“In most cars on the road today, these internal messages aren’t protected: the receivers simply trust them.”
Thieves pulled the bumper off Ian Tabor’s RAV4, unplugged the headlight and stole the car days later. The headlight shares a CAN bus with the smart key receiver, so a device on that wire can announce “key validated” and the car believes it. The Toyota version hides inside a JBL Bluetooth speaker case and sells for up to €5,000. Carmakers spent years hardening the key fob and left the wiring behind the headlight wide open.