This paper investigates why physical control inconsistencies exist and present techniques that can be leveraged to more fully obtain control of the physical systems of the car while only injecting CAN bus messages. It also discusses ways to makes these systems more robust to CAN message injection.
You can download it from the following link: https://packetstormsecurity.com/files/download/142306/can-message-injection.pdf
Source: https://packetstormsecurity.com/files/142306/CAN-Message-Injection-OG-Dynamite-Edition.html