As vehicle technology grows more complex, it can introduce new vulnerabilities that manufacturers don’t see until it’s too late. Ken Tindell, CTO of automotive cybersecurity company Canis Automotive Labs, details a new way that thieves are able to steal vehicles by hacking into them, Jalopnik reports.
Tindell made a post on his blog about an incident that happened to his friend in which their “nearly new Toyota RAV4” was stolen using an innovative method that Tindell has figured out.
It’s referred to as “CAN injection.” Thieves target a vehicle’s CAN bus, which is commonly seen in modern cars. In order to do so, the thief needs physical access to the wires of the vehicle, which makes it a slightly more difficult task. This can be achieved, however, by simply removing a car’s headlight, Tindell noted.
Once access to these wires is gained, thieves are able to “inject malicious commands into the network” and “falsify the presence of the car key.”
Tindell proposes a solution referred to as “the ‘zero trust’ approach,” which would make it so that “every device, even within a car’s internal CAN bus, needs to verify itself during any communication.” The solution is viable, though it would also require more work from manufacturers with regard to their cybersecurity measures.
