> According to Tindell and Tabor's research, the attack, called CAN (controller area network) injection, works by sending fake messages that look as if they come from the car’s smart key receiver, the research continues. The underlying issue is that vehicles trust these messages without verifying them. Once the thieves have accessed the necessary cables by removing the headlights, they can use their device to send these messages, it adds.

I have to ask - does the automobile industry hire from a different pool of systems engineers than the usual pool I’m used to interacting with? It seems like everyone I know would say “obviously you should verify that the security mechanism first”.

Or is this a result of how the automobile industry is structured and what is outsourced to vendors/suppliers and what is done in house?

I’m not going to be buy that this isn’t solvable for a technical reason at this point. We have had a lot of experience dealing with PKI infrastructures and zero trust architectures in other parts of the industry.