DEF CON 31 Car Hacking Village - How an Auto Security Researcher Had His Car Stolen - Tabor, Tindell

The story of the investigation into the device that I believe was used to steal my 2021 Toyota RAV4 in July 2022 using 'CAN Injection'

There will be low level details on how the CAN bus works, how the 'theft device' spoofs CAN frames and using a modified transceiver to stop other ECUs communicating. We will also explain the disclosure process and possible fixes. Get the full story in the blog.

[StarchedPie]

I work with CAN for industrial applications at my job, and it is insane to me that it would get used for anything security related. I was (and now still am) under the impression that the moment there is physical access to the bus, that the bus is owned by the attacker.

[Andrei-ngyz]

Actually, the first suggestion is the only correct one. Devices accessible from the outside should not be on the same bus as the main security modules. Never.
And the excuse about the cost in production - just indicates that the manufacturer is extremely interested in its own profits, but absolutely not interested in the safety of the customer's property, after he gave money for it to the dealer...
Actually converting all the devices and modules on the bus to CryptoCAN will be more expensive than an isolated bus for externally accessible devices.

[Andrei-ngyz]

Anyone who is into the business of automotive security system installation knows about this CAN attack through the headlight wiring on Toyotas. And Toyota has known for a long time for sure. And it was known well before 2021... Hijackers have been using this method for a long time. So it's nothing new.

[zoenagy]

use LIN bus instead of CAN for headlights

[honestlocksmith]

Solutions to auto theft are difficult due to the right to repair. Forcing people to go to the dealership or to purchase special licenses to access the computer of a vehicle is illegal.
This includes the immobilizer.
Recent changes in security will force major manufacturers who refuse to play along will sue or continue to reverse engineer vehicles.
At the end of the day, it's up to each individual to secure their own vehicles. Just like we do our homes and personal belongings we carry.
We also need to strictly punish thieves.

[josephkanowitz]

ב''ה, or you could just rent from my Connecticut landlord.