Stolen by CAN Injection in 90 seconds

[Tam]

The video recorded how thieves were able to steal Lexus RX in 90 seconds by accessing the headlight through the wheel arch. Headlights are controlled by ECU (electronic control unit). From there, a thief can reprogram the ECU to unlock the door and drive away. Thus, it's called CAN Injection.

Watch Thieves Steal an SUV in 90 Seconds, the Key Fob Doesn't Need To Be Nearby

It's getting harder and harder to protect your vehicle from being stolen. Not even parking in front of a working surveillance system will deter nefa...

www.autoevolution.com

Wonder if PIN to Drive can deny the thief from driving away away? Or could the thief do some ECU programs to bypass the PIN as well?

 

[myztic]

Toyota was never hard to steal, firsly need to understand whats CAN and how it works. There are different CANs in normal cars like MB or BMW and so on, where they are separated for drivetrain, convenience, peripherial and so on, means. You can't steal it via connecting to headlights' control modules, because there are different bytes fleeing and it would not support bytes thief would send to CAN. All depends on separation of CANs in Tesla. I yet have not found any schematic diagrams for newer teslas

 

[E90alex]

1. Tesla headlights do not have a CAN bus connection. They use LIN bus.

2. It depends on the security design of the vehicle in question, and every automaker has their own system. It appears that Toyotas have weak/non existent security in that regard.

For example in a BMW the smart key or immobilizer key authenticates with the CAS module to allow car access (eg door unlock or allows the start button to turn on the car). The CAS module then authenticates with the DME via a direct connection (not over CAN) to allow engine start. These are encrypted rolling authorization codes that are sent between the modules. This type of CAN injection wouldn’t be able to start the car.

Toyota on the other hand has the smart key authenticate with the gateway, but after that seems to just use a generic static authorization message via CAN to tell the ECU an authorized key is present and it’s ok to allow engine start. That’s akin to writing the password to your computer on a post it next to it and wondering how someone gained access to your computer.