[mdorazio]

Thank you for pointing this out. A few additional notes on the way most modern car electronics work:

1) The entertainment system generally has read-only access to the CAN bus via an intermediary DCU. Even if you were able to "jailbreak" it, you wouldn't be able to modify the CAN.

2) The control unit(s) that actually have the ability to modify things like brakes, maximum speed settings, etc. are ECUs (http://en.wikipedia.org/wiki/Electronic_control_unit) and are entirely separate from the entertainment system.

3) Updates to vehicle-critical systems generally never even go through the entertainment system. They are sent over the air to the car's receiver (usually a kind of DCU), and are processed outside the purview of the entertainment system. The only thing the entertainment system can do is schedule the download and read the progress of the update.

It's interesting to see that Ethernet is used to connect the infotainment displays, but this isn't really a security concern as far as I can see. It just means we'll probably see some mods for the displays in the future, like turning off the YouTube lockout or enabling different data displays.

[rjsw]

There isn't any reason why the entertainment system couldn't reprogram the ECUs, I have never seen a read-only CAN controller so the hardware will be able to write to the CAN bus. The OBD-II diagnostic connector provides full access to the CAN bus anyway so once you are inside the vehicle there isn't much security.

You could even run the service diagnostics on the entertainment system and avoid the need for extra hardware in repair shops.

[mdorazio]

At least with the auto manufacturers I've worked with the entertainment system is controlled by a DCU, which is in turn connected to the CAN controller. It is the DCU that limits the access to be read-only. It may be possible to alter the firmware of the DCU to allow two-way access, but it would not be easy.

100% agree with you that if you're already inside the car security of the entertainment system is a moot point. There are attack vectors you could use that bypass software controls entirely.