CANBUS strikes again....

There have been various exploits on the CANBUS and other in-vehicle networks for higher end cars for a while now (Looking at you, BMW) but it looks like the tech is filtering down.

Link to above article: https://www.theregister.com/2023/04/06/can_injection_attack_car_theft

Link to a more detailed writeup: https://kentindell.github.io/2023/04/03/can-injection/

 

Nothing like a dumb key and good old fashioned halogen headlights.

 

What? To steal a car with a dump non chipped key all you have to do is a pick the door lock and pick the ignition lock or break a window and jump the correct ignition switch wires. Way easier then having to deal with current vehicle anti theft features.

 

Nobody wants to steal that stuff. I think a chipped conventional key and immobilizer is the best anti theft device. Connected vehicles are less secure than vehicles with out a chipped key.


The question is are vehicles with secure comunication systems the way to go?

Or would going back to chipped H keys more secure?

I know which I prefer, and I know which way manufacturers will go. Manufacturers might not go to more secure communications, the vulnerable networks in use now don't seem that secure.

 

VW uses a secured bus and it means a new key/fob costs $$$$$$$$ - the dealerships have to call Germany to get the crypto directly from VW. Other manufacturers have started locking EVERYTHING up - need dealer codes if you change your head unit, instrument cluster, drivetrain components even.

The answer is separate systems in the vehicle for security critical and noncritical systems, but that would cost engineering and remove the excuse for locking maintenance behind dealerships.

 

I recall aVW key costing around $800.00 and that was 10 years ago.

I can live with out power locks/keyless entry, PTS, AHB, navigation, OTAU basically all of the non critical systems I could live with out, and have a more secure vehicle.

That's the route I'd like to see the auto industry take. That's not happening, so seperate systems would be better.

I hope to never be behind the wheel of an autonomous vehicle, not with the junk automotive electronics the auto industry uses.

 

Many manufacturers are working on various methods to secure their communication buses although I don't think anything will ever be totally secure against attack.

Unfortunately this also adds additional complexity to diagnosing already complex systems and in some cases extra subscription fees and being forced to be connected to the internet to even connect to the vehicle as many 18+ vehicles are now using some form of secure gateway/network isolation.

Additionally many modules are now 1 time write, once they are coded to a vehicle they are hardware locked to that vehicle and can not be reprogrammed to a different vehicle so say goodbye to using used modules. When a manufacturer decides to quit making a module and you need one you are SOL, some of this I believe is planned obsolescence more than security but either way it's where we are at with modern vehicles.