What the research found
Researchers at the University of Kansas ran a full security analysis on 125 Android automotive companion apps pulled from the Google Play Store, the kind of app that connects to your car through an OBD-II diagnostic dongle to show fuel level, engine data, or remote diagnostics. Combining static code analysis, live runtime testing, and network traffic monitoring, they found 70% of the apps carried vulnerabilities that could lead to private information leakage, property theft, or direct risk while driving.
Eighteen of the apps could connect to an open OBD dongle with no authentication required at all, then accept arbitrary commands sent to the vehicle’s internal network without checking them first. The researchers demonstrated this against real vehicles, not just in simulation.
Why the OBD port makes this different from a typical app risk
The OBD-II port is a direct line into the vehicle’s internal control network, the same system responsible for things like engine timing and diagnostic reporting, not a side channel these apps happen to use. An app that verifies its connection badly at that point risks more than your data: it risks a pathway into systems that affect how the car runs. Most people plugging in a diagnostic dongle are thinking about fuel economy or a check-engine light, not whether the app managing that connection checks commands before passing them through.
The practical takeaway
If you use an OBD dongle and companion app, stick to ones from the vehicle manufacturer or a small number of well-established, maintained brands rather than a low-cost or unfamiliar option from the app store, since maintained apps are far more likely to have had security issues identified and patched. Unplug the OBD dongle when you’re not using its features instead of leaving it connected all the time, since an idle, always-connected dongle is the exact setup this research tested. And check what permissions the companion app requests during setup: an app asking for far more access than fuel level or diagnostics requires is worth a second look before you grant it.
This research tested apps available through the Google Play Store at the time of the study. App security postures change as developers patch known issues, so a specific app flagged in this research may have since been fixed. The broader pattern (that this app category carries demonstrated risk as a whole) holds regardless of any one app’s current state.
Reference
Mallojula, P., Li, F., Du, X., Luo, B. “Companion Apps or Backdoors? On the Security of Automotive Companion Apps.” University of Kansas, ITTC. https://www.ittc.ku.edu/~bluo/pubs/mallojula2024esorics.pdf
