See also diagnostics and logging, Open Systems Interconnection (OSI) model, 25, original equipment manufacturer. See ECU (engine/electronic control unit), Ethernet low-level socket interface (ELLSI), 158, ETSI (European Telecommunications Standards Institute), decentralized environmental notification messages, 183–184, European Telecommunications Standards Institute. It has one CAN interface and costs about $300. Level 0 is a super simple CAN packet that does the intended operation without any background noise, while level 3 randomizes all the bytes in the packet as well. The SAE J1850 protocol was originally adopted in 1994 and can still be found in some of today’s vehicles, for example some General Motors and Chrysler vehicles. To send packets continuously with can-utils, you can use a while loop with cansend or cangen. If a vehicle supports OpenXC, you can plug a vehicle interface (VI) in to the CAN bus, and the VI should translate the proprietary CAN messages and send them to your PC so you can read the supported packets without having to reverse them. The longer you hold the key down, the faster the virtual vehicle goes. This information was originally stored in a vehicle’s airbag control module (ACM), but today’s vehicles distribute this data among the vehicle’s ECUs. Octane (http://octane.gmu.edu/) is an open source CAN bus sniffer and injector with a very nice interface for sending and receiving CAN packets, including an XML trigger system. Figure 8-19: Normal clock cycle (top) and glitched clock cycle (bottom). It also supports reading GPS data in NMEA format. But say as a consumer you want to use a backup copy of your purchased DVD in your system rather than the original because your car gets really hot during the day and you don’t want the DVD to warp. The following are recommended ROM emulators: Ostrich2 A ROM emulator designed for 8-bit EPROMs ranging from 4k (2732A) to 512k (4mbit 29F040) and everything in between (27C128, 27C256, 27C512). At a bare minimum, you’d need basic knowledge of the architecture in order to write the necessary code. Fault injection, also known as glitching, involves attacking a chip by disrupting its normal operations and potentially causing it to skip running certain instructions, such as ones used to enable security. When implemented in the star topology, a FlexRay hub is a central, active FlexRay device that talks to the other nodes. If you run into an antitheft security code for the radio, check the owner’s manual for the code, if you’re lucky enough to find that. It can also generate random packets. This table shows some of the goals a malicious actor may have when attacking V2V systems and the types of attacks they might launch in order to achieve those objectives. Permanent DTCs give mechanics a history of faults so that they’re in a better position to repair them. This is because vehicles often compress the RPM value using a proprietary method. 0x08: Controls operations of onboard component/system. For instance, in the wiring examples shown in Figure 9-5, a vulnerability in the Bluetooth module would give us direct CAN access; however, if we exploited the IVI’s navigation system, we’d need to use K-Line instead (see Figure 9-6). The dmesg output shows a lot of Unknown symbol messages, especially around can_x methods. The dynamic section is split up into minislots, typically one macrotick long. The icsim application listens only for CAN signals, so when the ICSim first loads, you shouldn’t see any activity. Every so often a CAN signal shows up that resets the values to 00 00 and stops the speedometer from moving. Be forewarned that the ELM327 has limited buffer space, so you’ll lose packets when sniffing and transmission can be a bit imprecise. (The ChipWhisperer can perform man-in-the-middle attacks on smart cards, but because cars don’t really use smart cards, we won’t cover that feature here.). As the shutter wheel spins, the crystal detects the magnet and sends a pulse when not blocked by the wheel. This system works because all of the participants on a FlexRay bus are time synchronized. Take A Sneak Peak At The Movies Coming Out This Week (8/12) The Worst Movies To Watch With Your In-Laws; Best Reactions to Movies Out Now In Theaters Assuming the authentication takes place over CAN, it’s also possible to grab the key fob ID over ultra-high frequency and attempt to gather the key stream by replaying and recording the communication over the CAN bus, as discussed in “Reversing CAN Bus Communications with can-utils and Wireshark” on page 68. And while bugs are usually discovered by accident, most exploits require careful craft. (Make sure to set the Glitch Trigger option to Manual in the ChipWhisperer settings before you upload the firmware or you may accidentally glitch the firmware upload.) You can use just