V2X Exploitation: How Connected & Autonomous Cars Get Hacked

This article is based on the talk "V2X Exploitation: Steering Through Auto Cyber Seas" by Ravi Rajput - automotive and telecom security researcher, and author of AutoHackOS - at BSides Mumbai 2024. You can watch the full session on YouTube.

"What I do for my living: I crash cars." That is how Ravi Rajput summed up his job, and he meant it literally. As cars shed their drivers and hand control to software, every line of that software becomes an attack surface - and a bug in the right place does not just crash a program, it crashes a two-tonne vehicle moving at speed. His BSides Mumbai 2024 talk was a fast tour from the electronics inside a single car all the way out to the telecom networks that connect it to everything else, and the recurring lesson was uncomfortable: modern car hacking is really telecom hacking.

Key Takeaways

• Software driving means software vulnerabilities driving. When there is no human at the wheel, code makes the safety-critical decisions - and Ravi demonstrated a browser bug that stopped a real vehicle, failing its brakes and hydraulics in the process.
• "Connected" multiplies the attack surface. V2X (vehicle-to-everything) links cars to other cars, pedestrians' phones, traffic infrastructure, and the cloud - and every one of those links, plus the cloud APIs behind them, is a new way in.
• The attacks target availability, integrity, authenticity, and confidentiality. Jamming and IMSI catchers knock cars off the network; GPS spoofing and message injection corrupt what they believe; certificate-replay attacks defeat the cryptography meant to stop all of it.

From Distributed to Zonal: How Car Electronics Evolved

To understand the attack surface, Ravi first traced how a car's computers are organised:

• Distributed architecture (typical of cars bought before ~2016): every function - windows, horn, each subsystem - had its own microcontroller, so a car contained hundreds of them.
• Domain architecture: manufacturers grouped those controllers into a few more powerful "domains", which is what enables features like ADAS (Advanced Driver Assistance Systems) - the sensors and logic behind lane-keeping and adaptive cruise control on cars like the XUV700 or MG Hector Plus.
• Zonal architecture: the future, used by Tesla, where a single central computer runs almost everything, divided into zones and telematics.

The telematics control unit (TCU) is the in-car computer that handles remote functions and calls. Ravi recounted a 2022 on-site engagement at an EV manufacturer where, coming from a telecom background, his team compromised the telematics unit and could listen to anyone talking in the car.

The Browser Bug That Stopped a Car

The most striking anecdote: on that same engagement, Ravi wrote an integer/buffer-overflow exploit for the car's in-vehicle browser. He hosted a malicious page on his laptop, brought the vehicle onto his access point, and when the car's browser loaded the JavaScript, the exploit fired and the car stopped - brakes and hydraulics failing as it did. A "smart car", as he put it, is just a lot of sensors and actuators feeding algorithms written in AUTOSAR C/C++; if a calculation goes wrong, the car can crash. That is the whole risk in one sentence.

V2X: Vehicle-to-Everything

Once cars join the network, they speak a family of "V2-something" protocols:

• V2N (vehicle-to-network) - the car talks to the telecom tower.
• V2V (vehicle-to-vehicle) - cars share distance, speed, and damage state.
• V2P (vehicle-to-pedestrian) - a pedestrian's phone signals a human is present.
• V2I (vehicle-to-infrastructure) - traffic lights and road systems.
• V2G (vehicle-to-grid) - charging stations.

Ravi cited a 2015 Siemens deployment on Germany's A9 highway that cut accidents by 35% and injuries by 31% - the upside is real. But wherever a cloud server sits behind these links, he warned, two problems reliably emerge: misconfiguration and insecure APIs - which is exactly why this is relevant to web and cloud security folks, not just car people.

Two radio technologies carry V2X: WAVE (IEEE 802.11p), a Wi-Fi-like protocol tuned for low-latency vehicle-to-vehicle links, and C-V2X (cellular V2X), where the car becomes UE (user equipment) on the mobile network. Cellular authentication runs through the Mobility Management Entity (MME) - the same telecom component the police update when you report a lost phone's IMEI.

