I think a basic idea should be: panic stops disconnect all wireless access.
Which will probably result in lots of calls from people after they avoid hitting a dog. But still.
Which will probably result in lots of calls from people after they avoid hitting a dog. But still.
Maybe in addition to breaking a link on a panic stop, stopping and steering would be set to a non-commanded mode that relies less or not at all (maybe impossible with current design?) on software commands.
I guess the disconnect could be physical/mechanical and require physical intervention to reconnect (but cost, etc.).
The root problem is that they were able to flash an ECU with custom code. From there they are 'trusted' on the vehicle network and can trigger or emulate any other component.
Requiring the firmware image to be signed, or not accepting a bootload from the physical interface that's connected to the internet would be a more comprehensive solution.