← All Notes

My girlfriend sent me one of those "your car can be hacked and someone can take the wheel" posts a while back. I did what I do with most things that show up in a group chat: called it BS, confident, and moved on with my day.

I was wrong about the BS part. I was right about something else, and the gap between those two reactions is the whole article.

What's Actually True

Cars stopped being mechanical a long time ago. Steering used to be a shaft and a rack. Now it's Electric Power Steering — a motor, taking instructions from a computer. Throttle used to be a cable to the engine. Now it's electronic, a sensor reading your foot and a computer deciding what the engine does about it. Braking assist, adaptive cruise, lane-keeping — all of it software sitting between your intention and the machine doing the thing. That's not a conspiracy, that's just what a modern car is: dozens of Electronic Control Units talking to each other over a shared internal network called the CAN bus.

The part that makes the social-media claim true instead of paranoid: that internal network is reachable from outside the car. Telematics units — the box handling your cellular connection for over-the-air updates, remote start, the manufacturer's app — sit on the same architecture as the CAN bus, on the low-security infotainment side of it. In 2015, two researchers (Miller and Valasek) proved you could compromise a Jeep Cherokee's Uconnect system remotely over Sprint's cellular network, pivot from the infotainment subnet onto the CAN bus, and take control of steering and the engine while a journalist was driving it on a highway. Fiat Chrysler recalled 1.4 million vehicles over it. This isn't speculative. It happened, it's published, and the class of vulnerability it demonstrated hasn't gone away — it's gotten more relevant as cars ship with more cellular modems and more OTA update paths, not fewer.

An abstract glowing wireframe mesh in the shape of a car chassis, crisp precise lines suggesting the software skeleton beneath the metal

Why "The CIA Could Do It" Isn't the Conspiracy It Sounds Like

Here's where I have to be precise, because this is the part people mangle in both directions. Security engineers build threat models by picking a ceiling: the most capable adversary you're willing to design defenses against. "Nation-state actor" is the textbook ceiling — not because every nation-state is targeting you personally, but because it's shorthand for "unlimited budget, unlimited time, a bench of specialists, and no legal constraint on the research." The CIA isn't a boogeyman in this sentence. It's a unit of measurement. When a security researcher says a system needs to resist a well-resourced attacker, they mean exactly that tier — and a modern car's attack surface, with a cellular modem bridging into a safety-critical network, is a legitimate target for that tier to reach.

Saying "the CIA could hack your car" isn't a claim about the CIA. It's a claim about how far the vulnerability actually goes.

Saying that doesn't mean the CIA is hacking cars. It means: if you're asking "could a sufficiently resourced attacker do this," the honest answer is yes, and the Jeep demonstration is the proof, not a hypothetical.

What It Doesn't Mean

This is the half I got right, and the half the original post almost certainly got wrong: none of this means remote car hacking is common, none of it means there's a standing backdoor, and none of it means your commute is a target. Pulling this off takes real expertise, real research time, and in most documented cases, physical access to a lab-bench copy of the target vehicle first. It's a demonstrated capability, not an active epidemic. The distinction matters — dismissing the mechanism because the conspiracy framing is wrong throws out the real finding along with the bad take.

The Forensics Gap Nobody Mentions

The part of this that actually unsettled me isn't the hack — it's how hard it is to prove after the fact. Standard Event Data Recorders (the "black box" regulated under 49 CFR Part 563) capture crash telemetry, not a forensic log of the high-frequency CAN bus traffic in the seconds before. A sophisticated remote exploit that overrides steering or throttle and then clears its tracks leaves investigators with a crash that looks like driver error, because the standard tooling was never built to distinguish "the driver did this" from "the network was told to do this." Real automotive forensics, when it happens, means pulling non-volatile flash memory directly off the TCU or ECU chips — a slower, more specialized process than anything a routine accident reconstruction does today.

A single car on a dark highway at night, tail lights streaking, a faint corrupted glow flickering in the dashboard instruments

The Response Already Underway

None of this is sitting untouched. ISO/SAE 21434 — the actual cybersecurity engineering standard for road vehicles — now governs things like Secure On-Board Communication (cryptographically signing CAN messages so a rogue node can't just inject commands) and hardware security modules baked into ECUs. There's a real aftermarket forming around CAN bus firewalls and gateway modules that segment the infotainment subnet from the safety-critical one, and privacy-conscious owners are increasingly asking about air-gapping or deleting telematics units entirely. The friction is on the OEM side: cryptographic bootloader locks and Right-to-Repair fights make it harder for independent security researchers and shops to inspect or harden what's already on the road, which is its own separate, ongoing argument.

Back to the Group Chat

So — was the post right? The framing was garbage: no, there's no button in Langley that unlocks your car. The claim underneath it was correct: remote compromise of a moving vehicle's steering and engine has been demonstrated, published, and recalled-over, and the "well-resourced attacker" standard researchers measure against is exactly as capable as advertised. Half BS, half real. I'll take being half right over being fully dismissive.

— J.P. Howlett

Related:

Sources