Car cybersecurity: why modern cars are stolen through electronics, and what an owner can do

The picture of car theft as a broken window and a forced lock is out of date. On a modern car mechanics are not the barrier: everything that opens the doors and permits starting is decided by electronics.

This article is not about how that is done. It is about how the risk is structured and which measures actually achieve something.

Why electronics became the weak link

Vehicle networks were designed when a car was a closed system. Modules inside trust one another by default: if a message arrived on the bus, it is treated as legitimate.

That was sound engineering for the 1990s and is a weak point today. How the bus works is covered in CAN fundamentals.

The second factor is the number of access points. There used to be one diagnostic connector reaching the network from outside. Now the keyless entry module, telematics, wirelessly connected infotainment, and sensors around the body perimeter are all tied to it one way or another.

Three families of risk

1. Working on the keyless entry system

The most common category. The system is designed on the assumption that the key is near the car. Create conditions where it believes that, and the car opens and permits a start.

Vulnerability indicator: if your car unlocks without pressing a button as you approach, it is in this category.

What works as protection:

• A shielding (Faraday) pouch for the key at home and at work. The cheapest and most effective measure.
• Key sleep mode, where the manufacturer provides it: pressing lock twice disables the radio module.
• A mechanical steering or pedal lock. It looks archaic and works precisely because electronics cannot bypass it.

2. Access to the vehicle network from outside

The second category is physical connection to the network at points reachable without entering the cabin.

What works:

• A lock on the diagnostic connector, or relocating it somewhere less obvious. Inexpensive, and it noticeably raises the time required.
• A transponder tag that blocks starting without a separate carrier, independent of the factory system.
• Motion and tilt sensing in the alarm — it reacts to work under the bumper and near the headlights.

3. Telematics and connected services

The newest category: access through the manufacturer’s app account.

What works:

• Two-factor authentication on the manufacturer’s app.
• Checking the list of paired devices — especially when buying used. A previous owner can remain on the list, complete with unlocking rights.
• Removing the car from somebody else’s account — a separate step at transfer, and the one most often forgotten.

That last point is the most common real-world problem on this list, and it requires no attacker at all.

What this has to do with a diagnostic adapter

A fair question arises: if the risk runs through the port, is plugging something into it yourself dangerous?

Two separate cases.

Reading data with an adapter is a request to show a value. It changes nothing and unlocks nothing. The distinction between reading and writing is covered in warranty and scanners.

An adapter left permanently plugged in is another matter, for two reasons. The first is practical: some cheap adapters never sleep and flatten the battery — see parasitic drain diagnostics. The second is that any device permanently sitting in the port is one more thing you have stopped thinking about.

The rule is simple: unplug the adapter after every use. That closes both problems at once.

What diagnostics shows after an attempt

If somebody has worked on the car, traces frequently remain in module memory:

• A code cascade sharing a timestamp — from a disconnected battery or a voltage sag. Mechanics in ghost and false codes.
• U-series codes — lost communication, if the bus was cut. Covered in the U0100 guide.
• A module missing from the roll call. The most alarming sign: a module has physically gone or fallen silent.
• A changed CALID or CVN — the control software checksum. Mechanics in the Mode 09 guide.

So periodically checking the module roll call is useful for more than fault-finding.

What not to do

• Rely on the factory alarm alone. It was designed against a different class of threat.
• Leave the key by the front door. The most common domestic mistake.
• Dismiss “small things”: the car unlocked itself, lights flashed overnight, settings reset in the morning. It may just be a weak battery, but the codes are worth reading.
• Buy a car without checking its paired accounts.

In short

• Modern theft is work on electronics, not on mechanics.
• A shielding pouch for the key is the cheapest and most effective measure.
• A mechanical lock works precisely because electronics cannot bypass it.
• When buying, check the paired accounts in the manufacturer’s app.
• Unplugging the adapter after every use closes two problems at once.

Download the app — the module roll call, codes across every system, and Mode 09 are read with an ELM327 adapter over Bluetooth SPP on Android.