a simple OBD-II scan tool that you can pick up at any automotive store. One attack that utilizes DSRC communications is vehicle tracking. We’ll first look at lower-cost, open source hardware and then explore some higher-end devices for those willing to spend a bit more money. The frame ID is the slot the packet should be transmitted in when used for static slots. We’ve looked at how alterations in standard factory settings result in performance trade-offs and compromises, such that the “best” settings for a vehicle will always depend on your specific goals. Reducing noise on the bus results in fewer collisions and cleaner demos. While much of the technology and security behind V2V is still being ironed out, we do know that the security for cellular, DSRC, and hybrid communications is based on a public key infrastructure (PKI) model much like the SSL model on websites. In MOST25, a block consists of 16 frames. Each manufacturer decides which bus and which protocols make the most sense for its vehicle. Table 1-5 includes the countermeasure for the HSI code execution risk, and Table 1-6 includes the countermeasure for the risk of HSI interception. Make sure the software associated with the device you choose does what you want because you’ll usually be locked into their API and preferred hardware. As of this writing, you should be able to find a demo image of AGL for VMware (last released in 2013), installation instructions, and a bootable USB version for x86 at the AGL website (http://automotivelinux.org/). You should be able to reprogram modern systems directly via debugging software, like JTAG. His specialties are reverse engineering and penetration testing. If DREAD isn’t detailed enough for you, consider the more detailed risk methodology known as the common vulnerability scoring system (CVSS). OLS300 An emulator that works with only WinOLS software. If you’re in a pinch, however, this is the cheapest route. Note that the register order is slightly different than when passing arguments to a function. Currently, it runs only on Windows. Once in continuity mode, it will beep if you touch both pins to the same trace, indicating that they’re connected. TPMS sensors don’t use input validation. RomRaider (http://www.romraider.com/) is an open source tuning suite for the Subaru engine control unit that lets you view and log data and tune the ECU (see Figure A-6). When performing a risk assessment, it’s good practice to leave the scoring results visible so that the person reading the results can better understand the risks. For example, you’ll see codes like P0477 (exhaust pressure control valve low) and U0151 (lost communication with restraint control module). Right-click the bus and choose Open RAW view. In Figure 7-9, the second line of the cansniffer traffic shows bytes 2 and 3—0x0B and 0x89—changing as we rotate the potentiometer knob for Arbitration ID 0x110 (the column labeled ID). A plain, or old-style, disassembler will output very verbose text. This will give us the exact year, make, model, and engine type of the vehicle. If you want to monitor a FlexRay network without a FIBEX file, you’ll at least need to know the baud rate of the bus. PLATFORM NO_PLATFORMDESCRIPTION "No description"DEVICE_ALIAS OBD Port slcan0(1094.141850)➊ slcan0➋ 128#a20001➌(1094.141863) slcan0 380#02020000e0007e0e(1094.141865) slcan0 388#0110(1094.144851) slcan0 110#0000000000000000(1094.144857) slcan0 120#f289632003200320, Figure 5-5: Right pane of Log files tab settings. Some actions, such as flashing ROMs, will require you to send a SecurityAccess request. New ideas from both the attack and defense teams need to be shared, but do so responsibly. You can use wiring diagrams to help locate additional “internal” bus lines. You can list your IRC room or Twitter account if you have one. They range from hobbyist-level boards to professional devices that support lots of custom features and can handle many different CAN buses simultaneously. (Without the sleep statement, you’d flood the bus and other signals wouldn’t be able to talk properly.). IPv6 is configured by the WAVE management entity (WME) and also handles channel assignments and monitors service announcements. In fact, as any cryptographer will tell you, if knowing the math behind an algorithm jeopardizes the security of that algorithm, the algorithm is flawed. Once you identify these packets, you can write programs to transmit them, create files for Kayak to define them, or create translators for OpenXC to make it easy to use dongles to interact with your vehicle. You most likely won’t see any communication without a wake-up signal, but some devices may transmit at slow intervals anyhow. Now, for a change of pace: Here’s one method for brute-forcing a keypad lock on a vehicle; this particular method was discovered by Peter