Hacker News Reader

The car hacker's handbook [1] has a chapter on just using the infotainment system to access the CAN. Specifically mentions "attacking through the update system".

[1]https://opengarages.org/handbook/ebook/ (chapter 9)

An aftermarket head unit connects to the CAN bus? The aftermarket head unit I installed certainly doesn't. Are you sure what you are saying, which is true for OEM units, applies to aftermarket ones?

Mine does. Its dashboard shows fuel level and a bunch of other things and I can bring up a speedometer/rpm app.

I believe the connection exists because the steering wheel buttons/iDrive talk to the original head unit over CAN.

Can't vouch for all car architectures, but in most cases the head unit is QM and safety domains are usually segmented from each other. So even if the head unit talks CAN (it needs to get car data somehow) it will only communicate with the rest of the car through a gateway that will not allow it to take any dangerous actions.

Manufacturers should be sued to absolute oblivion for doing what any developer would tell you is a security hole.