UK asks cyberspies to probe whether Chinese buses can be switched off remotely

UK governmental is working with the National Cyber Security Centre to understand and "mitigate" any risk that China-made imported electric buses could be remotely accessed and potentially disabled. This follows concerns raised by Norwegian public transport service operator, Ruter, which conducted cybersecurity tests on a new …

[Joe W]

Well... yeah, but nah?

OK, it is mainly the OTA firmware update that they found. And this can (in principle and in practice) be used to brick a machine (like stolen agricultural equipment). So: yes, it is very possible.

No, this is not surprising to anybody who has even the slightest clue about anything IT. It is the exactly bloody same thing as when Sonos bricked the speakers.

I don't mean we should not care about this - we clearly do - I'm just saying that this is so widespread and unregulated that this should have been addressed already.

[Frank Bitterlich]

Re: Well... yeah, but nah?

So true... and the idea that they can just "remove the SIM card" and everything is fine is just ridiculous. That certainly won't fix a bricked bus that has downloaded and installed a malicious firmware update. Unless the bus has a "bad firmware incoming" indicator light, of course.

[DS999]

Re: Well... yeah, but nah?

The other problem is what if the firmware doesn't like it if you go too long without connectivity and bricks the bus or there's a loudly beeping warning indicator on the driver's dash that can't be silenced.

If the timeout for that is a day you'll find out pretty quickly. If the timeout is a year, you might watch for a week to see if anything happens but when it doesn't assumed it is fine. Until the day all your buses stop working one after the other, in the order in which the SIMs were pulled out!

[Graham 32]

Re: Well... yeah, but nah?

Vacuum cleaners already brick themselves without connectivity.

https://codetiger.github.io/blog/the-day-my-smart-vacuum-turned-against-me/

[Claptrap314]

Re: Well... yeah, but nah?

Another application for RFC 3514 !

[vtcodger]

Re: Well... yeah, but nah?

The Register article isn't entirely clear, but it sort of sounds like the normal practice is to remove the SIM card, run the buses without it and to install updates manually. Seems reasonable to me if the buses will indeed operate without a SIM card. Not no risk. But probably no riskier than alternatives from any other vendors.

For that matter, in the unlikely event that anyone actually cares about vehicle security, limit OTA updates to vehicle entertainment systems and require the entertainment systems be physically isolated from the vehicle operational buss(es).

[collinsl]

Re: Well... yeah, but nah?

I'm not so sure - the article also references data being uploaded and stored in an AWS instance in Germany, so for that some kind of network from the bus would be required.

[jdiebdhidbsusbvwbsidnsoskebid]

Re: Well... yeah, but nah?

"Seems reasonable to me if the buses will indeed operate without a SIM card."

The buses will certainly be designed to operate without connectivity, for a while at least, in tunnels or areas with patchy phone signal. I'm wondering what will happen if the telemetry buffer fills up after a day, week, year, whatever, of having no connection back home. At which point, it might not happen maliciously but it might simply trigger a poorly handled error that at best does something unexpected, at worst panics and shuts the bus down.

And running without a SIM assumes that is a physical SIM that is accessible in the first place (might be protected by tamper proof switches for "safety"). What if it's an e-sim that is not replaceable?

[wolfetone]

Re: Well... yeah, but nah?

"I'm just saying that this is so widespread and unregulated that this should have been addressed already."

It's like the Y2k episode of The Simpsons where Lisa is in the kitchen holding a carton of orange juice and says "It has a microchip in it, everything does". And the whole kitchen is going mental because Y2k is making everything to mad.

We're in that kitchen. All of these things can be bricked because they're just pushed out with no real regard to not just if they're secure, but whether or not they actually should have this level of connectivity.

Have a beer for jogging a wonderful memory of proper TV.

[MarkMLl]

Re: Well... yeah, but nah?

The fundamental issue is that it should be the fleet operator's responsibility to update firmware etc., and the manufacturer should not have been allowed to retain direct access.

Obviously the operator should be open to the possibility that there are "backdoors", but the fact that the manufacturer is open about having access means that something went very badly wrong in the procurement process.

[Anonymous Coward]

Re: Well... yeah, but nah?

The manufacturer has a legal obligation to maintain cybersecurity according to R155. How they do that in practice is a process that is called CSMS. That CSMS gets audited every three years by organizations that are designated to do that by EU country governments.

