Hacker Finds He Can Remotely Kill Car Engines After Breaking into GPS Tracking
Not surprised. I built automotive test benches for some time. The moment you have something that can remote-access the CAN-bus, you have a problem.There are typically only a few busses in a car. In many cases, there is a LIN bus for entertainment / radio / lights etc that is physically separated from the main CAN bus. This one is mostly harmless.But if you can somehow talk to the main bus... There are like 5 critical ECUs that have to communicate "I'm OK" (engine, breaks etc) - otherwise nothing works. Those communicate with some minor encryption, and that communication is somewhat validated (they send counters to each other etc). 
But it doesn't matter. First of all, the protocols and databases are similar for different models, and known to A LOT of people  who had jobs similar to mine. In order to test or build any ECU, you have to simulate the correct communication, otherwise the ECU won't start up.. Second, just sending nonsense with the right identifier could probably shut down the car or at least make it think there is a major problem. Third, there are messages that simulate power-cycling the bus..