DEF CON 31 Car Hacking Village - How an Auto Security Researcher Had His Car Stolen - Tabor, Tindell

[@StarchedPie]

I work with CAN for industrial applications at my job, and it is insane to me that it would get used for anything security related. I was (and now still am) under the impression that the moment there is physical access to the bus, that the bus is owned by the attacker.

[@Andrei-ng2yz]

Actually, the first suggestion is the only correct one. Devices accessible from the outside should not be on the same bus as the main security modules. Never. And the excuse about the cost in production - just indicates that the manufacturer is extremely interested in its own profits, but absolutely not interested in the safety of the customer's property, after he gave money for it to the dealer... Actually converting all the devices and modules on the bus to CryptoCAN will be more expensive than an isolated bus for externally accessible devices.

[@Andrei-ng2yz]

Anyone who is into the business of automotive security system installation knows about this CAN attack through the headlight wiring on Toyotas. And Toyota has known for a long time for sure. And it was known well before 2021... Hijackers have been using this method for a long time. So it's nothing new.

[@superdooper6969]

has this been patched by Toyota?

[@zoenagy9458]

use LIN bus instead of CAN for headlights

[@savagesl4yer]

I’m newer to this field and just curious what do you mean by that?? How does it differ?

[@ramidaouas4933]

@@savagesl4yer the LIN bus, unlike CAN, is usually used for less critical systems, e.g. headlights control (You can still argue that headlights are critical for driving in the dark, but yeah still not critical as the braking system for instance). When you connect those systems to the LIN bus you separate them from the critical systems connected to the CAN bus. In a way, you are segmenting the bus network to avoid that hijacked less-critical ECUs can control very critical ones.

[@少-r6c]

how to get the pdf or ppt

[@honestlocksmith5428]

Solutions to auto theft are difficult due to the right to repair. Forcing people to go to the dealership or to purchase special licenses to access the computer of a vehicle is illegal. This includes the immobilizer. Recent changes in security will force major manufacturers who refuse to play along will sue or continue to reverse engineer vehicles. At the end of the day, it's up to each individual to secure their own vehicles. Just like we do our homes and personal belongings we carry. We also need to strictly punish thieves.

[@SuperMarioDiagnostics]

Right to repair never included immobilizer systems

[@josephkanowitz6875]

ב''ה, or you could just rent from my Connecticut landlord.