For cost reasons, most manufacturers these days choose OTA updates since it makes the whole logistics of calling vehicles into workshops and have technicians connect diagnostic equipment no longer required.

China more or less requires manufacturers to do these updates from within China; Europe has no requirements for firmware updates to be pushed from any EU country, they can come from anywhere in the world.

What we would need to solve this is the requirement that these updates are pushed from inside the EU, by an EU legal entity. This entity would have to be audited for complying with R155 and all that.

[Bowlers]

Re: Well... yeah, but nah?

If the practice is so widespread it would be interesting to find out F35 manufacturer Locheed Martin's view.

[Headley_Grange]

The fact that almost every other computer system the state relies on is based on Windows,Oracle, SAP, etc. and their related updates, telemetry and phoning-home and all of which can be turned off remotely from foreign countries doesn't seem to bother them at all.

[Bill Gray]

I'd be interested to see comments from the downvoters. Pointing out that this isn't just a China problem, and that vast swathes of infrastructure could be bricked (intentionally or otherwise) from "foreign countries" (or one's own, or by "foreign countries" that have planted/figured out vulnerabilities in domestic code), seems entirely reasonable.

Truthfully, if I were running China's security apparatus, the ability to control British buses would be relatively unexciting. Surveillance over Windows machines, for example, would be much more interesting.

[DS999]

The ability to control buses

Is irrelevant, until perhaps you decide to invade Taiwan and want the west to be distracted with their own problems so you cause buses, drones, wireless routers, cell towers and all sorts of other stuff to stop working. Or maybe not stop working entirely just cause enough problems to serve as a warning "stay out of this or we WILL brick everything and grind the west to a halt".

[Bill Gray]

Re: The ability to control buses

Not saying the buses wouldn't be potentially useful targets. Just that the routers and cell towers would be far more valuable, and would be so today, not just when invading Taiwan.

Besides, I'd say the West is already doing an excellent job distracting itself with its own problems, and I sadly expect things to get much worse before they get better. Were I China, I wouldn't see much point in murdering a country busily committing suicide.

[vtcodger]

Re: The ability to control buses

I doubt China would do that. But only because they are presumably equally vulnerable to such attacks in reprisal . Now North Korea ... Or Yemen ...

Also, one suspects that an attacked vehicle won't just stop. It'll park itself in such a way as to cause maximum traffic disruption. Imagine if you will every Tesla vehicle on the planet, in user not, waking up, driving five kilometers, looking for other Teslas already parked across as much roadway as possible and doing it's best to expand the roadblock. If it can't find another Tesla to team with, it parks across as many lanes as possible and waits for its pals to join it.

[MarkMLl]

So what are downvotes for anyway?

> I'd be interested to see comments from the downvoters.

Regrettably, there are a lot of people convinced that a coherent posting highlighting an issue with which they are uncomfortable demands a downvote.

[Graham Cobb]

While certainly true, dependence on US, and other Western countries, is well known. The planners may well be over optimistic, but the risk is, at least, understood and accepted. To be honest, I don't think any country considers it could survive if all its major partners turned against it.

A dependence on China for keeping the country running is, however, rather more serious. While there is no reason to assume China is going to turn against us, there is certainly a higher risk of that happening than many other partners. And that is only considering government actions: there are also criminal elements to be considered.

[Anonymous Anti-ANC South African Coward]

Where there's smoke, there's a fire...

Imagine the chaos if a major portion of public transport buses got bricked (or stopped from working normally) in a couple of countries.... and private transport too...

[Dwarf]

Arguably, with the generally poor reliability of the public transport network people are used to things not working, so they would barely notice if something got bricked, it would just become another reason to add to the list of why you won't get home before your dinner is spoiled or why you can't get to that meeting on time.

The whole remote telemetry and always-on principles need to be balanced against when reporitng or maintenance can be done. Why not just download it when you get back to a depot and use a local server there, since the local team with spanners live in the same place too. There is absolutely no need for hooking them up to the cloud.

[sal II]

Same will happen when the computer and public cloud infrastructure they often rely on are blocked by their respective supplier. But I guess since it would be most likely USA based supplier it's all good...

[Apocalypso - a cheery end to the world]

The wheels on the bus...

