Most connected car security myths are half true. Cars can be attacked, but not every car is remotely drivable by anyone, and strong encryption does not fix every problem. Here are five common beliefs, checked against the sources used across this series.
Myth 1: Encryption on the bus stops attackers
Fact: classic CAN has no built in authentication or encryption. Wikipedia states that an attacker who can insert frames onto the bus can intercept or inject messages, so applications must add their own measures. Whether a given vehicle adds them depends on its design.
Myth 2: Strong encryption stops keyless theft
Fact: relay attacks pass messages unchanged, so they work regardless of encryption or authentication. Distance measurement with ultra-wideband ranging helps. A 2024 ADAC test reported on the reference page found that the vehicles resisting relay equipment were those with UWB.
Myth 3: The OBD port is harmless because it is just for mechanics
Fact: the port connects to the diagnostic network, and the reference page says the original specifications lack authentication and authorization. It reports that researchers in 2012 gained control of many components through it. It also describes thieves using reprogramming devices. Dongles left plugged in add their own wireless exposure.
Myth 4: Over-the-air updates are a risk, so skip them
Fact: updates can create an attack path, listed as spoofing, tampering, replay and privilege escalation. They also let manufacturers fix flaws without a workshop visit. The reference page notes that a recall for emissions software that affected 11 million vehicles was an issue over-the-air updates could have avoided. The answer is a well designed update system, which UN R156 targets by requiring a managed process.
Myth 5: Regulation guarantees a secure car
Fact: UN R155 requires a cybersecurity management system and UN R156 requires an update management system. Both are about process and evidence across the vehicle life cycle. UL describes the CSMS as a systematic, risk based approach. A certified process raises the floor. It does not promise that no vulnerability will ever be found.
- Assume the in-vehicle network trusts whatever reaches it, and defend the boundaries.
- Measure what matters, such as key distance, rather than trusting a cipher label.
- Keep the diagnostic and update paths under control.
- Keep records so you can answer questions after a new vulnerability appears.
Why the myths persist
Car security stories often compress a complex chain into a single dramatic sentence. In practice an attack needs a way in, a path across networks and a message the target will accept. Each step has a defence, and that is why the layered approach in the regulations and standards makes sense. Keep that chain in mind when you read headlines.
Quick check
Is a connected car more at risk than an older one?
The sources do not compare them. Connectivity adds paths such as telematics and updates, while older cars have physical and diagnostic risks. Assess each vehicle by its interfaces.
Sources
- CAN bus, Wikipedia
- Relay attack, Wikipedia
- On-board diagnostics, Wikipedia
- Over-the-air update, Wikipedia
- UN R155 CSMS, UL Solutions
Last reviewed: 19 October 2026.