Boothe (available at http://www.nostarch.com/carhacking/). Because the sensors would have limited range, you’d have to place them around intersections or freeway on- or off-ramps. Unlike GENIVI, AGL doesn’t have a costly board structure. You’ll see AVRDUDESS in action in “Prepping Your Test with AVRDUDESS” on page 139. Dmesg should report seeing an AVRISP mkII plugged in, which is the programmer that we’ll use to program the target board. Instead of modifying temperature, this shellcode unlocks the car doors. This huge industry—worth around $19 billion annually worldwide, according to the Performance Racing Industry—draws almost half a million people yearly to compete in auto races in the United States alone. In this example, we’re sending a packet containing PID 0x02 with mode 0x09 in order to request the vehicle’s VIN. for(cnt = 0; cnt < 5; cnt++){ if (inp[cnt] != passwd[cnt]){ passok = 0; }}if (!passok){ output_ch_0('F'); output_ch_0('O'); output_ch_0('f'); output_ch_0('f'); output_ch_0('\n');} else { output_ch_0('W'); output_ch_0('e'); output_ch_0('l'); output_ch_0('c'); output_ch_0('o'); output_ch_0('m'); output_ch_0('e'); output_ch_0('\n');}, Listing 8-2: Password check method for glitch3(). The maximum size of the data carried by a standard CAN bus packet can be up to 8 bytes, but some systems force 8 bytes by padding out the packet. Press the play button (circled in Figure 3-6); you should start to see packets from the CAN bus. In theory, the originating device can request enough short-term keys to last the vehicle’s lifetime, which is why the certificate revocation list (CRL)is important. Is there a GPS? Make sure you have ATmega328P selected in the MCU field, and then click Detect to verify that you’re connected to the ATmega328p (see Figure 8-9). If you don’t have the algorithm to generate the necessary challenge response, then you’ll need to brute-force the key. Unlike chip tuning, flash tuning (also known as flashing) requires no physical modifications. However, some sniffers, such as many Arduino shields, expect the US-style DB9 connector (see Figure 2-19). If your goal is, for example, to create a malicious update that wiretaps a vehicle’s Bluetooth driver, you have almost everything you need at this stage to do so. As discussed in “Side-Channel Analysis with the ChipWhisperer” on page 134, the ChipWhisperer is a system for side-channel attacks, such as power analysis and clock glitching. Figure 3-5: Setting up the bus connection. See also diagnostics and logging, DLC (diagnostic link connector), 17, 51, 119. An amplified relay attack uses the same basic principles as a relay attack but with only a single amplifier. Not all bus lines are exposed via the OBD-II connector, and when looking for a certain packet, it may be easier to locate the module and bus lines leaving a specific module in order to reverse a particular packet. starstarstarstarstar. In online-passive mode, no data is sent or received. The second byte of the 0x510 packet represents the engine temperature. So far you’ve located a vulnerability in an infotainment unit and you have the CAN bus packet payload ready to go. Discovering undocumented or disabled features and utilizing them lets you use your vehicle to its fullest potential. If that doesn’t work, add a second resistor. In this chapter, you learned how to use SocketCAN as a unified interface for CAN devices and how to set up your device and apply the appropriate bit rate for your CAN bus. Vehicles Porsche, Audi, Bentley, Lamborghini, Crack Status Broken but the attack methods have been censored by lawsuit. Your budget and supported processors will determine which disassemblers are an option. Next, we’ll look at physical modification and attacks to the vehicle itself. If the transponder is happy, the transponder sends G to the car. A field-programmable gate array (FPGA) board is ideal, but you can accomplish this trick with other microcontrollers, too. It can take a long time to grasp the information contained in these packets, but that knowledge can be critical to understanding the car’s behavior. You’ll find the firmware for the target in the ChipWhisperer framework in this directory: hardware/victims/firmware/avr-glitch-examples. If attackers can create their own DSRC receiver by buying a DSRC-capable device or using software-defined radio (SDR), they could receive information about vehicles within the receiver’s range—such as the size, location, speed, direction, and historical path up to the last 300 m—and use this information to track a target vehicle. CANtact, an open source device by Eric Evenchick, is a very affordable USB CAN device that works with Linux SocketCAN. Today’s systems use a key fob to send an RFID signal to a vehicle to remotely unlock the doors or even start the vehicle. You can sketch anything