Researchers will demo a new attack on production vehicles at the Car Hacking Village during DEF CON 34 that turns a car’s diagnostic port into a weapon against its own safety systems.
Modern cars are moving diagnostics from CAN to Automotive Ethernet, and gateway ECUs are supposed to limit traffic to specific IP addresses. The problem, says researcher Yehyeong Lee, is that many gateways also run DHCP so diagnostic tools can connect. Anyone with brief access to the diagnostic socket can stand up a rogue DHCP server, seize control of the gateway’s IP assignment, and then attack the network blind, with no map of the vehicle’s internals required.
The researchers blast the network with high-rate Layer 2 and Layer 3 traffic across ARP, ICMP, UDP, and TCP. The flood wrecks safety-critical functions such as the audio-visual navigation unit, wipers, and headlights, and can bring the vehicle to an abrupt stop once the driver selects Drive or Reverse. Crank the packet rate higher and the infotainment screen goes dark, refusing to come back until the vehicle is completely powered off.
The findings were discovered on a production vehicle, and the team will bring a live demo to the village’s Creator Stage on Saturday afternoon.
The work highlights a growing tension in vehicle design: the same Ethernet backbone that enables modern diagnostics and software updates also hands attackers a high-bandwidth path into safety systems when network services are left open. OEMs should treat diagnostic ports as untrusted, disable unused services, and add rate limiting and authentication to in-vehicle network stacks.
