Norwegian Transit Authority Flags Security Risk in Chinese-Made Electric Buses
A new security vulnerability has emerged in electric buses manufactured by Chinese firm Yutong Group, prompting Norway’s leading public transport operator to announce stricter security protocols. Tests conducted by Ruter, which operates half of Norway’s public transport network in Oslo and the Akershus region, revealed that Yutong buses possess the capability for remote shutdown by the manufacturer.
Ruter’s findings, published last week, demonstrate that Yutong Group maintains access to the buses’ control systems for essential functions like software updates and diagnostics. However, officials warn that this access presents a potential security risk. “In theory, this could be exploited to affect the bus,” a Ruter spokesperson stated.
The investigation involved rigorous testing in underground mines, designed to eliminate external signals and isolate the buses’ connectivity. These tests compared Yutong buses with vehicles from Dutch manufacturer VDL. The results showed a critical difference: while the VDL buses lacked over-the-air software update capabilities, the Yutong buses did. This remote access is the core of the current concern.
Yutong Group has not yet issued a direct response to inquiries from The Associated Press as of Wednesday, November 5. However, The Guardian newspaper reported a statement from the company asserting its strict adherence to local laws and regulations. The statement further indicated that data related to the buses is stored in Germany.
According to the company, through an unidentified spokesperson, the collected data is encrypted and “used solely for vehicle-related maintenance, optimisation and improvement to meet customers’ after-sales service needs.” Yutong’s website highlights its extensive global reach, with tens of thousands of vehicles sold across Europe, Africa, Latin America, and the Asia-Pacific region in recent decades.
The security study was initiated amid growing anxieties surrounding potential surveillance and data security, a concern shared by numerous countries actively strengthening consumer data protection and remote operations safeguards.
Ruter emphasized that the tests revealed “the manufacturer has direct digital access to each individual bus for software updates and diagnostics.” This finding underscores the broader implications of interconnected vehicle technology.
These concerns are not isolated to the Yutong buses. US regulators initiated a probe in January into Tesla vehicles following reports of crashes linked to the company’s remote control features, which allow drivers to summon or move their cars via a mobile app. This investigation highlights the escalating risks associated with the increasing remote control of electric vehicles.
