We’ve covered before how thieves are using seemingly ordinary-looking devices to hack into cars’ CAN bus and start the engine without a key, but a new wave of reports is shining a light on this problem again. They’re actually referencing a story which broke back in January from the UK after a cybersecurity specialist had his Toyota RAV4 stolen after it was seemingly vandalized twice before.
The guy didn’t realize until the vehicle was gone those “vandalisms” were actually thieves unsuccessfully attempting to hack the CAN bus and get the vehicle unlocked and started. They had pulled off trim pieces around the headlight, pulling out cables which connect the headlight to the computer which control them.
That’s how you can have adaptive headlights and other advanced features on modern cars: everything is connected through the CAN bus or the Controller Area Network. Acting like the nervous system for a vehicle’s different systems, it connects ECUs so they can share information and coordinate responses to on-road conditions, etc. together.
What most people don’t realize is there are relatively inexpensive devices which are supposed to only be used by locksmiths but can be purchased by anyone and are capable of unlocking and even starting a vehicle by hacking into the CAN bus.
Thieves are going after the connections to the headlights because they’re especially easy to reach, although they can do the same thing using other connections. To reach the wires which provide access to the CAN, thieves have to pry back or remove trim pieces on the vehicle, including the front or rear bumper covers. If you find someone has done that to your car, they were probably trying to steal it.
Without going into too much detail, these “locksmith” devices can be purchased already embedded in seemingly innocent things like Bluetooth speakers, a cell phone, etc. If police stop suspects, they might not realize they’re carrying one of these devices used for stealing cars.
Using the device, a thief can unlock a car and have it started in under 30 seconds, if they’re good. This should be concerning. Supposedly, automakers are working to develop software updates which would close this security loophole. However, just like with your computer or smartphone, that’s always a cat and mouse game.
In the meantime, you can take steps to secure your car in all the usual ways: park inside a garage whenever possible, use motion-sensor lights, cameras, steering wheel locks, etc. to slow down and deter thieves.