> Imagine the chaos if a major portion of public transport buses got bricked (or stopped from working normally) in a couple of countries.... and private transport too...

If buses and coaches in the UK suddenly stopped working then the railways would really be in trouble. Where would they get replacement buses from?

[elsergiovolador]

Cyberspies

Did Cyberspies read my heavily downvoted comment, months back, that this is a possibility?

Who would have thought.

Hello!

[An_Old_Dog]

Compliance

"Compliance with standard(s)" != "without vulnerability(ies)".

[Anonymous Coward]

Re: Compliance

The standard says the update channel must be secure, but what are you realistically going to do if they upload BusBricker2026 firmware to your bus? Ask the DGSE sink some ships to get your money back? Ask the USAF to bomb them to get your money back?

[IamAProton]

Re: Compliance

It's actually rather simple, do not accept anything that must be 'always connected' and apply software updates on your schedule.

The automatic update everything is a curse, mostly because software updates are not limited to bugfixes but more often than not they add half-baked non-requested changes or "features"

[VoiceOfTruth]

Keep licking the American boot, Britons

Meanwhile... Cisco and its collection of security holes gets a free pass. Not even a mention.

[Doctor Syntax]

Re: Keep licking the American boot, Britons

Cisco make buses? Who knew?

Can we have a whataboutism icon?

[VoiceOfTruth]

Re: Keep licking the American boot, Britons

You know exactly what I am referring to. But apparently Cisco gets a free pass from you. American security holes = good, apple pie, church going, let's grab some Winchesters, red white a blue holes. Chinese security holes = bad, reds under the bed, bad.

The extent of the blind eye being turned to Cisco is astonishing.

[Anonymous Coward]

Re: Keep licking the American boot, Britons

I can neither deny or confirm the suggestion, but...

...last decade when I audited a number of switch/router software stacks (including Huawei) the only manufacturer that would not allow me access to all of the code was Cisco.

Anon to avoid association with the OP, who I do not normally agree with.

[Anonymous Coward]

Re: Keep licking the American boot, Britons

Sake here, this time VoT is on the money. Must be a full moon or they remembered their meds today

[that one in the corner]

Re: Keep licking the American boot, Britons

Yup, VoiceOfTruth, we *never* see any criticisms of Cisco here, it is all "Yutong this, Yutong that, Yutong the other" all day, every day; oh, hang on, what is this:

Sun 2 Nov 2025 attackers are installing an implant named “BADCANDY” on unpatched Cisco IOS XE devices

Tue 28 Oct 2025 organizations using Cisco or Citrix were 6.8X more likely to fall victim to an attack

Mon 20 Oct 2025 Cisco 0-day abused to deploy rootkits

Thu 16 Oct 2025 Senator presses Cisco over firewall flaws that burned US agency

and so on and so forth.

[VoiceOfTruth]

Re: Keep licking the American boot, Britons

That is correct.

So... where is the demand from government to remove these blatant security holes? I have not heard one government minister say: Cisco needs to be audited.

No rip and replace.

[Aldnus]

Re: Keep licking the American boot, Britons

and much of ciscos tech is built where exactly, O yes the little men in pointy hats and pyjamas, but who reads the labels on the back when installing anyway.

[Anonymous Coward]

Re: Keep licking the American boot, Britons

The backdoors and bugs are built in the US.

[Roopee]

Pelican is wilfully missing the point...

It doesn't make any difference whether you manually or remotely update your bus/whatever, if you don't know exactly what the update is/does, and can verify it, you have no security - thus you need to trust the manufacturer because you are at their mercy.

So if there's reason to believe your supplier might maliciously 'update' your safety-critical device, you shouldn't have bought it in the first place, and you certainly shouldn't apply unchecked updates (though you may be too late of course)... not really rocket-science.

Hands up who trusts Chinese manufacturers, or more to the point, the Chinese government! Other countries are available.

Not that I trust our own or our allies' manufacturers or governments even in peace-time, but at least their software updates/cock-ups probably aren't malicious.

[martinusher]

Re: Pelican is wilfully missing the point...

>Hands up who trusts Chinese manufacturers, or more to the point, the Chinese government! Other countries are available

That's the whole point of a report like this. It spreads a bit of FUD around, the sort that gets picked up and amplified by people predisposed to this kind of rumor, and hopefully it deals with a competitor. Except that -- increasingly -- there just aren't competitors any more. (You'd think there would be plenty of European suppliers of buses.......)

