Security researcher and automotive expert Yan Semenov shared a few weeks ago a new and, to my knowledge, not yet patched vulnerability in the BYD Leopard 3 that allows an attacker to bypass the immobilizer, unlock the doors, and start the engine.
The vulnerability is in the NFC module located in the driver’s mirror. But the weak part is not on the RF side - it’s on the internal CAN-FD side. The command sequence that sent from the NFC ECU to the internal immobilizer is static. 🤯 According to the author, the exploitation takes 20 seconds in total.
Of course, the vulnerability requires the hijacker to be in physical contact with the car, open the mirror, and connect to the bus, but for a skilled criminal it can take another couple of minutes.
It’s still unclear if other BYD models are affected. Please share it with BYD owners - it’s worth checking with dealers to see when the update is available.
Stay safe!
