'I got really angry': Ontario woman scares away car thieves at her home

How Ont. car thieves defeat vehicle immobilizers A Pickering woman was unable to stop car thieves after they used one of several methods to hack her new Lexus.

When Maryam Ali saw a headlight on her car turn on in the middle of the night, she knew something wasn’t right — and rushed out to confront two car thieves, screaming at them.

Her surveillance video shows the thieves scatter — a small victory in the fight against surging thefts — and also shows in detail a tactic that security experts believe they have identified and can fight with new security standards.

“I saw the light in my car go on. And right away, something clicked. I said, ‘This is not happening to me,’” Ali told CTV News Toronto in an interview at her Pickering, Ont., home.

“There was a rage that came through. You know, I got really, really angry,” she said.

Other security video shows the thieves scouting the neighbourhood and then settling on Ali’s Lexus.

Rather than go into the driver’s seat, the thieves target the headlights, drilling or hammering through to access its wiring.

The video shows one headlight turn on, and only then do the thieves get behind the wheel, ready to go — exactly the point where Ali rushes outside.

The tactic she interrupted is known as a CAN injection attack, said Durham Autohaus’s Ryan Jaipaul. He says thieves get at the wiring in the headlights and use that to send signals to the car’s Controller Area Network.

Digitally controlling that central hub allows the thieves to command other parts of the car, including unlocking the vehicle and tricking the car into thinking that its key fob is in the vehicle, which allows them to start the car.

“They’re injecting their software through the CAN wires into the vehicle and then hacking it,” Jaipaul said as he watched the video with CTV News Toronto.

It’s one of several types of attacks that treat a car like a computer. And the tech-savvy approach is one that defeats an immobilizer, which stops a car from starting without its key.

Until recently, the immobilizer was a key success in stopping car theft. Provincial figures show a sharp drop in car thefts after it was made mandatory in Canada almost 20 years ago.

But now, thefts are surging again, prompting a national summit in Ottawa last week to deal with the problem.

On Wednesday, the government earmarked $28 million in new money to help stop the export of stolen vehicles that are shipped abroad and destined for Africa or the Middle East.

One major problem is that to thieves using attacks like the CAN injection, cars remain astonishingly easy to steal.

An American agency is proposing new standards that could stand in the way of the CAN injection for new cars.

George Borlase of UL Standards & Engagement says the agency’s new standard, ULC 338: Vehicle Theft Deterrent Equipment and System was published in July 2023.

“We believe that vehicles with the immobilization systems that conform to revised standards will be harder to steal,” Borlase told CTV News Toronto in an interview.

The standard could target-harden the cars, but representatives of manufacturers say adopting it could take years.

“That's a longer-term situation in terms of getting suppliers lined up and that sort of thing, so you're looking at 3-4 years and the reality is we have a serious crisis in auto theft in Canada right now,” said David Adams, the President and CEO of Global Automakers of Canada.

Jaipaul told CTV News Toronto he is convinced that a mass-produced theft deterrent is too predictable to stop thieves.

He pointed to the aftermarket and custom theft deterrents that can provide unexpected barriers to theft, including a device that turns the buttons on a car’s steering wheel into a keyboard that can enter a password to start the car.

“We as installers can install this device in multiple places in the vehicle, and thieves will have no idea where that is,” he said.

Ali says her victory against the car thieves targeting her Lexus was short-lived. Months later, she said, someone targeted her car in a parking lot and they were successful.

“I came back at four in the afternoon to the spot where I thought my car was and it wasn’t there. I think I cried. I was so upset,” she said.

She says she’s not confident even her newer replacement vehicle is less vulnerable to attacks like the one that she believes ultimately took the Lexus.

“Vehicle companies need to be held accountable,” she said.