hey everyone alex here coming at you
from the cactus con discord command post
it's my pleasure bringing you our next
talk introduction to car hacking basics
with kay turbo yoda singh who's an
incident responder with blackberry
security services and part-time car
tinkerer
don't forget to stay tuned after the
talk for live q a just go ahead and
click the link on your screen
enjoy
hey guys my name is kay and this is my
cactus con 2021 presentation
on introduction to car hacking basics
before we begin a quick disclaimer
if you try to actually take any of this
to your car and fry something
don't come after me i'm not liable i
can't afford to pay you out if you
decide to sue me or come after me
if you learn something from this
presentation which i hope you do and you
try it on your car
or someone else's car and you break
something
don't come after me you know you do this
at your own risk it's
pretty easy to fry a car um with that
said
you may have been wondering uh i'm
actually not agent k for men in black
which is my name suggests
i can't pull off a suit for 30 minutes
let alone 24 7.
i'm just an associate incident and
response consultant at
blackberry and despite what my handle
says i am not related to
nor am i baby yoda apparently it's a
common misconception that's been going
around
so sorry not that cute uh you didn't
come here for my autobiography though
you came here how to learn to hack a car
but virtually because cars are expensive
and big
some are ugly and they're a little bit
of an investment
um this is video i took this video a few
years back in college when i just got
into this
uh this is my 2013 camry so it's a
fairly new car
and i gave it a little bit of an
aneurysm
you see obviously the rev counter is you
know going up and down across the range
and the engine oil light and the key fob
light are flickering right above it
essentially i was spamming it with
random packets
and the ecu the engine control unit was
freaking out
trying to figure out what was going on
and so this is where the danger comes in
you can send a command that may
permanently have like a
check engine light that comes on you
have to pay a diagnostic fee or maybe
you
uh do something with the brake system
and cause it to
not work at some point um these are
things you kind of do at your own risk
so if you break something i'm not liable
and just one more look
because i think this is absolutely
hilarious
so you might think guess that you know a
car has a lot of computers i had already
mentioned one the
engine control unit that manages the
engine
and all about it but as you buy a newer
and newer car
as well as a more advanced car you're
going to find that there's a lot more
computers in a car
a ten thousand dollar nissan sentra may
only have like you know
um your radio your air con your gauge
cluster
steering brakes engine you know like the
bear basics uh
then you get lucky and you buy like a
ninety thousand dollar audi or a bmw
all of a sudden you'll have a computer
for things like adaptive cruise control
and automatic
braking uh keyless entry blind spot
detection
uh navigation system and you know it
goes on and on and on
uh the point i'm trying to get to here
is they all have to communicate somehow
they're all interlinked and
that method or how they're interlinked
is the controller area network bus
or the canvas essentially it connects
all of the computers and modules in a
car
together it doesn't matter if it's
something as
important as the engine controller or as
insignificant as like your seat controls
or
you like your light controls or the
charger in the back
because who cares your kid can't charge
your tablet you know
they're all interconnected to this
network in one way or another
canvas first started being developed in
1986 by bosch electronics
and in 1991 mercedes uh like they tend
to do with a lot of the newer technology
that sort of trickles down to other cars
uh brought a car to market with with can
uh this is this car right here it's a
1991 mercedes s-class it's the w140
chassis it's old you've probably seen
one around these things are tanks you
know they're known for it
but essentially mercedes brought this to
market
the first time for the first time
uh you might be wondering well okay
there's a network how do i interface
with it you know how do i mess with it
or how do i get information from it well
um in your car there's a connector
called the
obd2 connector it's the onboard
diagnostic
two connector um this is a pin out right
here
this specific connector has been a
worldwide standard since 1996.
