Over-the-air updates let manufacturers fix vehicles without a workshop visit, but they also create an attack path. The main threats are spoofing, tampering, replay, rollback, freezing and denial of service. Each has a known control, and a good update design covers all of them together.
Why OTA is different for cars
An over-the-air update delivers changes to an operating system or embedded firmware over a wireless network such as cellular or Wi-Fi. In cars, the telematics control unit typically downloads and installs updates over cellular networks. The reference page notes that cars cannot be driven during installation, that the car checks the update is genuine beforehand and that it verifies the integrity of affected systems afterward.
The same page lists spoofing, tampering, replay attacks and privilege escalation as concerns, and gives two scenarios: a flashing failure that interrupts an update, and arbitrary flashing that installs a malicious update.
The threats and the matching control
The Uptane standard gives a longer taxonomy for ground vehicles. Its list includes eavesdropping, drop request and slow retrieval attacks, freeze attacks, partial bundle installation, denial of service, rollback, endless data and mix and match attacks, and arbitrary software installation.
| Threat | What happens | Control |
|---|---|---|
| Spoofing | A fake server sends an update | Signed metadata, verified against trusted keys |
| Tampering | An image is altered in transit | Signatures and integrity checks on images |
| Replay | An old valid message is sent again | Nonces or counters in signed reports |
| Rollback | An old vulnerable version is installed | Version numbers in signed metadata |
| Freeze | The device is kept on stale data | Expiry times and a trustworthy clock |
| Partial install | Only some units get the update | Bundle checks and consistent state |
Delta updates add a wrinkle
To keep downloads small, a distributor can send a delta, the difference between old and new firmware, and the device applies it. That is efficient, but it means the unit must verify the result as well as the download, because a delta applied to the wrong base produces the wrong image.
Design questions to ask
- What is signed, who holds the signing keys and how is a key revoked?
- Can an old but validly signed image be reinstalled?
- What happens if power or connectivity is lost mid update?
- Does each control unit verify for itself, or does it trust a central unit?
- Where does the vehicle get a secure time?
The last question matters more than it looks, since expiry only works with a clock an attacker cannot move.
How this ties to regulation
UN R156 requires that update integrity and authenticity are established and that the vehicle can be restored if an update fails or is interrupted, according to UL's summary. See the post what happens when a vehicle update fails.
Quick check
Is HTTPS alone enough to secure a vehicle update?
Transport security helps but protects only the channel. Signed update metadata protects against a compromised server or mirror, which transport security does not.
Sources
Last reviewed: 19 October 2026.
