More like, there is this acceleration module and there is this pedal that must hook into it, and there is this handy bus going through the car that you can connect the two systems to in order to make them talk with each other.

And then you add a radio, and a knob under the steering wheel to control it, and think - hey, I have this handy bus I can reuse so that they talk with each other. And suddenly, your radio talks to your brakes.

I don't think it's malicious design. More likely stupid one, or just a result of people being used to treating car hardware as trusted environment - where obsessing over security is just a waste of resources. It's just that when you introduce an Internet-connected device to that environment, it's not trusted anymore.

I'd still argue that anyone who connects radio, travel computer or air condition systems (non-critical, not real time) with breaking, acceleration and external lightning systems (mission-critical, realtime, potentially lethal) is maliciously stupid.

In almost all cars there are in fact two CAN buses - a high speed, low security bus that connects the radio to the entertainment system and so on, and a low-speed, high security (in terms of components, not actual security) but that connects the brakes to the ECU and so forth.

The issue is that frequently systems like OnStar sit on both buses, because they are used for things like engine diagnostics. If you investigate you'll notice that every single one of these car hacking attacks starts somewhere, pivots to an OnStar like system, then can control the car.

Doesn't really make your point less true, but fits perfectly in the features over security mindset.

Two CAN buses is a quite low number. Last system i saw, which was pretty old, had at least half a dozen from what i could tell from my end of the system, probably even more internally inside or behind other components. Modern cars also use flexray, LIN, MOST and all other kinds of buses. The reason for this is safety, bandwidth and that the delay jitter on a highly loaded can bus can be relatively unpredictable for high frequency control requirements like suspension, traction and other engine related control.

Or there is always the chance of management overriding building a separate system due to higher costs. The gains in safety did not justify the costs to them.

Don't contribute to malice what could be explained by stupidity. Don't contribute to stupidity what could be explained by greed.

Add to that the fact that some cars, like a Mercedes C-Class I rented recently, allow you to change the 'agility' setting from the entertainment screen (changing throttle response, steering and suspension).

There is a common bus, and there are reasons for it existing, but the fault is with an internet-connected module being able to break out of its role. Fixing that is the traditional game of whac-a-mole that we have in IT every day, at least until a secure-by-design Bus 2 comes along.