A modern car isn’t one computer, it’s somewhere between 70 and 150 of them — ECUs (Electronic Control Units) handling everything from the engine and brakes to the infotainment screen and power windows, all talking to each other over onboard networks. For most of automotive history that network was effectively sealed off from the outside world, so security wasn’t really a design priority. That stopped being true the moment cars got cellular modems, Wi-Fi, Bluetooth and app connectivity built in as standard: the same network that controls the brakes is now, in principle, reachable from somewhere far outside the car. Automotive cybersecurity is the discipline that grew up specifically to close that gap.
The proof of concept that changed the industry: Jeep Cherokee, 2015
The moment the risk stopped being theoretical was a 2015 demonstration by security researchers Charlie Miller and Chris Valasek, who remotely took control of a Jeep Cherokee’s steering, brakes and transmission over its cellular connection while a journalist was driving it on a real highway — entirely over the internet, with no physical access to the car at any point. The attack chain ran from the infotainment system’s cellular modem, across the car’s internal network, to safety-critical systems that had never been designed with an internet-connected entry point in mind. It triggered a 1.4-million-vehicle recall and is still the reference case the entire industry cites when justifying automotive cybersecurity budgets.
Why the CAN bus was never built to be defended
Most of a car’s internal communication still runs over CAN bus (Controller Area Network), a protocol designed in the 1980s for reliability and simplicity, not security: any device on the bus can broadcast a message, and every other device trusts it and acts on it, with no built-in authentication of who actually sent it. That design is exactly why the Jeep attack worked once researchers reached the internal network: from inside, a compromised infotainment unit could send messages that looked, to the steering and braking ECUs, exactly as legitimate as messages from the real sensors. Retrofitting authentication onto a three-decade-old protocol used by literally every ECU in the car isn’t realistic, so the industry’s response has focused on containing the problem instead of rewriting the protocol.
Segmentation: keeping the entertainment system away from the brakes
The main structural fix is network segmentation: instead of one flat CAN network where every ECU can reach every other ECU, modern architectures split the car into separate domains — powertrain and safety-critical systems on one segment, infotainment and connectivity on another — connected through a central gateway ECU that filters and controls what traffic is allowed to cross between them. An attacker who compromises the infotainment system, the most exposed entry point because it’s the one talking to the outside world, should in principle hit a controlled chokepoint rather than a straight path to the brakes. A second layer, intrusion detection systems (IDS), sits on the internal network watching CAN traffic for the kind of anomalies a compromised ECU produces — messages sent at the wrong frequency, from the wrong node, or with implausible values — and can flag or block them even without knowing the specific attack in advance.
Over-the-air updates: the fix and the new risk, at the same time
The other major shift is over-the-air (OTA) software updates, which let manufacturers patch a vulnerability across an entire fleet remotely instead of requiring a dealership visit — genuinely useful for closing security holes fast, and one of the reasons Tesla in particular treats cybersecurity as an ongoing software problem rather than a one-time hardware certification. But an update mechanism is also, by definition, a channel that can push new code onto safety-critical hardware, which makes it a high-value target in its own right: manufacturers now rely on cryptographic code signing and secure boot so an ECU only accepts and runs an update that carries a valid signature from the manufacturer, refusing anything else regardless of where it claims to come from.
It’s now the law, not just good practice
Since July 2024, every new vehicle type sold in the EU has had to comply with UNECE Regulation No. 155, which requires manufacturers to operate a certified Cyber Security Management System (CSMS) covering the entire vehicle lifecycle, from design through to the vehicle being scrapped, not just at the point of sale. Its companion, UNECE R156, does the equivalent for software updates specifically, requiring a certified process for how updates are developed, validated and delivered. Between them, the two regulations turned automotive cybersecurity from an internal engineering choice into a legal precondition for type-approving a new car in Europe at all.
The EU research pushing detection and resilience further
Three complementary EU-funded projects, all backed by the CCAM (Connected, Cooperative and Automated Mobility) Partnership — cybersecurity isn’t a dedicated CCAM cluster in its own right, but work spanning its Vehicle Technologies and Key Enabling Technologies clusters — target different layers of the problem described above. CARAMEL (“Artificial Intelligence based cybersecurity for connected and automated vehicles”, H2020, coordinated by Fundació i2CAT in Spain, €5.0M, 2019-2022) applied machine learning directly to intrusion detection, aiming to spot attack patterns that rule-based systems would miss. SELFY (“SELF assessment, protection & healing tools for a trustworthY and resilient CCAM”, Horizon Europe, coordinated by Fundació Eurecat in Spain, €6.0M, 2022-2025) went a step further, building a toolbox that doesn’t just detect an attack but actively responds to and recovers from one — the “healing” layer that intrusion detection alone doesn’t provide. A companion Horizon Europe project on the same 2022 call, CONNECT (“Continuous and Efficient Cooperative Trust Management for Resilient CCAM”, coordinated by Technikon in Austria, €5.66M, 2022-2025), tackled the trust-relationship side specifically: how vehicles and infrastructure that have never previously interacted can establish enough mutual trust to share safety-critical data securely, directly relevant to the V2X communication described in our earlier article on that topic.
Photo: © Car-Shooters