Honestly, that was written from a bit of a "doomsday"/paranoia/tin-foil-hat perspective. Those guys are completely exaggerating /blowing it out of proportion when they say "any idiot can randomly throw numbers at the bus and make the car spontaniously combust". They obviously have a LOT of background in GMLAN, and have done a TON of reverse engineering. Either that or their brother is a GM software engineer. Because GM guards all of the specs/white-papers/databus info on both GMLAN and Class 2 databusses with the utmost secrecy. I have an ELM322 and I once spent a whole weekend throwing random commands at my truck and I couldnt get it to do anything more than lock the doors, put the windows up and down, and chime. All of the "wrong" commands I sent were simply ignored and worst case scenario, the door locks would stop working and I would have to cycle the ignition.The opposite side of the "it can't go wrong" coin are those who have demonstrated being able to take over system control via CANBUS in ways that could be catastrophic if done in a moving vehicle.
While this was done in terms of how someone could maliciously affect a system to which not having access would be a primary safeguard, once you facilitate access you open the door to malicious action both deliberately caused and unintentionally. Many things said to not be possible proved indeed to be possible.
The issue of 'fuzzing' is particularly relevant to damage a PICAXE or similar system could inflict; simply throwing inorrect packets on the bus causes some ptentially dangerous events to occur.
Full paper at http://www.autosec.org/pubs/cars-oakland2010.pdf, snippets below -
Reflashing ECUs While Driving. The standard also states that ECUs should reject reflashing events if they deem them unsafe. In fact, it states: “The engine control module should reject a request to initiate a programming event if the engine were running.” However, we experimentally verified that we could place the Engine Control Module (ECM) and Transmission Control Module (TCM) into reflashing mode when our car was at speed on jack stands. When the ECM enters this mode, the engine stops running. We also verified that we could place the ECM into reflashing mode while driving on the closed course.
Fuzzing. Much to our surprise, significant attacks do not require a complete understanding or reverse-engineering of even a single component of the car. In fact, because the range of valid CAN packets is rather small, significant damage can be done by simple fuzzing of packets (i.e., iterative testing of random or partially random packets). Indeed, for attackers seeking indiscriminate disruption, fuzzing is an effective attack by itself.
Brakes. Our fuzzing of the Electronic Brake Control Module allowed us to discover how to lock individual brakes and sets of brakes, notably without needing to unlock the EBCM with its DeviceControl key. In one case, we sent a random packet which not only engaged the front left brake, but locked it resistant to manual override even through a power cycle and battery removal. To remedy this, we had to resort to continued fuzzing to find a packet that would reverse this effect. Surprisingly, also without needing to unlock the EBCM, we were also able to release the brakes and prevent them from being enabled, even with car’s wheels spinning at 40 MPH while on jack stands.
Lights Out. Our analysis uncovered packets that can disable certain interior and exterior lights on the car. We combined these packets to disable all of the car’s lights when the car is traveling at speeds of 40 MPH or more, which is particularly dangerous when driving in the dark. This includes the headlights, the brake lights, the auxiliary lights, the interior dome light, and the illumination of the instrument panel cluster and other display lights inside the car.
Critical components, like the EBCM brake controller, are connected to the separate highspeed bus, with the Body Control Module (BCM) regulating access between the two buses. One might therefore assume that the devices attached to the low-speed bus, including aftermarket devices, will not be able to adversely impact critical components on the high-speed bus. Our experiments and analyses found this assumption to be false.
"jam the door locks by repeatedly sending a lock command". Give me a break. Even a 6-year old has enough strength to force the door lock open and overpower the door lock motor.
Basically, that whole article needs to be taken with a HUGE HUGE grain of salt.