you want: a layout for a garage, notes, a logo, and so on. Figure 8-23 shows some possible places to locate the glitch. THE CAR HACKER’S HANDBOOK. Once the tool sees a valid response (0x40+service) or an error (0x7f), it’ll print the arbitration ID and the reply ID. You can debug a chip with JTAG using just two wires, but it’s more common to use four or five pin connections. Also, some CAN packets are visible only from within a moving vehicle, which would be very dangerous. For instance, memory-based DTCs are stored in the PCM’s RAM, which means they’re erased when power from the battery is lost (as is true for all DTCs stored in RAM). In order for that OBD port to fully function, we need to expose the vehicle’s network wires from the ECU to the OBD port. By creating an account on LiveJournal, you agree to our User Agreement. Security developers need access to exploits to test the strength of their protections. We see that there’s a diagnostic service responding to 0x0244. | Automobiles--Performance--Handbooks, manuals, etc. Hopefully as these early devices start to trickle out into the marketplace, this chapter will be a useful guide for performing security audits. cansend This tool sends a single CAN frame to the network. Is there a map update service available? We went over where you can get parts for building a test bench and how to read wiring diagrams so you know how to hook those parts up. Then, stop recording and play back the data. Now let’s list all potential threats with our threat models. When ASK modulation is used, the bits are designated by the amplitude of the signal. Guessing or brute-forcing these passwords can be very time consuming and would make traditional brute-forcing methods unrealistic. Restart the scan from where it left off using the -min option, as follows: In our example, the scan will also stop scanning a bit later at this more common diagnostic ID: Found diagnostics at arbitration ID 0x07df, reply at 0x07e8. To display all IDs of 5XX, you’d use the following binary representation: ID Binary Representation500 101 0000 0000700 111 0000 0000------------------ 101 XXXX XXXX 5 X X. If certain tools are expensive or require training before they can be used, you might use the Membership Level space to denote that the user must be a paid member to access these tools. For details on how to write your own brute-forcer for the ChipWhisperer, see the NewAE tutorials. The connectors usually have a number on the first and last pin in the row. Consider a signal that represents engine_speed. In order to test many of the examples in this book, install a recent version in a Linux VM on your system. Five fields make up the fingerprint: Make, Model, Year, Trim, and Dynamic. The hardware is already natively supported by Linux, but you should add a group for the normal user that you’ll test so that the user can have access to the device without needing root privileges. Prior to the adoption of the J2534 standard, each software vendor created its own proprietary hardware and drivers for communicating with a vehicle in order to perform computerized repairs. We’ll break these down into threat groupings that relate to cellular, Wi-Fi, key fob (KES), tire pressure monitor sensor (TPMS), infotainment console, USB, Bluetooth, and controller area network (CAN) bus connections. For instance, a malicious actor could plant a roadside explosive and set it to detonate when it receives a known ID from the TPMS sensor. This chapter also discusses some open source in-vehicle infotainment systems that can be used for testing. Once you know your system’s OS, architecture, and update method, the next thing to do is to see whether you can use this information to modify it. Books like the Chilton auto repair manuals include block diagrams, but you’ll find that they typically cover only the most common repair components, not the entire ECU. Some microcontrollers aren’t vulnerable at all to power glitching, so test with your target chipset before trying it on a vehicle. • Use a multimeter to check for a 2.5V baseline voltage. As a point of reference, 20Mbps will let you sample the entire FM spectrum simultaneously. The Hitag 2 system can be brute-forced so quickly because it doesn’t even use its full bit length, and when the transponders are introduced into a system, they don’t produce true random numbers during initialization. If the device is internal, run these commands to reset it: $ sudo ip link set canX type can restart-ms 100$ sudo ip link set canX type can restart. For a list of further service PIDs to query, see http://en.wikipedia.org/wiki/OBD-II_PIDs. Currently, however, the systems being developed are planning to use 20 or more certificates that are all simultaneously valid with a lifetime of a week, which could prove to be a security flaw. セントラルスポーツのスポーツクラブ・フィットネスクラブでは、充実したプールやジム・スタジオプログラムをご用意。