any car after 1996 if you want to be
safer for
like 1997 for whatever reason um they
will have this connector
and these pins will be standardized
they're going to be the same no matter
what
four and five are going to be your
grounds you will have a 16
pin 16 will be your 12 volt volts and
6 and 14 will be your can bus
pins and this not connects not only to
canvas but to things like lin bus and
maybe something
weird and proprietary the manufacturer
has going on
[Music]
for the purpose of this presentation i'm
going to be referring to
can high and can low as just can bus
just to keep things simpler
and you'll see why essentially
some things may have a higher priority
than others on
can high versus can low like if i go
back you kind of want your
brakes to be a slightly higher priority
than your lights uh that's just my guess
maybe the manufacturer thinks something
different i kind of hope not but you
know
so can high get higher priority for
things uh but for the purposes of this
we're just going to assume it's a flat
topology
because we're not going to be doing too
much and you guys might be wondering
well
okay history 101 why are we still
talking about the 1990s
well the answer is modern cars haven't
changed much
canvas is still the standard for basic
communications between all the computers
on a car
there's only been a couple of minor
revisions
since 1991 and the core principles are
still the same
some manufacturers will do things like
run multiple can buses at the same time
in parallel but they can still be
accessed
through the same obd2 port with the same
pin out
and if you've ever been interested in
cars you might not know that canvas
fully
exists essentially oems practice
security through obscurity meaning they
don't talk about it
they'll talk about you know our engine
control unit is brand new and a lot
faster or whatever
or we have more computers but they don't
necessarily
directly mention canvas so
the most you generally are able to find
are the original bosch white paper some
other white papers
and researcher researched on my other
fellow security researchers
maybe they've hacked their own car or
someone else's car
so this means that canvas is
fairly old and still has some of the
same vulnerabilities that it did back
then
um but you know so far you might be
thinking okay well there's only one way
to access it is through the port
in the car well as we add newer and
newer
technology more computers to a car it
adds more attack vectors
um you might have a cellular connection
for your navigation system you might
have an in-car wi-fi hotspot
you might have bluetooth to play music
through the radio
these are just more and more attack
vectors it's just another way to gain
access to the system
um and slowly but surely this is
starting to sound an awfully lot like
just pen testing a network
and the answer is it kind of is
when you interface with canvas on a
laptop it shows up as a network adapter
meaning you can just pop good old
wireshark up
plug everything in set up the interface
and you are
ready to read canvas and inject packets
if you have the hardware
twenty dollars gets you an adapter to
plug into your car
and read packets uh make a packet dump
even
we'll get more into that at the end but
essentially it's not that expensive
relatively speaking to start car hacking
if you happen to have a car
it's just the serial connection that you
make with the obd2 port
and your laptop but we're not here for
an actual car because like i said
they're expensive and you kind of don't
want to break a car if you only have one
you can all do this virtually it's
pretty easy all you need is a laptop or
a virtual machine i will be doing this
in a virtual machine
you can actually do the car hacking with
a physical car and a virtual machine
as well but for the purposes of this i
will be using ubuntu
20.04 um
you can use whatever distro you want um
as long as it has a couple of
prerequisites the two that we're going
to be going over are can
tools and icsim if you have some weird
adversion to linux
you can also do this on windows using a
program called bus master
unfortunately i found it to be a little
finicky and you kind of do need a real
car for the most part unless you can
find a database online
so i'm not going to be going over that
last but not least most importantly
you need patience this is really tedious
this entire process
and you might get a little frustrated
anchor management classes are always
great or you can just buy food
i prefer the food it seems to be cheaper
and it's pretty good
but enough of that onto the show
first of all i just mentioned that you
will need can tools nice csim
um icsim is this lovely program made by
zombie craig and essentially it provides
a
virtual gauge cluster and controller for
your quote-unquote car right here
you need can tools and these
prerequisites
you also have to be able to use the make
file in here
this is you have to compile this
yourself so it's pretty distro agnostic
these controls are from ubuntu but all
of these
you can find on other distros and
canutils is also on github
if you want to get more advanced jay
gamlin has this script which pulls a lot
more tools
such as kayak and care and caribou
amongst others
including ics ic sim and ud sim
[Music]
by the time you guys will see this i
also have my own fork
unfortunately i've run into issues with
uh this one
in the past and currently between
different ubuntu versions
there's not really much difference but
hopefully by the time this airs
this will be updated to work on both 18
and 20.
