carried the Uconnect flaw that researchers showed could hand over not just a vehicle’s radio, air conditioning and windshield wipers, but its steering, brakes and transmission. The documented vulnerability gave an attacker access to safety-critical controls.
That distinction, comfort controls versus the systems that actually stop and steer the vehicle, separated this flaw from a nuisance bug and made it a genuine safety concern. Owners of an affected Grand Cherokee needed the same patch as the Cherokee and Ram trucks built alongside it.
10. Cadillac Escalade: Tracked By A $100 Gadget
A $100 device called OwnStar, built by researcher Samy Kamkar, could intercept the signal between GM’s OnStar smartphone app and a vehicle, letting a stranger locate, unlock or remote-start a Cadillac Escalade parked nearby. The device, described on OnStar’s technical background, worked by inserting itself into that wireless handoff.
GM moved fast once the technique went public, patching the flaw within twelve days by releasing upgrades to the OnStar server software and the RemoteLink app. Unlike the VIN- and email-based exploits elsewhere on this list, OwnStar targeted the wireless link between phone and car.
More from Morning Overview
- A geomagnetic storm is forecast to hit Earth today, pushing the northern lights unusually far south
- A recalled pill hid a stimulant dose linked to heart attacks and death
- Four U.S. startups fired up their first small nuclear reactors, aiming to power AI data centers on-site
- Card skimmers hidden on gas pumps and ATMs are draining accounts, and here’s the tell