The Attacks

Ravi organised the offensive material by the security property each attack breaks:

• Availability - black hole / gray hole, flooding, and jamming. A malicious node drops all (black hole) or some (gray hole) packets. With an IMSI catcher (a Stingray - a fake cell tower broadcasting at high power so nearby phones and cars connect to it), an attacker forces a connection and can then man-in-the-middle it. Cheap jammers from overseas can block 2G-5G, Wi-Fi, and GPS at once. His chilling worked example: box a target car in with four vehicles - front, back, left, right - and jam it to isolate it from the cell tower.
• Integrity - false-message injection, replay, and GPS spoofing. Once you have MITM, you can inject false messages or replay old ones. GPS spoofing is especially dangerous for autonomous vehicles: match the GPS clock, feed a false position, and the car's navigation logic can decide it is heading the wrong way and take drastic corrective action.
• Confidentiality - sniffing pre-shared keys and location tracking. MITM also exposes the pre-shared keys these vehicles use, plus continuous location tracking.
• Authenticity - certificate replication. Manufacturers turned to certificates and blacklists to stop rogue vehicles - but an attacker who was previously authenticated can reuse a blacklisted or previously valid certificate, and combine it with the four-car isolation trick to impersonate a legitimate node.

Car Hacking Is Telecom Hacking

Ravi's blunt bottom line: to actually pull these off at scale, you need to hack the telecom layer. He pointed to real research - "awesome telco security" and "awesome vehicle security" reading lists - and to SS7, the internal signalling network behind incidents like historical WhatsApp interception, reachable via a telecom's SIGTRAN/VoIP interfaces. He runs the Telecom Security Village at DEF CON, so this is his home turf. His mentor's framing closed the talk: you cannot stop a hacker, only raise a hurdle - and they will evolve past it, which is how the whole field moves forward.

Frequently Asked Questions

Can a car really be stopped remotely through a software bug?

Ravi demonstrated exactly that - a browser exploit on an in-vehicle system that halted the car and failed its brakes and hydraulics. It required getting the vehicle onto the attacker's network first, but it shows that safety-critical systems are reachable from ordinary application bugs, which is why isolating infotainment from drive systems matters so much.

Why do people say "car hacking is telecom hacking"?

Because connected vehicles ride on cellular networks and V2X protocols. Many of the highest-impact attacks - IMSI catchers, jamming, SS7 abuse, location tracking - are attacks on the telecom infrastructure the car depends on, not on the car's own code. Securing the vehicle means securing the network it lives on.

Is this only a concern for autonomous cars?

No. Domain-architecture cars with ADAS already let software make safety decisions, and any connected car is exposed to V2X and cellular attacks. Autonomy raises the stakes - GPS spoofing a self-driving car is far more dangerous - but the attack surface exists the moment a car is connected.

Summary

V2X promises fewer accidents and smarter roads, and the data backs up the safety gains - but connectivity turns every car into a networked computer with the attack surface to match. Ravi Rajput walked from the ECUs inside a single vehicle, through a browser bug that physically stopped a car, out to the V2X protocols and the telecom networks underneath - and showed how jamming, GPS spoofing, IMSI catchers, and certificate-replay attacks map onto availability, integrity, confidentiality, and authenticity. Defenders should treat automotive security as a telecom and cloud problem: isolate safety-critical systems, lock down the cloud APIs and certificates, and assume the network itself is hostile.

About the Speaker

Ravi Rajput is an automotive and telecom security researcher who describes himself, half-jokingly, as a "frustrated researcher". He is the author and project lead of AutoHackOS, an operating system for automotive security testing, a training author on platforms including PentesterMag, and a core organiser of the Telecom Security Village at DEF CON. He has spoken at Black Hat Asia 2023, Nullcon, and many other conferences, and delivered this talk at BSides Mumbai 2024.

Watch the Full Talk

Want the full walkthrough, including the live Q&A on rooting V2X applications? Watch the complete BSides Mumbai 2024 session below.