| | |

Connected Cars, Disconnected Safety – The Rising Risk of Auto Hacking

ByBrainTrust

The Birth of the CAN Bus Network

The Controller Area Network (CAN Bus) was developed by Bosch in the early 1980s as a response to the critical design challenges in automotive engineering: the cost, bulk, and complexity of point-to-point copper wiring. At the time, connecting every electrical device in a car required hundreds of individual wires, adding weight and manufacturing expense, while also limiting scalability and maintainability. By introducing a shared, digital communication protocol, the CAN Bus system enabled electronic control units (ECUs) from different domains (engine management, body electronics, transmission, and more) to “talk” to each other using much fewer wires. Mercedes-Benz was among the earliest adopters, integrating CAN into luxury models in the 1990s, with BMW soon following suit and the technology quickly becoming the global standard by the early 2000s.​

This shift wasn’t just a matter of technological progress; it was a commercial and design necessity. By 2008, regulations in the United States required all new vehicles to use CAN Bus for on-board diagnostics, cementing its universal adoption.​

The Expanding Threat – Cars Are Now Connected

While the CAN Bus solved longstanding issues with internal vehicle wiring, modern vehicles now incorporate connectivity features such as 4G LTE, WiFi, and Bluetooth and even semi-permanent cellular links, especially in electric vehicles. Infotainment systems, wireless driver-assist technologies, and remote vehicle controls have brought the in-vehicle network onto the wider Internet, dramatically increasing the “attack surface”—the number of points through which hackers can potentially access vehicle systems.​

The problem is not speculative. Security researchers have successfully demonstrated, sometimes live on stage at conferences such as Def Con, that they can compromise vehicle systems via external connections. Tools and techniques to exploit CAN Bus vulnerabilities are readily available online, and many “car hacking” demonstrations have shown how malicious actors can gain full control over the vehicle’s brakes, steering, and engine via remotely sent commands to the internal network. Several vehicles, including some Tesla models, receive software updates and diagnostics wirelessly, sometimes leaving their CAN Bus exposed to internet-based intrusion.​

How Real Are the Risks?

Unlike traditional network security, the CAN Bus was never designed with cyber threats in mind. It lacks robust authentication and encryption, meaning any device that can talk on the network is trusted by default. Public demonstrations have proven that attackers can exploit unsecured Bluetooth or WiFi systems, either by direct physical access (e.g., plugging in a malicious device) or remotely via the car’s wireless links. In one high-profile case, researchers remotely disabled brakes and manipulated steering on highway-driven vehicles using equipment purchased from mainstream electronics outlets—no advanced criminal expertise required.​

Expert Concerns and Documented Cases

  • Academic studies and federal agencies (like NHTSA) have repeatedly warned of the risk that poorly secured CAN Bus networks pose, especially as wireless features proliferate.​
  • Detailed experimental attacks (such as those by Karl Koscher, Tadayoshi Kohno, and others at the University of Washington) involved reading ECU memory, loading malicious code, and fuzzing CAN messages to manipulate key car controls.​
  • Real-world car hacking incidents are documented every year at security conferences, often using open-source toolkits available to anyone with basic technical skills.​
  • Automotive cybersecurity standards are still catching up, as many cars still ship with unecrypted or minimally protected CAN Bus connections.​

Minimising Risks

This is not the stuff of science fiction—the threats are real, especially for vehicles with always-on internet connectivity, such as electric cars. Here are several actionable steps to help minimise exposure:​

  • Keep vehicle software up-to-date with manufacturer-issued patches and updates.​
  • Limit use of aftermarket wireless accessories or OBD-II dongles unless from reputable sources verified for security.​
  • Disable WiFi, Bluetooth, or cellular modules when not needed, especially if travelling or parking in unfamiliar locations.​
  • Use secure passwords for remote control apps and always enable two-factor authentication if available.​
  • Be wary of phishing attempts or suspicious messages attempting to gain access to your vehicle’s wireless systems.​
  • For high-risk models, consult with manufacturer or dealer about additional security measures or firmware hardening procedures.​

Conclusion

The move towards a fully connected car ecosystem brings significant convenience but also opens doors to new forms of cyber risk. As vehicles become increasingly networked—often persistently online—the importance of basic cybersecurity hygiene grows. Awareness, vigilance, and regular updates are the best ways to keep drivers and passengers safe in an era where digital threats are just as real as physical ones.

Similar Posts