The technique, called CAN injection, allows a car to be stolen in a few seconds using an old, iconic phone: the Nokia 3310.

In ten, fifteen seconds at most, a car can be stolen with a Nokia 3310 and a cable. This is what emerges overseas and it is not a late April Fool’s joke, but a new technique exploited by the bad guys to take possession of other people’s vehicles, taking advantage of the famous telephone launched by the Finnish brand in the now distant 2000. No particular skills are needed ( if not the propensity to crime).

CAN injection, this is how the method is defined. It was first described by Ken Tindell, CTO of the Canis Automotive Labs company specializing in computer security applied to the world of four wheels. The theft takes place by tampering with one of the car’s headlights and then connecting to the CAN bus (Controller Area Network) to interact with the on-board system, deactivating the alarm and thus allowing the engine to be started. Among the demonstration videos circulating on the net, one refers to the Toyota RAV4 model, but models produced by Maserati, Land Cruiser and Lexus would also be vulnerable.

The first reports of cars stolen in ways attributable to this technique date back to April 2022. The particularity of the instrument used, a specially modified Nokia 3310, has now brought it to the headlines. Units of the phone with modified firmware and additional chips (one of which was pulled from a $10 JBL speaker) for that purpose have been spotted for sale on Telegram and through some websites, priced around €2,700.

The good news is that the risk can be avoided through a software update, which would still require intervention by the owner and/or manufacturer. A definitive solution would consist in the introduction of cryptographic protection for the messages conveyed through the communication protocol used by the CAN bus, so as to render harmless those which do not come directly from the vehicle’s control unit.