What Is a CAN Injection Attack? The New Car Theft Method
If relay attacks worried you, CAN injection is the method keeping security engineers up at night. It doesn't touch your key at all — it talks straight to your car's own computer. Here's what's really going on.
What is the CAN bus?
Every modern car has an internal network — the CAN bus — that lets its computers talk to each other: the engine, the locks, the key reader, the lights. These modules trust each other completely, because they're all supposed to be inside the car.
That trust is the weakness. If a thief can get a message onto the bus, the car believes it.
How a CAN injection attack works
Thieves reach a point where the wiring is easy to get at from outside — often behind a headlight, wing mirror, bumper or wheel arch.
- They pop the panel and splice a tiny pre-made device into the CAN wiring.
- The device injects fake messages — ‘the key is present’, ‘unlock’, ‘disable the immobiliser’.
- The car obeys its own network, unlocks and starts. They drive off.
The whole thing can take under a minute, and the only damage is a popped-off trim panel.
Why it's so hard to stop
A Faraday pouch does nothing — the attack never uses your fob. The factory alarm and immobiliser don't fire, because every message looks like it came from inside the car. Even keeping your key in a tin won't help. CAN injection sidesteps all of it.
What actually stops a CAN injection theft
You stop it with a layer that isn't part of the car's own network and can't be told what to do by it.
IMMOSTOP holds the engine immobilised at two separate points and only releases them when your authorised phone is in range. Even if a thief convinces the car's computer to ‘start’, the engine stays dead — there's no message on the CAN bus that can release an IMMOSTOP cut point. It's a deliberately separate lock, which is exactly why it works against attacks the car's own security can't see.
The attack talks to your car's computer. IMMOSTOP answers to your phone instead. See how IMMOSTOP stops it →
Common questions
What is a CAN injection attack?
A theft method where criminals splice a device into a car's internal CAN bus network — usually reached behind a headlight or wing — and inject fake messages telling the car to unlock, disable its immobiliser and start, all without the key.
Does a Faraday pouch stop CAN injection?
No. A Faraday pouch only blocks your key fob's signal, and CAN injection doesn't use the fob at all. It talks directly to the car's computers, so pouches and key tins make no difference.
Can IMMOSTOP stop a CAN injection theft?
Yes. IMMOSTOP's two immobilisation points are independent of the car's own network and are only released by your paired phone, so no injected message can free them — the engine stays immobilised even if the car is told to start.