I had thought the firmware already required physical presence to alter? As per the recall notice, Jeep is mailing everybody thumbdrives with updated firmware. That suggests that the hack doesn't require changing the firmware, but merely exploits what's already there.