Re: firewall
if I was designing something to connect the engine management system to entertainment system - presumably for display purposes?
The OBD-II and its GM Tech/Ford predecessors were never intended for that. As a result they cannot display faults properly without two-way interactions. Additionally, there is no authentication, no crypto and very little security. So if you can connect something to the OBD the car security is compromised as a given.
The solution is to have a dedicated unit connected to the OBD and have a limited modern one way interface using a messaging protocol of choice from that unit to the infotainment. You can implement that in ~ 10£ and do the software in a week with off the shelf components. It is also utterly trivial - you just give the problem to any security geek and that is what they will come up with.
Unfortunately, this is too "hard", too "expensive" and "does not make sense" for your average car manufacturer - let's face it their computing and security people in their vast majority are clueless.
Biting the hand that feeds IT
