Theft via CanBus

JeffL · February 25

Not CAN bus this time......... https://www.theguardian.com/money/2024/feb/24/smart-keys-car-crime-thieves-hi-tech-arms-race?utm_term=65dae5752f6f52a9e36b5b480d3fa79c&utm_campaign=GuardianTodayUK&utm_source=esp&utm_medium=Email&CMP=GTUK_email

ColinBarber · February 25

1 hour ago, JeffL said:

Not CAN bus this time.........

It was mentioned in there, and Toyota gave this reassuring message to existing owners:

A spokesperson for Toyota, which owns Lexus, said: “Toyota and Lexus are continuously working on developing technical solutions to make vehicles more secure. Since introducing enhanced security hardware on the latest versions of a number of models, we have seen a significant drop-off in thefts. For older models we are currently developing solutions.”

peniole · February 25

5 minutes ago, ColinBarber said:

For older models we are currently developing solutions.

What a load of PR baloney! They mean for one model, every other model owner can take a long walk off a short pier.

Peter Ja · February 28

On 2/20/2024 at 7:29 AM, ColinBarber said:

Normally I wouldn't accept what a dealer says but I've not seen any reported pre-facelift NX thefts discussed here on LOC so there is something different.

The headlights have CAN bus wiring to all years in the wiring diagrams I've seen, for all three types of headlight so either wiring is different (maybe difficult to reach on one or two of the headlight designs) or the theft device doesn't support the older ones (or the body ECU/gateway ECU doesn't get tricked on the older model).

Hello Colin,

I am Peter Janas from Australia and have the 2017 NX300 Deluxe. I have struggled to find anyone who knows about CAN bus wiring to LED headlights, which my NX has. I am trying to wire in a LED light bar, but cannot find a 'wire' that will control the solid state relay so the light bar goes off when the high beam lights are dipped. Toyota Australia will not talk to my contact, who has a high profile in the auto repair industry. He was told to talk to a CAN bus Engineer. Reading what you have said above, can you help me out with the diagram I need?

Kindest Regards,

Peter Janas

ColinBarber · February 28

51 minutes ago, Peter Ja said:

Reading what you have said above, can you help me out with the diagram I need?

Hi Peter. You can access wiring diagrams here:

https://www.lexus-tech.eu/euro5search/index?PUBTYPE=EWD

You will be asked to register, which is free, but to access the diagrams you have to paid for timed access. It is €4 per hour for short term access, which is all you will need.

This is for European vehicles - I doubt there is much difference to the wiring between regions (a benefit of using CAN is you minimise wiring and can software control regulations between regions) but if Lexus offer a similar service in Australia you would be better to access local information.

It isn't going to tell you much however, other than pins 23 (white wire) and 24 (black wire) on the headlight ECU are the CANL and CANH signal pins. A CAN message is sent to turn on/off high beam, so you need something that will read the CAN bus and look for the correct message - the decode of the CAN messages isn't detailed in Lexus repair manuals so you will have to figure that out - monitor the bus and look for the messages as you enable/disable high beam.

The Swedish Guy · March 1

On 2/28/2024 at 12:18 PM, Peter Ja said:

Hello Colin,

I am Peter Janas from Australia and have the 2017 NX300 Deluxe. I have struggled to find anyone who knows about CAN bus wiring to LED headlights, which my NX has. I am trying to wire in a LED light bar, but cannot find a 'wire' that will control the solid state relay so the light bar goes off when the high beam lights are dipped. Toyota Australia will not talk to my contact, who has a high profile in the auto repair industry. He was told to talk to a CAN bus Engineer. Reading what you have said above, can you help me out with the diagram I need?

Kindest Regards,

Peter Janas

Since we Swedes are afraid of the dark we have your back here; https://www.xbb.nu/en/

They have a OBDII dongle and Power unit for allsorts of exterior lightning (LED-bars, worklights, warning lights)

Have a look i bet they can help you out, use it on my work-van for Led-bar and reverse lights and works 200% perfect!