Software and vehicles in general is a bit of a sort point. I don't happen to believe that OTA updates are necessary or desirable, be that for cars, buses or even trains (remember this one?). I also don't like the way that software is increasingly used to lock in business in products it has no business doing so. We all know about the ongoing John Deere problem but just yesterday I read about the problems someone was having changing the rear brake pads on his Hundai -- he can't do this without expensive software & a proprietary adapter and even after purchasing this he discovered he couldn't use the software unless he was a registered business. All totally unnecessary, its not helping the user, just locking them into a revenue stream model.

[Martin an gof]

Re: Pelican is wilfully missing the point...

Or a friend of mine who has discovered that, when he needed to fit a new battery (as in, standard 12V battery) to his VW, the battery had to be "registered" with the ECU. Said car has start-stop, which only operates if the battery health and charge is "good enough". If the car cannot somehow measure this state independently (which presumably it can't otherwise it would be able to see that you have fitted the new battery) then how does it know when the battery is not good enough? A timer??

M.

[cyberdemon]

Re: Pelican is wilfully missing the point...

It's pretty simple to measure the internal resistance of the battery (which is all that matters for stop/start). Temporarily pause the charging circuit, measure voltage and current, correlate large increases in current with drops in voltage and divide voltage by current

[David Hicklin]

Re: Pelican is wilfully missing the point...

> the battery had to be "registered" with the ECU.

I understand that a lot of modern cars have some communication with a chip on the battery to monitor its health, I think the idea being to give warning if it is about to die.

Usually the first you know is when the battery announces it by dying suddenly , thankfully the AA patrol had the kit to register it at the roadside after fitting a new battery.

[tiggity]

Re: Pelican is wilfully missing the point...

.. and would you necessarily trust the other countries?

A neighbour of mine has a Tesla, he gets quite a few OTA updates. I'm sure there are some people that would not necessarily trust updates from a company Musk is in control of!

But pointing fingers at China, Russia, whoever is always a good distraction tool - I'm more worried about what my government will do to screw things up* rather than imaginary attacks from other countries.

e.g. I have not noticed China, Russia, North Korea etc trying to interfere with UK energy policy,

the US however..

* They do plenty of damage just by being totally incompetent

[BartyFartsLast]

Re: Pelican is wilfully missing the point...

Given the device you typed that on was almost definitely made in china or contains significant amounts of Chinese components the answer would be you as well ase

[Tubz]

Trust no country or corporation and vet all updates should be at the core of security, unfortunately, users won't have that as too inconvenient and so a level of trust is given that is then always abused in the name of profit.

[goblinski]

Which modern vehicle can not be remotely disabled ?

Not sure about right-ponders, but us wrong-ponders have been receiving OnStar love for decades, now available in your preferred brand's colors at your friendly car manufacturers' shop.

[BartyFartsLast]

I'd be surprised if the telemetry most European cars are capable of wasn't in some way abusable if not intentionally written to contain such functionality

There's even been a murder case in the UK proven with help from the data collected by the murderer's car

[Doctor Syntax]

"Cyber security risk is a core element of our procurement process for new electric buses. Ruter's work in Norway is helpful for wider industry learning, and it's really encouraging that they are carrying out tests and exploring how security systems can be improved even further."

It's at the core of their procurement process how come they hadn't done such tests already?

[Jeff 11]

“Cyber security risk is a core element of our procurement process”

Usually shorthand for “we know it’s a risk, therefore it’s stipulated in the contract the supplier not allowed to do this so we’re legally covered”

“Ruter's work in Norway is helpful for wider industry learning”

AKA “we just found out more responsible companies do this but we don’t know how and it’s too expensive, so let’s hope they don’t find anything truly nefarious”

[robert.harris]

Free software the answer

The only real solution is to insist that the bus software is free, buildable and modifiable by the customer.

[StewartWhite]

Re: Free software the answer

There is another answer - stop building buses that need software to make them function. My wife recently bought an electric car which randomly decides to change speed limits in mph to km/h but then gets confused and alerts continually if we're doing more than 30km/h in a 30mph zone. That and randomly moving the time back and forth an hour. You can go on the laughably bad app to look at the documentation for the car but a) it doesn't know which car we're in so you have to go through several menus to find the correct model and b) it's over 300 pages long without an index.

