417/68 Wednesday, October 22, 2025
The concept of Bring Your Own Device (BYOD), where employees use personal devices for work, is now expanding into a new risk area known as Bring Your Own Car (BYOC). At the recent BSides NYC conference, researchers from cybersecurity firm Threatlight showcased a new proof-of-concept (PoC) attack demonstrating how a personal vehicle could become an entry point for infiltrating an organization’s internal network-leveraging an employee’s smartphone as the bridge. According to the researchers, the attack requires only a few inexpensive devices and can penetrate critical systems such as Linux servers and ESXi hypervisors.
The attack begins when hackers use low-cost tools, such as business-card–sized microcontrollers (“cardputers”) combined with NRF24 transceiver modules, to disrupt the Bluetooth connection between a target vehicle (in this case, a Tesla) and the driver’s phone. When the driver attempts to reconnect manually, the attacker deploys a FlipperZero device to spoof the vehicle’s Bluetooth identity. Once the driver unknowingly pairs with the malicious device, the attacker exploits the connection using BadUSB techniques to deliver and install malware (an APK file) onto the victim’s smartphone, gaining full control. From there, the attacker only needs to wait until the employee enters the office. As soon as the compromised phone connects to the corporate Wi-Fi, the attacker can move laterally through the network to compromise other systems.
This case study underscores that the most dangerous vulnerabilities often lie not within a single system, but in the “gaps” or “intersections” between overlooked systems. Many organizations deploy strong endpoint detection (EDR) and network monitoring (SOC), yet fail to account for risks arising from interactions between personal devices and vehicles. Researchers recommend adopting a holistic security approach, including stricter Mobile Device Management (MDM) policies, network segmentation, and active monitoring of anomalous mobile device behavior, to close these often-overlooked gaps.
Source https://www.darkreading.com/vulnerabilities-threats/car-byod-risk
