Get the latest tech news

Can Injection: keyless car theft (2023)

This is a detective story about how a car was stolen - and how it uncovered an epidemic of high-tech car theft. It begins with a tweet. In April 2022, my friend Ian Tabor tweeted that vandals had been at his car, pulling apart the headlight and unplugging the cables.

Ian is a cybersecurity researcher in the automotive space and has previously been awarded bug bounties for finding vehicle vulnerabilities, and I initially thought from reading his tweet that this might be a trophy hack. There are products targeting many car models, including from Jeep, Maserati, Honda, Renault, Jaguar, Fiat, Peugeot, Nissan, Ford, BMW, Volkswagen, Chrysler, Cadillac, GMC - and Toyota. This was the subject of my second CAN Quiz question, and used a particular CAN controller (that is almost never seen in production vehicles) to illustrate the problem (a real ECU will have a more sophisticated network management approach to how it tries to rejoin a CAN bus after what appears to be a hardware fault).

Get the Android app