There are lots of problems with buses in the UK (not enough of them or bus drivers, weird routes and lack of early morning and late night services) but insufficiently complicated systems isn't one of them.

[Sandtitz]

Re: Free software the answer

"My wife recently bought an electric car which"

Name and shame pls.

[Jamie Jones]

Re: Free software the answer

Mrs. White, I assume.

[David 132]

Re: Free software the answer

You owe me a new keyboard.

[Sandtitz]

Re: Free software the answer

I sure walked right into that!

[martinusher]

Re: Free software the answer

Name and shame the equipment, not the user.

I've got one for you. An older couple we know like many of their age group are wedded to their iPhones and iWatches. They've not been able to get the watches to consistently tell the correct time for months now. They keep on coming out with things like "his watch is older than mine and maybe needs to be replaced" and any comments I make along the lines of "Its nothing to do with the hardware, its a software problem" fall on deaf ears. Those TechBros have trained their user base Real Good, apparently.

[StewartWhite]

Re: Free software the answer

Citroen e-Berlingo. The car itself is fine, it's the software and apps that are ridiculously complicated and unreliable.

[Martin an gof]

Re: Free software the answer

Citroen e-Berlingo

Aah, there is your problem (and, I suspect, also the Peugeot and the Fiat and the Vauxhall models of the same van).

We had a Diesel Berlingo new 19 plate. Immensly practical car with seven seats and a cavernous load space if seats were folded or removed. Software was a constant bugbear, though in that model certain things could be silenced. It was theoretically possible, for example, to tie the speed limit recognition system to the speed limiter. Not a good idea as it was constantly recognising signs on side roads and assuming they applied to the main road we were actually on. Also constantly resetting speed limits in (for example) speed-controlled motorway segments, and insisting the road through our village was 60mph instead of the 30mph it has been since the mid 1980s (now 20mph).

The lane-keeping was a nightmare and had to be turned off every journey. The collision warning was spooked by every little thing, but the screech and the flashing warning were both non-specific (so you needed to glance down to read the display) and fleeting (so the display had disappeared before you could read it).

Oh, and the radio and the cabin lighting and the 12V socket turned themselves off after 20 minutes if the engine wasn't running, and couldn't be turned back on without starting the engine. Not much use if sat outside the village hall for a 45 minute ballet class to finish.

The thing that made us get rid in the end was an engine problem – snapped timing chain of all things – that turned out to be a warranty fix (even though the car was out of warranty) that really should have been a recall issue, and the fix was done so badly that the car leaked oil ever after and needed other expensive repairs that were "not covered, sorry".

And why didn't we replace with an electric version? Mainly because for some unknown reason Stellantis decided only to fit a "small" (c200 mile range?) battery to a car that really should have enough space for one twice that size.

M.

[Boothy]

Re: Free software the answer

Crap software in modern cars just seems to be the tend currently!

I've got an almost 3 year old Cupra, part of VW group of course.

I also have to turn lane-keeping off every trip, otherwise it tries to steer me into either the side of the road, or into oncoming traffic, depending on its mood! The worse one is the M62 West bound exit for the M606, as you come off the M62 onto the slip-road on the left, the car is absolutely adamant it's going to just keep going straight on instead of following the slip-road off to the left, which would mean cutting across the right hand slip road lane and going straight onto the hard-shoulder of the M62!

The collision warning seems to hate parked cars, especially on bends where the parked car is basically directly in front, and the car just doesn't notice I'm already following the bend, so not even vaguely getting close to the parked car, but nope, big red warning on the dash and hits the brakes!

Speed limit detection is also terrible. There is a parkway I drive along regularly (think small bypass around a housing estate), this is a single carriageway road, three proper (i.e. not mini) roundabouts one at each end and one in the middle, and about 2 miles long total. It's 40 mph along the entire length, no change of speed at all, with the occasional 40 repeater signs along the route. The car on the other hand thinks it's 30 at some points, then back to 40 (the repeater signs) then back to 30. One of these times is by the middle roundabout, as the left side exit (that I don't use) does drop to 30, so I suspect the car is picking this up in error (still not an excuse). But at no point on the rest of the road is there any change in speed, or any other side road with a different speed sign, or any other speed signs other than the 40 repeaters! I've even checked Street View! So I've no idea why the car thinks it keeps changing to 30! Google Navigate or Waze (via Android auto) on the other hand show 40 for the entire length! I have to keep my foot on the gas ready to push forwards, otherwise the car will brake on it's own down to 30!

