In our technical article "Diagnostics and Security: Brave new World", written by Markus Steffelbauer (Head of Product Management at Softing Automotive) and Günter Fahböck (Project Manager at Softing Automotive), we show, that as long as diagnostics takes place locally, in other words using a cable connection between the diagnostic tester and the diagnostic interface or the vehicle, it is safe to assume that the diagnostic system is basically secure as far as unauthorized access is concerned.
But the picture changes as soon as there is a remote data connection over the Internet.