Stealing Cars With Headlights Illuminated

Car Headlight Security Flaw Unexpected

These days, modern automobiles are, in general, quite difficult to pilfer. The latest anti-theft appliances and technology make them tougher to abscond with; however, this has not thwarted robbers from devising novel schemes for making off with your cherished set of wheels. According to Dr. Ken Tindell of Canis Automotive Labs, criminals have resorted to utilizing a car’s CAN bus network by way of the headlights.

Tindell, in his most current blog post, gives an insightful look into how burglars can access the headlights of new cars and get away with them. The explanation began when one of his acquaintances, who has a notable background in cyber security, had their Toyota RAV4 hijacked. After carrying out investigations, the rightful owner found a web page which sells products that have the ability to mimic keyless entry when connected to the car’s Controller Area Network.

Websites which pretend to provide assistance to automobile owners or locksmiths are peddling these wares, yet it is readily perceptible that this is not authentic. The masquerading JBL music system retails at a price of up to $5500 and can be used on differing car types, such as Toyota, BMW, Volkswagen, Ford and sundry GM and Stellantis vehicles.

It’s evident that this item’s cost point isn’t catered toward possessors, but for illegal actors viewing it as an acquisition. Robbers harm the prohibiting and furnishing elements around the headlight, thus permitting them to gain entry to the CAN bus in the light bundle. Upon the apparatus being hooked up to the automobile, it accomplishes the bulk of the endeavor.

By hitting the “play” button on the imitation JBL speaker case, the ECU (Engine Control Unit) is prompted to unlock the doors, thus allowing the thief to get in and drive away. As the video below demonstrates, this entire procedure is finished in a matter of minutes.

This is certainly a cause for concern, but, as Tindell notes, this problem can be addressed in two ways. The first, dubbed the “quick and dirty” approach, involves a software update that allows the engine immobilizer to keep tabs on the CAN controller for any errors.

Toyota RAV4 2021 - stolen in less than two minutes

“According to Tindell, the gateway could be re-programmed to only forward a smart key CAN frame if it has recently transmitted a CAN frame without any issues, and there have been no bit errors of this kind on the CAN bus in the recent past,” writes Tindell.

This is only partially proof, with the author noting that changing the CAN injector can overcome the fix. However, this could take criminal types a while to figure out, granting the world’s automakers some time to come up with a fool-proof remedy. Tindell believes that a “Zero Trust” approach is the optimal solution and would entail the ECU of a vehicle not automatically believing messages from other ECUs and instead needing to confirm that it is an authentic request.

Given the need for new chips and hardware, a retrofit option is unfeasible; nevertheless, Tindell claims that a software replication of the Hardware Security Module can be accomplished. Currently, we would suggest parking in protected spots where crooks cannot approach your automobile.

I comprehended what they had been doing, my Toyota car has vanished! My @ToyotaUK program displays it is in transit. I just filled the fuel reservoir the prior night. FLIPPIN’ HECK! https://t.co/SWl8PcmfZJ

Despite the lack of available garage space for many owners, there is still hope in terms of thwarting potential car theft. The reality is that most thieves will not take the time to gain access to your headlights as it requires uninterrupted operation. Therefore, parking on the street should not be considered a total loss, as vigilance can minimise risk by averting possible thievery.

If you encountered the same scenario as with the RAV4 in this instance, and subsequently come across evidences of tampering to your vehicle bumper and front trim in the morning, it is advisable to contact the local police and make arrangements to protect the automobile.

Regrettably, automobile stealing is a frequent occurrence here in the United States, with bold offenders even infiltrating dealerships to get their hands on fresh cars. In the meantime, Hyundai and Kia have been the focus of a peculiar social media movement that promotes individuals to take these autos unlawfully.