the same with gamblers this might get
updated as well anyways
i have a pretty clean ubuntu 220 install
and as you can see i'm going to start
from the bare basics i'm actually going
to
delete my previous directory to show you
what you get when you first clone this
from github
i don't know after that i have to
can't do that i'm going to clone it and
i'm going to change directory
so first you have to run the makefile
which is to make
you'll see that goes on pretty fast
you'll notice you have
controls and ic sim but before we get to
play with that
we actually have to set up the vcan the
interface
or on setup vcan i've already done it
so no need to do that um the next steps
are bringing up the
actual interface
the network interface we're gonna mod
pro vcan i've already done this i'm just
gonna go through the command history and
then we're going to run
these two commands they're just iplink
commands to bring the interface up
and when you run ip when you get it all
done you'll see when you're an ip link
you have this as a
network adapter these instructions are
also on a zombie qriket
page so i'm kind of breezing through
them real fast but
now that we've got icsim installed we
will change directory to
icsem and we are going to launch icsem
to vcan0
see and we have a gage cluster wow this
is your very own ferrari
not really um i don't believe you can
actually make this bigger so i'm sorry
if this is a little small
but uh you have a you speedo your
tickers and your car
car doors um which will be here now this
is pretty boring
nothing's going on to get things to
actually work you need to also launch
the
controls package as well controls and
then vcan zero
now before we do this forget
i'm going to show you real fast like i
said before this shows up as a network
adapter on wireshark
and this i'll leave this in the corner
here but you see it's pretty dead right
now there's no packets going through
as soon as we launch controls we'll see
a couple of things happen one
instantly packets start flooding the
interface you know something's going on
next you'll see this needle is slightly
moving
the engine quote-unquote is now idling
now you have this amazingly drawn
dual shock three-ish controller better
than i can draw
ironically despite this being you know a
playstation controller
or whatever you need an xbox controller
um unfortunately i don't have one on
hand
uh some say i had a really rough halo
game and it was thrown
i'm gonna play the fifth on that one but
if you don't have a controller like me
you can also use arrow keys and as you
can see i'm well i'm holding the up
arrow on my keyboard
and the gauge cluster is moving up
slowly but surely
we also have the tickers and these are
turning green and you can also mess with
the doors
so that's great and all you've got a
simulated car
but now we have to actually read and
inject packets
you can either do this through wireshark
take a packet dump go through at your
leisure
or there's another tool in can utils
called can sniffer
canned sniffer will take all these
plackets and sort of
congest them or compress them into this
whatever repeated ids you have
they will be here and whatever is
changing will be in red
if you use the tag c like i did see okay
this is not packages
but it is fairly hard to kind of
correlate all of this together
um so this is what i meant you need
patience because this is a game of
sort of recording what you see here
correlating it with this
injecting package and praying it works
um
two things we don't have time for that
and i also like to cheat a lot
so since i'm a dirty little cheater i
just happen to have another vm with
all the commands right here so real fast
i'm going to
copy this one here
and i have a second terminal here and so
this is just can send
i'm going to send this packet to vcan 0.
okay nothing happened let's try again
and again and you'll see right there
just barely it flicked to 280 or the
other end
but this is tedious you're not going to
want to stand around doing that so i'm
going to go back because i'm
too lazy to actually write this very
quick and dirty uh
for loop
we're doing 280 miles an hour one of the
fastest cars in the world
uh with occasional stops back to zero
which kind of hurt if you're in the car
so in less than like three minutes you
already have a
virtual car going and we're injecting
packets but
um add a little more time because dirty
a little cheat
um so that's pretty cool and all uh you
could probably find that after like a
couple of minutes of work if you just
kind of
spam all these ids
um but let's say you get bored of that
let's say you've already recorded all
this well the great thing about
uh can i see sim is that it also has a
randomizer in it
if you use the tag r you can generate a
seed value please go over here
and move this over to controls
we're going to use the c value with the
flag s and then v
can zero boom so it's back to working we
see packets
but if i do this
uh okay that's hoping that would be in
my history it's not for whatever reason
if i do this again it's not doing
anything
that's simply because the values have
changed anytime you redo the c
value it'll change the values i mean you
have more things to work with
if you get bored of this you can also go
on further and further with the other
tools mentioned in the car hacking tool
script
you get more things to play with and
more things to emulate
let's say you get bored of this you win
the lottery and you buy a brand new car
someone gave you a free car
amazing i'm kind of jealous honestly and
you want to break it
i mean um you want to hack it
sorry if you want to hack your car
you're going to need a couple of things
you're going to need a laptop unless you
prefer dragging your
rig out to the gardener if you can fit
your rig in your uh your car in your
house i'd be also jealous of that you
need a pc
linux windows whatever
[Music]
if you want to get just started off with
looking at canvas
this is a l327 off of amazon this
specific one is
20 on amazon uh you have some downsides
with it being extremely limited
uh there's you run out of buffer space
real fast
you can't inject packets but you will
see some canvas packets
the next step up and if you have an
arduino like uno on hand
this is great you just need the shield
board uh this is the can
the seed studio can bus shield v2
long name put this plug this in with
your uno
this serial port goes out to your can
bus
and you have usb going to your laptop
and you can read packets you can inject
packets and you can have all the fun in
the world
um as long as you don't break something
in your car
if you want to be a little more
professional i suppose or have an easier
like
custom built solution the cantact exists
this is the original contact this is
what i started out using it's by
evan and i can't say his last name event
chick
sorry if i butchered it um that thing
was like about
70 dollars all in with the two cables
you need to connect to the car and to
your pc
amazing you can do everything uh i
believe it's being now replaced by the
cantech pro which lets you do
two can interfaces simultaneously and
your pc
it has a couple of other cool things
like a bigger buffer i believe so
um that's all you need to get started or
to inject packets and stuff just one of
these guys
patience and probably fearlessness
because this is kind of risky in your
real car so
yeah that's that i believe we are going
to be having a quick
q a right now so i will see you there
you