A historical and up-to-date guide to the world of automotive security and car hacking covering foundational breakthroughs, major attacks, community growth, tools, and essential resources.
- **First Hacking Points:** OBD (On-Board Diagnostics) port introduction enabled access to engine management with custom hardware and proprietary protocols.
- **Key Focus:** Wired access to in-vehicle networks, mainly CAN (Controller Area Network, [CAN Wikipedia](https://en.wikipedia.org/wiki/CAN_bus), standardized 1991).
- Researchers began hacking ECUs through direct access, quickly moving to remote attacks via Bluetooth, CD, cellular, and more.
- Notable exploits included 2011 Chevy Malibu remote hacks ([Wired Article](https://www.wired.com/2011/03/hackers-car/)) and proof that almost any connected vehicle could be at risk.
- **Open-source tools and low-cost OBD-II USB adapters** made experimentation accessible.
- 2015: [Jeep Cherokee/UConnect hack](https://www.wired.com/2015/07/hackers-remotely-kill-jeep-highway/) allowed full remote takeover - leading to million-vehicle recall.
- Tesla ([2016 hack](https://www.wired.com/2016/09/tesla-hack-can-remote-control-brakes-and-more/)), BMW ([ConnectedDrive hack](https://www.wired.com/2015/01/hackers-remotely-unlock-dozens-bmw-models/)), and Nissan ([Nissan Leaf hack](https://www.troyhunt.com/controlling-vehicle-features-of-nissan/)) also targeted through remote and telematics attacks.
## 4. 2019–2021: Community, Tools, and Remote Exploits
- **Events:** [Car Hacking Village (DEF CON)](https://www.carhackingvillage.com/) and [Car Hacking Village @ DefCamp](https://def.camp/car-hacking-village/) expand globally.
- [Open Garages](https://github.com/openGarages) and online forums centralize tutorials, datasets, and collaborative research.
- Tools like [can-utils](https://github.com/linux-can/can-utils), [python-can](https://pypi.org/project/python-can/), and [Scapy/CAN](https://dissec.to/kb/chapters/can/can-scapy.html) widely adopted in both hobbyist and professional domains.
- Mass remote exploitation of telematics APIs by researchers - impacting brands like Acura, Kia ([Kia API bug](https://samcurry.net/hacking-kia)), BMW, Tesla ([Tesla charger exploit](https://www.synacktiv.com/en/publications/exploiting-the-tesla-wall-connector-from-its-charge-port-connector)), Nissan ([Nissan Leaf hack](https://www.troyhunt.com/controlling-vehicle-features-of-nissan/)), and Škoda ([Škoda Mobile App bug](https://blog.vensis.pl/2019/11/vw-hacking/)).
- **Read:** [The Car Hacker’s Handbook](https://nostarch.com/carhacking)
- **Practice:** Use [ICSim](https://github.com/zombieCraig/ICSim), [ELM327](https://www.amazon.com/dp/B07SK6MJT1/), [CANtact](http://linklayer.github.io/cantact/) on test benches.
- **Engage:** [ASRG](https://asrg.io/), [Open Garages](https://github.com/openGarages), [DEF CON Car Hacking Village](https://www.carhackingvillage.com/)
- **2015:** [Jeep UConnect hack](https://www.wired.com/2015/07/hackers-remotely-kill-jeep-highway/), [DEF CON Car Hacking Village](https://www.carhackingvillage.com/)
- Monitor live vulnerability and supply chain intelligence portals (e.g., [VicOne](https://vicone.com/automotive-zero-day-vulnerabilities), [FOSSA](https://fossa.com/industries/manufacturing-autos/), [GitGuardian](https://www.gitguardian.com/industries/automotive)).
- Engage at [DEF CON Car Hacking Village](https://www.carhackingvillage.com/), [Auto-ISAC Summits](https://automotiveisac.com/), and [Pwn2Own Automotive](https://www.automotiveworld.jp/tokyo/en-gb/conference/pwn2own.html).
- Follow and contribute to open-source and research repositories.
- Stay updated with [Upstream Reports](https://upstream.auto/reports/global-automotive-cybersecurity-report/), and adapt to regulatory and threat intelligence changes.
*This guide covers car hacking’s journey from early OBD/CAN explorations to today’s cloud, API, and AI security challenges - linking you directly to key reference points and resources at each stage.*