[Boothy]

Re: Free software the answer

'trend' of course, not 'tend'!

[smudge]

Oh really?

"Currently, Ruter can disconnect the bus from the internet by removing the SIM card, as all connectivity to the network goes through this single point. This ensures that we retain local control if necessary,"

It's a bus. How many SIMs can the manufacturer conceal in it? Even allowing for the need for positioning for reliable communications...

[G2]

Re: Oh really?

actually... the number of SIMs that can be concealed is unlimited if you also count eSIMs - these are just digital certificates and they are only limited by the storage space available on the device (more specifically on the secure element chip)

so even if one removes the obvious physical SIM card, with modern devices that does not mean that the connection to the mothership is now broken, there might be one ore more eSIMs configured as backup in the case that the primary SIM is not working.

[Dan 55]

"UK importer says supplier complies with the law"

I have in my hand a piece of paper...

[BartyFartsLast]

If they're worried about this

Just wait 'til they find out what a foreign state can do to the fleet of F35s and AH64s

[Anonymous Coward]

Re: If they're worried about this

I think we already know. Can't add new weapons without US permission...

[segfault188]

Pelican

Meanwhile, the importer of Yutong vehicles for the UK and Ireland region, Pelican

Not mentioned in this report, but Pelican have also been accused of phishing.

Apparently they are based, not in China, but at Pelican Island National Wildlife Refuge in Florida.

[Mickey Porkpies]

YES

[Anonymous Coward]

Remote disabling of transport

I seem to remember some USA company released an update which bricked loads of windows machines, causing plane groundings.

Yet still these people have the kill switch.

When did we start accepting as the norm third party remote software updates for anything more serious than a computer game?

[Anonymous Coward]

They SHOULD be asking their cyberspies to probe whether the USA can be switch Tesla's off remotely, and while they are at it, ask what backdoors Tesla has installed to give the NSA/FBI & CIA access to spy on them.

[DartfordMan]

Remote access would be expected

People may remember the laughable defence by the Post Office and Fujitsu that they had no remote access to Horizon. They were never challenged on how they could fix bugs or issue updates

[The Mole]

Re: Remote access would be expected

I do clearly remember reading in Computer Weekly someone challenging it on the grounds its just a windows PC of course there is remote access.

Though to be fair I believe most people assumed bugs and updates were installed in the the normal way - via the floppy disk drive.

[GreggS]

1) It relies on a SIM for connectivity - so it's never going to get a signal anyway in the UK.

2) They haven't responded as to whether Yutong has remote access, which means they probably do and they've now gone to stick their head back in the sand.

3) See 1

[Captain Slog]

Ransomware As A (Dis)Service

Would someone please, pretty-please, pay the ransom so that the doors can re-open before I have to REALLY cross my legs...

[Mark C 2]

SIM

It will have an eSIM not a physical SIM, possibly multiple eSIMs, so someone is telling porkies about removing it. However, it will have to connect via an APN and that can be blocked. OTA software updates are required or things get very expensive if you need to physically connect and flash all of the ECUs, and there could be 5-10, maybe more. This will work on a small number of buses but not a large fleet and the software has to come from the manufacturer. This is the same principle as updating your smartphone although safety critical systems are not typically updated OTA.

[rcw88]

Who’d have thought it?

A transportation machine entirely manufactured in a Communist state. Preconfigured to stop, permanently on instruction. Now multiply that by all the Chinese slave made EV’s littering our roads, make them all stop, then watch the chaos - a page straight out of Slow Horses series 5.

Today the UK MoD has instructed users of EV’s leased by the MoD to NOT conduct conversations inside the vehicle relating to any matter carrying a protective marking above OFFICIAL - source multiple news outlets. And these cars must be parked two miles from a secure location.

FFS who the hell thinks buying a Chinese car is a good idea to use on Goverment business? Or any business for that matter. I’m sticking to my disconnected car thank you very much.