ArneT · March 2

On 2/28/2024 at 12:17 PM, ColinBarber said:

Hi Peter. You can access wiring diagrams here:

https://www.lexus-tech.eu/euro5search/index?PUBTYPE=EWD

You will be asked to register, which is free, but to access the diagrams you have to paid for timed access. It is €4 per hour for short term access, which is all you will need.

This is for European vehicles - I doubt there is much difference to the wiring between regions (a benefit of using CAN is you minimise wiring and can software control regulations between regions) but if Lexus offer a similar service in Australia you would be better to access local information.

It isn't going to tell you much however, other than pins 23 (white wire) and 24 (black wire) on the headlight ECU are the CANL and CANH signal pins. A CAN message is sent to turn on/off high beam, so you need something that will read the CAN bus and look for the correct message - the decode of the CAN messages isn't detailed in Lexus repair manuals so you will have to figure that out - monitor the bus and look for the messages as you enable/disable high beam.

Do you think this could also be the answer to my other post about disabling the front cornering lights? I really hate the temporary light that appears on one side when I start turning into a country lane at night as I think someone is coming the other way. My local Lexus dealer said they cannot disable the cornering lights, which seems ridiculous . I am sure they can just disconnect them?

ArneT · March 2

On 2/25/2024 at 9:15 AM, JeffL said:

Not CAN bus this time......... https://www.theguardian.com/money/2024/feb/24/smart-keys-car-crime-thieves-hi-tech-arms-race?utm_term=65dae5752f6f52a9e36b5b480d3fa79c&utm_campaign=GuardianTodayUK&utm_source=esp&utm_medium=Email&CMP=GTUK_email

This article includes key relay attacks AND CAN bus. A horrific summary of the lax security on our expensive pride and joys. I'm certainly dreading my next insurance renewal, and am looking at Ghost IIs, steering locks and more.

Pm4 · March 2

Excuse my ignorance but what's a CAN bus? Some sort of old bus?🤣

GMB · March 3

18 hours ago, Pm4 said:

Excuse my ignorance but what's a CAN bus? Some sort of old bus?

Good question - I will try to explain for you. We have dustbins for recycling tin cans and plastic. To save the planet we re-use these materials to make cars from the tin/steel/aluminium cans. The plastic makes the faux leather and other cheapo bits.

So the CAN bus is a description of what your SUV or BUS like vehicle actually is - which is a bus made out of cans. Hence CANbus - QED.😉

Pm4 · March 3

Thanks, I knew my car was rubbish! 🤣 Still none the wiser.

GMB · March 3

11 minutes ago, Pm4 said:

Still none the wiser

Me neither 😒 🤐 Here's a less puerile and less facetious very basic answer for you -- Companies like to use fancy words to make their products sound expensive and good quality. A BUS is a simple term for a network backbone or in other words connecting wires The CAN bit is another way of saying that things connected to this bus can send and receive signals to controlled devices. Dead simple really innit? But google it and you will get a load of techno bumf that talks about the sizzle and not the sausage - know what I mean?

ColinBarber · March 3

On 3/3/2024 at 10:17 AM, Pm4 said:

Thanks, I knew my car was rubbish! 🤣 Still none the wiser.

Bus is a computing term meaning a shared communication path between components, essentially via copper wires either within a system or allowing multiple systems to communicate with each other.

CAN is an acronym for controller area network (hence why it is written in capital letters) - it is the specific protocol, or language, that is sent over the bus - like humans, two items communicating need a common language to understand each other.

Within the auto industry there are many different protocols used. Toyota/Lexus commonly use CAN, LIN, AVC-LAN and MOST.

The reason for using buses rather than discrete wiring is to save cost and allow more sophisticated features. Take the rear light clusters, (Toyota don't typically use CAN for rear lights but just as an example) - traditionally you have multiple wires, one for each function: rear light, brake, left indicator, right indicator, reverse and fog. That's 6 controls wires + ground. If you had sequential indicators you need two more wires for sequential mode rather than standard on/off required for hazard, so a total of 9 wires. If you had CAN controlled light clusters you can reduce to just 4 - +12v, ground and two CAN wires. If you want your mirrors to drop when in reverse, rather than a signal wire going to the mirror ECU, it can just listen for the reverse communication without needing any additional wires.

