Car Security Check · Updated October 18, 2026 · Defensive-awareness guide: how the attacks work conceptually and how to stop them — no exploit instructions
Your car is a network of 100+ computers on wheels. Modern vehicles carry cellular modems, Wi-Fi, Bluetooth, keyless entry radios, companion apps, and internal wiring buses — every one of them an attack surface. In January 2026, white-hat hackers at Pwn2Own Automotive in Tokyo collected $1,047,000 for 76 zero-day vulnerabilities in fully patched cars and EV chargers. Here are the six real techniques behind car hacking — and the defenses that actually work.
Your keyless fob constantly whispers a short-range radio signal. In a relay attack, one thief stands near your car with a relay device while an accomplice stands near your house — where the fob sits on a table — with a second device. The pair amplify the fob's signal across the distance, so the car believes the key is right there. Doors unlock, the engine starts, and the car drives away in under a minute. No broken glass, no alarm.
What it needs: proximity to the fob (typically within a few meters of the house) and inexpensive radio relay hardware. Defense: store the fob in a Faraday pouch or metal box that blocks radio signals; many owners also disable keyless entry in the car's settings when parking overnight.
Older remote fobs use rolling codes: each button press sends a new code, and the car rejects reused ones. Attackers get around this by jamming the signal while recording it — you press "lock," the jammer blocks the car from hearing it (so the car stays unlocked), and the attacker keeps your code for later. Newer systems use tighter timing windows, but millions of older vehicles remain exposed.
What it needs: line-of-sight to you pressing the fob. Defense: always visually confirm the car locked (lights flash / mirrors fold); if it doesn't respond, move and try again rather than pressing repeatedly; keep the car's firmware updated.
CAN (Controller Area Network) is the wiring that lets a car's computers talk to each other — engine, brakes, locks, lights. It was designed in the 1980s for reliability, not security: messages carry no authentication. Documented real-world thefts show attackers gaining physical access to the wiring — in reported cases through the headlight harness — and injecting crafted CAN messages the car obeys as if they came from its own computers, unlocking doors and more.
What it needs: brief physical access to exposed wiring. Defense: park in well-lit, monitored areas; aftermarket CAN-bus intrusion alarms exist; and pressure manufacturers — the long-term fix is authenticated CAN (SecOC), which newer platforms are adopting.
Telematics units and infotainment systems connect to cellular networks, Wi-Fi, and Bluetooth. The landmark 2015 Jeep Cherokee demonstration — researchers remotely controlled steering, brakes, and transmission through the infotainment system — forced a 1.4-million-vehicle recall and changed the industry. Attackers today probe the same surfaces: cellular-exposed services, malicious media files, and Bluetooth stacks.
What it needs: a remotely reachable software flaw. Defense: install manufacturer software updates promptly (many now arrive over-the-air); disable Wi-Fi/Bluetooth when not in use; never plug unknown USB devices into the car.
Carmaker apps let owners unlock, start, locate, and honk their cars from a phone — which makes the app account as valuable as the key. Attackers take over accounts with credential stuffing (trying passwords leaked from other breaches), SIM swapping, or phishing. Once inside, they can unlock and start the car from anywhere in the world.
What it needs: your reused or phished password. Defense: a strong unique password on the carmaker app, two-factor authentication enabled, and checking the account's device/session list for unknown logins.
REPORTED At Pwn2Own Automotive 2026 (Tokyo, January 21–23, hosted by Trend Micro's Zero Day Initiative), security researchers earned $1,047,000 for 76 unique zero-day vulnerabilities across EV chargers, in-vehicle infotainment systems, and Automotive Grade Linux. Team Fuzzware.io took the "Master of Pwn" title with over $215,000 in winnings. Synacktiv compromised a Tesla infotainment system via a USB-based attack chain ($35,000), and researchers demonstrated exploits against Alpitronic, Autel, ChargePoint, Phoenix Contact, and Grizzl-E charging equipment — including what was reported as the first public supercharger exploit.
The detail that matters: every target was fully patched when the contest began. As organizers and press noted, these were unknown flaws in current software — which is why the industry treats these contests as proof that patching alone is not enough, and layered defense plus fast update cycles are essential.
Six questions — one per technique. Answer honestly.
A relay attack defeats keyless entry without touching your key fob. One thief stands near your car with a relay device while an accomplice stands near your house with another; the devices amplify the fob's signal over the distance, so the car believes the key is present and unlocks. The whole theft can take under 60 seconds. A Faraday pouch or metal box that blocks the fob's radio signal is the standard defense.
CAN injection targets the Controller Area Network, the wiring that lets a car's computers talk to each other. With physical access to the wiring — documented real thefts reached it through the headlight harness — an attacker injects crafted messages that the car treats as legitimate commands, for example unlocking doors. It works because CAN was designed for reliability, not authentication.
Yes. Researchers have repeatedly demonstrated remote compromise through telematics units and infotainment systems with cellular or Wi-Fi connectivity — the famous 2015 Jeep Cherokee demonstration is the landmark case. At Pwn2Own Automotive 2026, researchers disclosed 76 zero-days across infotainment systems and EV chargers on fully patched targets, showing that patching alone is not enough.
Companion apps let owners unlock, start, and track cars — so the app account becomes a target. Attackers use credential stuffing (reusing passwords leaked from other breaches), SIM swapping, or phishing to take over the account, then unlock the car from anywhere. Strong unique passwords plus two-factor authentication on the carmaker's app are the core defenses.
Yes, for relay attacks specifically: a Faraday pouch or box blocks the radio signal between your key fob and the outside world, so thieves cannot amplify it to your car. It is cheap, passive, and effective against the most common keyless-theft method. It does not protect against CAN injection, app account takeover, or physical key theft.
Pwn2Own Automotive 2026 (Tokyo, January 21-23, hosted by Trend Micro's Zero Day Initiative) awarded $1,047,000 for 76 unique zero-day vulnerabilities across EV chargers, infotainment systems, and automotive operating systems. Every target was fully patched at the contest's start. The takeaway reported by organizers and press: even current, patched automotive software still contains exploitable flaws, so layered defenses and fast patching matter more than any single fix.
Related checks: AI-agent phishing (the credential-theft angle behind app takeovers) · IoT agent threats · real-world IoT hacks · all security checks
FEATURED — BreachHunter: BreachHunter tracks emerging threats and zero-days — like the 76 disclosed at Pwn2Own Automotive — so your defenses are built on what's actually being exploited, not last year's playbook.
FROM INGENIOUS AI — all 11 platforms: DisclosureGuard · ModelMinder · TermsWatch · Vibe-Code Audit · Rogue-Agent Defense · BreachHunter · ChatBreaker · Agent Flight Recorder · Agent Auth Gateway · DomainGuard · ContentCraft AI
Get early access on WhatsApp →
Filed under Car Hacker by Ingenious AI — see the related checks above for more in this series.