An electronic dongle used to connect to the onboard diagnostic systems of more than two million cars and trucks contains few defenses against hacking, an omission that makes them vulnerable to wireless attacks that take control of a vehicle, according to published reports.

US-based Progressive Insurance said it has used the SnapShot device in more than two million vehicles since 2008. The dongle tracks users' driving to help determine if they qualify for lower rates. According to security researcher Corey Thuen, it performs no validation or signing of firmware updates, has no secure boot mechanism, no cellular communications authentication, and uses no secure communications protocols. SnapShot connects to the OBDII port of Thuen's 2013 Toyota Tundra pickup truck, according to Forbes. From there, it runs on the CANbus networks that control braking, park assist and steering, and other sensitive functions.

"Anything on the bus can talk to anything [else] on the bus," Thuen was quoted as saying in an article from Dark Reading . "You could do a cellular man-in-the-middle attack" assuming the attacker had the ability to spoof a cellular tower that transmits data to and from the device.

The critique was presented last week at the S4x15 Conference in Miami. It's only the latest research to highlight the minimal protections included with many widely used car computer systems. Researchers at Argus Cyber Security analyzed the Zubie connected car service and similarly found it lacking many anti-hacking defenses. Progressive officials told Forbes they were confident SnapShot was secure, but welcomed any data Thuen may have so that they could evaluate it and make any necessary improvements.