How an Auto Security Researcher Had His Car Stolen
Automotive security experts reverse engineer a real-world CAN Injection theft tool disguised as a Bluetooth speaker used to steal a Toyota RAV4.
Summary
Investigating the Theft of a 2021 Toyota RAV4
When automotive security researcher Ian Tabor's vehicle was stolen from his driveway, he tracked down physical forensic evidence pointing to an emerging attack method known as CAN Injection.
Reverse Engineering the Hardware Theft Tool
Ian Tabor and Ken Tindell acquire and dissect the criminal hardware device—cleverly concealed inside a modified JBL Bluetooth speaker enclosure.
Exploiting Headlight Wiring to Inject CAN Frames
By accessing the vehicle's CAN bus wiring behind the front bumper headlight assembly, the rogue device silences legitimate Electronic Control Units (ECUs) and injects forged door-unlock and immobilizer-disable commands.
Industry Remediation and Cryptographic Message Authentication
The authors detail their coordinated vulnerability disclosure with Toyota, urging automakers to adopt cryptographic CAN message authentication (SecOC) to thwart physical bus injection.
Related talks
Car Hacking Village·26 min
collin · oblivion
Reverse engineers a commercial odometer rollback tool, extracting locked STM32 firmware and showing how CAN messages are intercepted and rewritten.
Car Hacking Village·29 min
Wyatt Ford · Alex Reuter
Wyatt Ford and Alex Reuter investigate security weaknesses in Vehicle Diagnostic Adapters (VDAs) used on heavy commercial trucks, exploring firmware updates and attack surfaces.
Car Hacking Village·45 min
David Rogers
David Rogers integrates commercial mileage clocking tools and remote braking overrides into an immersive vehicle simulator rig to safely study cyber-physical attacks.