If you take it to the extreme, where modern matrix headlights are made up of 1,000+ individual LEDs that each can be controlled individually to block out the beam to oncoming traffic then that wouldn't be economically possible or reliable using discrete wiring.

Pm4 · March 3

WAW! Many thanks, never too late to learn. It all makes sense now.

ArneT · March 13

On 3/3/2024 at 11:53 AM, ColinBarber said:

Bus is a computing term meaning a shared communication path between components, essentially via copper wires either within a system or allowing multiple systems to communicate with each other.

CAN is an acronym for controller area network (hence why it is written in capital letters) - it is the specific protocol, or language, that is sent over the bus - like humans, two items communicating need a common language to understand each other.

Within the auto industry there are many different protocols used. Toyota/Lexus commonly use CAN, LIN, AVC-LAN and MOST.

The reason for using buses rather than discrete wiring is to save cost and allow more sophisticated features. Take the rear light clusters, (Toyota don't typically use CAN for rear lights but just as an example) - traditionally you have multiple wires for each function: rear light, brake, left indicator, right indicator, reverse and fog. That's 6 controls wires + ground. If you had sequential indicators you need two more wires for sequential mode rather than standard on/off required for hazard, so a total of 9 wires. If you had CAN controlled light clusters you can reduce to just 4 - +12v, ground and two CAN wires. If you want your mirrors to drop when in reverse, rather than a signal wire going to the mirror ECU, it can just listen for the reverse communication without needing any additional wires.

If you take it to the extreme, where modern matrix headlights are made up of 1,000+ individual LEDs that each can be controlled individually to block out the beam to oncoming traffic then that wouldn't be economically possible or reliable using discrete wiring.

But sadly, like with home networking and "smart" devices, security was an afterthought. The original design (back in the 1980s) was for convenience and connectivity without thinking about the "what ifs" of some nefarious person or device being connected and what could go wrong. Stable door, bolt and horse spring to mind! Cars being stolen in under 1 minute, strangers being able to view baby monitors, control your boiler / HVAC and more unintended consequences follow.

Spock66 · March 13

2 hours ago, ArneT said:

But sadly, like with home networking and "smart" devices, security was an afterthought. The original design (back in the 1980s) was for convenience and connectivity without thinking about the "what ifs" of some nefarious person or device being connected and what could go wrong.

Actually I would blame the manufacturers for using it in applications it was never intended for, it was never designed to be a secure protocol so using it to control critical security features was a major design flaw which could and should have been foreseen.

Jim1977 · March 13

The One show is covering Lexus keyless thefts, in the watchdog segment. It’s out the bag on BBC1 prime time now…. Showed RX being pinched on CCTV. Worth watching if you missed it.

Lexus were approached by the BBC and said they were shortly fitting “security hardware” for pre Sep 2021 cars. This, and the plate, would be fitted for free. Customers should call their dealer to book in.

Tickedon · March 14

Yes, there’s another thread here discussing the show:

BillSt · March 15

At last, information from Lexus: https://mag.lexus.co.uk/lexus-uk-statement-on-vehicle-theft/

61babes · March 15

I wrote to both the President and Managing Director and Head of UK Operations (Director of Lexus UK) and the Chief Operating Officer Toyota Motor group Europe on 12th March and today received a letter back stating in writing that my model of NX300h 'IS NOT susceptible to this attack method as the technology which enables CAN Bus theft is not on your car, due to its production date'.

My car is a 2017 Plate model F Sport with Premium pack.

The letter was from Stephen Hinshelwood, Executive Office, Toyota (GB) PLC.

I'm still going to remove both inner splash guards to have a look for myself and probably make some plates up to cover whatever I find.

I'm also toying with having the attached made and fitting it to each side under the car, where they attack.