Engineers and tech people like Craig Smith (who made a great book about hacking cars) never stop warning about car security. Saying that modern cars ain't secure and can be hacked from the outside (cellular) and eventually be controlled.

If a hacker is able to connect to the car via cellular, he will be connected to the infotainment system right ?

So this means that the infotainment console of those cars are directly connected to every single node/ECU of the car (comfort, body and engine) ?

It seems weird to me because on the car I own (without cellular), the infotainment system isn't connected to every ECU. If I want to control the body, I have to find wires that are connected to it, same for the comfort and engine. But none of them are linked together.

Can someone clarify this please ?

Many thanks in advance.

  • What car do you own that you are referring to?
    – Milison
    May 12, 2018 at 22:45
  • 2
    Cars use what is called a CAN bus, which has no security whatsoever, so once you are in the system you can do anything you want.
    – Moab
    May 12, 2018 at 23:05
  • Welcome to Motor Vehicle Maintenance & Repair! May 12, 2018 at 23:54
  • Thanks for your comments, I'm testing car hacking on a Toyota Hilux (2016) and a Lexus RX300. I actually know that CAN has no security itself but what I mean is : are there cars that have an infotainment system which has the main CAN buses linked together to it (engine+body+comfort) ? It seems to be the case when they hack the new Jeep from the outside (youtube.com/watch?v=MK0SrxBC1xs) because he apparently does not need anything else ?
    – Lawris
    May 13, 2018 at 5:50
  • We have a few questions on this on Security Stack Exchange, and I have had Ken Munro keynote two years running at B-Sides Scotland: youtube.com/channel/UCFDj38U1zEPeIPvtZpA--Hg
    – Rory Alsop
    May 13, 2018 at 21:06

1 Answer 1


In an ideal world, you are right, the entertainment system should be entirely separate from engine management, navigation, locks, immobiliser etc.

But the world isn't ideal, and many decisions are made not by security teams, but by management, marketing or technology teams who may be tasked with cost reduction, implementation timing etc.

So some cars have unsecured or poorly secured entertainment systems that can then be used to propagate an attack to other systems, and in some cases this could be used to disable security systems, compromise navigation data, shut down the engine, or potentially to steer more modern cars.

This is obviously being looked at by many car manufacturers, as people like Ken Munro at Pen Test Partners and others are having significant success in demonstrating weaknesses.

  • Thanks for the clarification, it seems that cars are at the same point where computers were so unsecure back in time. We will maybe have to wait some car accidents caused by hacking before car manufacturers start to consider upgrading their systems...
    – Lawris
    May 16, 2018 at 7:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .