Wall of text incoming:
Theoretically any modern car with drive-by-wire and electronic power steering can be 'remotely controlled' via a CANbus connected telematics unit (Or even an infotainment unit via Wifi or Bluetooth if able to be hacked 'through'). But there's also a lot of gotchas involved. Basically having intimate knowledge of each vehicle's set of modules and CANbus networks, what are the modules programmed to responde to/interact with over the network. If the desired interaction cannot happen, can the modules be reprogrammed to allow them to respond in the desired fashion? There's rarely ever any direct and dumb 'trigger this output' interactions but specific routines that the modules follow that may or may not do what you desire.
For example with our C-Max. With the auto-park option, there is a function there in the system allowing the parking aid module to speak to the EPAS module and directly control steering while the car is in gear. There may be some specific safeguards though. I recall reading, and don't recall if it was a Ford vehicle or another make, that there is a hardcoded limit to lock out this control path above a certain speed. Throttle and brake control are another beast altogether. With the C-Max there's not a whole lot of entry points for that. We don't have the luxury of adaptive cruise control so for just basic CC that is usually self contained within the PCM which already acts on internal info from itself (engine speed, vehicle speed, engine load, etc) and the only external inputs are direct connections to the steering wheel controls and brake switch. Brake control is also similarly limited through ABS and what outside inputs it can act upon. Now if you move over to something like the Fusion which does have options such as Adaptive Cruise, you possibly have some options there for interaction but once again depends on what the various modules are designed to respond to.
I'm actually surprised there hasn't been anything from the side of GM vehicles with OnStar as they advertised early on the anti-theft features such as remotely restricting vehicle speed if it is actively being stolen.
Long story made short these things are a lot more complicated beyond gaining that entry point and expecting to have full control over everything out of the gate. There's also the benefit that all of this programming is obviously going to be different between makes and models, likely even down to individual model years and even various flashes and updates down the road. Never a one size fits all and that's why most of what you see are proof of concept hacks for the most part.
With all that said, it is still good practice to button up these holes and I am glad people are out there poking around and bringing these to light so manufacturers can get it taken care of.
While not as involved as this topic, I did toy around with the MS-CAN bus on my old '07 Focus for a bit. It wasn't as nearly as elaborate. Essentially the MS-CAN was isolated to just the radio and any accessories it may have had connected. In my case stock it had nothing attached but there have been aftermarket attachments for stuff like Aux inputs, bluetooth, ipod adapters, etc. that all communicate and control via the CAN bus. I originally started with an Aux adapter which just fed analog audio to the radio and enabled the Aux button/mode. The only advanced thing it did was display its brand name on the radio screen. I had intended to try and rig up a Raspberry Pi that could interact with the radio and act as a USB jukebox that could be controlled via the faceplate on the radio or even have the Pi control certain parts of the radio. Didn't get really far beyond reading what could and could not be interacted with. I eventually gave up and replaced it with a BT/USB aftermarket unit. What I essentially found out is a limited set of faceplate buttons were visible on the network in Aux mode: Volume, preset buttons (aside from I think button 6 which was the Text button?), up/down and seek buttons. Menu was unavailable. It did indicate when mode was changed through AM/FM/CD/AUX. When in any mode but Aux, all controls were not visible. In the other direction there wasn't a whole ton of control. Mostly being able to send text to the screen and I believe mute. Memory is a bit fuzzy on that at this stage.
Edited by cr08, 03 August 2017 - 08:08 AM.