We find that the conventional belief of vehicle cyber attacks and their defenses—attacks are feasible and thus defenses are required only when the vehicle’s ignition is turned on—does not hold. We verify this fact by discovering and applying two new practical and important attacks: battery-drain and Denial-of-Body-control (DoB). The former can drain the vehicle battery while the latter can prev...