Some awesome analysis. I need to get wireshark for CAN :-)<p>Its amazing to me to have seen the transformation of cars from things that were primarily mechanically controlled to ones that are primarily software + actuators controlled. A lot more ways to fail. No doubt at some point 'high speed' chases will no longer be possible when the cops send an SMS to your car telling it to pull over.
Not to be confused with the forthcoming paper from Birmingham's Flavio Garcia & Dutch researchers Baris Ege & Roel Verdult. That paper focuses on Volkswagen brands, including Porsche and Bentley. source: <a href="http://www.theguardian.com/technology/2013/jul/30/car-hacking-ignition-injunction" rel="nofollow">http://www.theguardian.com/technology/2013/jul/30/car-hackin...</a><p>This paper focuses on Ford and Toyota.
If you have physical access to the car to the extend that you are able to talk to the CAN bus, you could as well cut the brake fluid lines, corrupt the tires so they explode when they get hot and the pressure rises, put poison in the air conditioner or whatever. Sure, fiddling with the electronics gives you more creative ways to do harm, but the assumption that you have physical access to the can is a very strong one. Furthermore, some cars have multiple buses, with the more critical ones being harder to access.<p>A lot of people are negative about all the electronics, but there is a reason there are all there. The electronics allow you to have engines that are three times more powerful than those of 15 years ago and in the same time consume only half as much fuel. The electronics allow you to measure and control everything much more precisely.<p>Also electronics allow you to implement security systems like ABS, ESP and so one which are really helpful (ABS saved me several times!).<p>Talking about security of the CAN - one should think that adding more security means that more powerful ECUs will be required, which means more weight and more power consumption, which means more fuel consumption. Is it worth it?<p>One more point for the security - critical ECUs that control steering, brakes, airbags and so on are required to get the corresponding ASIL (Automotive Safety Integrity Level) certificates which require a lot of testing and sometimes redundant sensors (similar to those for airplanes). So it is not that simple for a ECU to send some false messages on the bus.
Something similar to this stuff is possibly how Michael Hastings was assassinated in Los Angeles, June 18, 2013.<p>There is a current HN thread about this:
<a href="https://news.ycombinator.com/item?id=6162450" rel="nofollow">https://news.ycombinator.com/item?id=6162450</a>