I’d like to make a quick post with the release of some CANBus analysis tools I wrote.
The tools are written in javascript using nodejs, which comes preinstalled on the Beaglebone black — my hardware of choice when doing CAN analysis. I wrote up a brief README on setting up a Beaglebone for use as a CAN analyzer which you can find at https://github.com/digitalbond/canbus-beaglebone. That README provides links to the hardware setup we used at the S4 CANBus Hacking Class along with some instructions for getting an environment set up to start doing vehicle work in javascript or python.
watch_id: Prints out every data packet for a given ID or IDs. Bytes that change from one packet to another are colorized for easy viewing.
decode_obdii: Decodes any OBDII standard request/reply messages sent over the CANBus. Includes a description of the message type according to the spec.
canbus_IDS: A very simple Intrusion Detection System for CANBus that will take configuration via JSON and alert on messages of a given ID. TODOs are extending alerts to use beaglebone GPIO and allowing ctype configuration of message data to alert on things like a bit flag being set.
The code is licensed under MIT. Contributions, questions, complaints are welcome. Check out the README file for more details on using the tools.
The repository is available at https://github.com/digitalbond/canbus-utils.
My son works for a Ford dealership. he is not a techie or a security guy by any means, but he has repeatedly expressed his dismay at how insecure the vehicle systems are. I chuckled when he told me he performs frequent software upgrades during service visits, and obtains said upgrades off the internet via the shops open wifi. What could go wrong?
And don’t forget that there are any number of ‘hacks’ out there to change/increase performance. How many people who ‘update’ their auto computers this way really know where the new modules/programming came from?
It is interesting, the ‘where does your tune and firmware come from’. I have a friend in town (Digital Bond alum Landon Lewis) who has tuned his car for racing. The tune seller gave him a multi-use one-vehicle dongle, where you could load the new map into the ECU. Later you can detune the car for normal driving. You can reload the racing map using the dongle (but only for the same vehicle). I think it works by locking to the vehicle VIN when it is used the first time. Using Corey’s tools it would be easy enough to either trick the tool into loading the map into more cars (by spoofing a VIN statement) or by capturing the actual tune upload and replaying it later.
Some day, I imagine that there will car malware. I think that there needs to be a way to profit from it, first, though. Charlie Miller probably has the right idea looking at infotainment systems (check out some of his tweets, he loaded a customized firmware onto his vehicle infotainment system to enable SSH access) — loading adware onto a navigation system could be a way to make money.
Save my name, email, and website in this browser for the next time I comment.
Subscribe to our newsletter on leading / bleeding edge ICS cyber security information and S4 Events.
Digital Bond was founded in 1998 and performed our first control system security assessment in the year 2000. Over the last sixteen years we have helped many asset owners and vendors improve the security and reliability of their ICS, and our S4 events are an opportunity for technical experts and thought leaders to connect and move the ICS community forward.
Search….
