[headers]

Originally Posted by Tejas Ingle

IMO, it is possible to play with onboard control units remotely. This is possible in high end cars starting from entry level luxury cars. It is not possible in lower end cars.

Originally Posted by DerAlte

no sane control system designer will put an unreliable wire-connection replacement just because there is BT around. The reason is quite simple, even if it is for an RR or a Bentley: BT increases the ECU cost without giving ANY benefit over a wired connection.
...

What one has to realize is how much CONTROL is allowed by ECU designers to outside influence (via whatever protocol or interface) - NONE whatsoever. CAN is only the physical layer implementation of a simple principle: ask a question, get an answer (and an associated action, if provided). Like in any object oriented system, if there is no handling method provided inside an object, all such queries are just ignored by the object one queries. The principle was the same in the generation previous to CAN/OBD too: KWP2000.

...
Lastly, ONE insider is of no use in this scheme of affairs - you need to win over at least 20-30 people in the chain to make them collude in sending out deliberately vulnerable code. Would they risk their (and their company's) reputation on such a frivolous thing? I don't think so.

A beautiful explanation given by Deralte

- Come on guys, if systems were so vulnerable, vehicle manufacturers wont risk into it.

[DerAlte]

Originally Posted by NetfreakBombay

... That is not true anymore.

Cars that are on lease are routinely fitted with remote monitoring systems that can send various commands over cell networks. ...

In this case, it was not "Hacked", employee just knew the password. But car was connected to net and was receiving commands. ...

LOL We are not talking on the same subject any more.

* The 'Car' and it's integrated systems are defined as what came out of the factory. Those are not connected to the 'net because, quite simply, they don't have anything to do with the 'net
* Telemetry doesn't use the 'net as we know it
* Conventional Remote monitoring systems for the 'Car' use the telemetry channel

What you are talking of is "Fleet Management Systems" or "Fleet Monitoring Systems" - an add-on that really does not get on to the 'net, and does not connect to the CAN system ususlly. Non-fleet cars - like yours and mine - don't have these. These systems are completely based on GSM SMS channel for asynchronous independent communications (command is embedded in text in incoming SMS, response is embedded in text in outgoing SMS). By and large, the commands are limited to asking for operating parameters such as start stop times, GPS coordinates, average and peak speeds, etc.

Fleet cars (and trucks and buses) have had such systems since the early '90s, initially based on costly satellite based systems. The modern version, used by car hire companies, has the ability to disable the car via the ignition circuit, not EMS. In Europe, they had reason to - to prevent rental cars being driven off to Eastern Europe and sold off. Earlier rental contracts prevented one from driving further east than Germany and Austria - quite obviously that was a tooth-less threat against people determined to steal and never show their faces again.

There are at least 2 Indian companies (one based in Bangalore) involved in making and operating such systems (no implication on their integrity). There was even one which used the driver as a part of the communications LOL - the driver had to get down, and take the smart card storage to the nearest designated center to upload the data .

Even Bangalore's infamous BTS (Bittare Thiruga Sigalla - 'you won't get another one if you leave this one', referring to their legendary time mismanagement) has FMS fitted on many of it's buses. Of course they don't use the Disable feature despite some drunks driving off with parked buses for a joyride.

[volkman10]

Exploiting weaknesses in apps to go on “phantom rides” with someone else’s profile.

While companies have taken note, with Daimler AG’s Car2Go car sharing beefing up security measures after a limited number of accounts were hacked, risks around vehicle cybercrime are only going to get worse.

Link