「0歳から一生涯の健康づくりに貢献する」を経営理念に全国230か所で展開しています。ぜひお気軽にお近くのクラブへお問い合わせください。 As long as you see a vcan0 in the output, you’re ready to go. Because the in-vehicle infotainment system probably has the largest attack surface, we’ll focus on different ways to get to its firmware and execute on the system. Notice that when a bit is transmitted on the CAN bus, the signal will simultaneously broadcast both 1V higher and lower. An OBD port allows for specialized mechanics tools to communicate with the vehicle’s network. As of this writing, IDA Pro is the most popular interactive disassembler available. FIBEX is an XML format used to describe FlexRay, as well as CAN, LIN, and MOST network setups. This chapter shows how an understanding of a vehicle’s embedded systems can be used to change its behavior. Regardless of which shield you choose, you’ll have to write code for the Arduino in order to sniff packets. MOST comes in three speeds: MOST25, MOST50, and MOST150. Like AUD and SWD, this in-circuit debugger requires its own device in order to interface with it. EVTV.me (http://store.evtv.me/) specializes in electric car conversions. The world needs more hackers, and the world definitely needs more car hackers. (Find out how in the IVI’s manual.) Here are some common modes specified by the ISO 14229 standard: Some interesting PIDs for modes 0x01 and 0x02 include the following: 0x1C OBD standards to which this vehicle conforms, 0x20 Additional PIDs supported (0x21–0x40), 0x31 Distance traveled since DTCs cleared, 0x40 Additional PIDs supported (0x41–0x60), 0x60 Additional PIDs supported (0x61–0x80), 0x80 Additional PIDs supported (0x81–0xA0), 0xA0 Additional PIDs supported (0xA1–0xC0), 0xC0 Additional PIDs supported (0xC1–0xE0). Unfortunately, the available CAN Linux tools won’t run on the ELM327, but Open Garages has begun a web initiative that includes sniffing drivers for the ELM327 called CANiBUS (https://github.com/Hive13/CANiBUS/). CVSS offers many more categories and details than DREAD in three groups: base, temporal, and environmental. In-frame response (IFR) data may follow immediately after this message. If you hook up a multimeter and check the voltage of wires in your vehicle, you’ll find that they’ll be at rest at 2.5V or fluctuating by 1V. This noise can make it futile to stream data from a CAN network without a filter. Wireshark doesn’t have any features to help sort or decode CAN packets, but it could be useful in a pinch. not based on your username or email address. If not, you can run your group by yourself until more members join. A broadcast message on this system has 0x for both the function code and the node ID. Once you’re down to one packet, you can then determine which byte or bits control the targeted operation with the help of cansend. Nexus from Freescale/Power Architecture (now NXP) is another proprietary JTAG interface. As I write this, there are no known cracks for Hitag AES. All adapters should be considered custom hardware. When passive IPv4 fingerprinting, details in the packet header, such as the window size and TTL values, can be used to identify the operating system that created the packet. Locate the engine fuses in the car’s manual and begin by pulling the ones you most suspect are the culprits. Figure 12-4 shows an example of a TPMS packet. These methodologies can be applied to any embedded system, not just to the ECU, and they may even be used to modify a vehicle with the help of aftermarket tools. The length of the hash listed for each file—32 characters—suggests that this might be an MD5 hash. An attacker could exploit the cellular connection in a vehicle to: • Access the internal vehicle network from anywhere, • Exploit the application in the infotainment unit that handles incoming calls, • Access the subscriber identity module (SIM) through the infotainment unit, • Use a cellular network to connect to the remote diagnostic system (OnStar), • Set up a fake Global System for Mobile Communications (GSM) base station. Bottom line: do not underestimate how much work this approach will take. The following are some of the known proprietary algorithms still in use and their current crack status—that is, whether they’ve been broken or not. The most basic test bench is the device that you want to target and a power supply. Information on vehicle size is transmitted in the following four fields: This information should be accurate to within a fraction of an inch because it’s set by the manufacturer. Figure 1-1 illustrates a possible Level 0 diagram. A CAN bus Y-splitter is a very simple device that’s basically one DLC connector broken into two connectors, which allows you to plug a device into one port and a CAN sniffer into the other. In the case of UDS, the source is 0x7df, and the destination (response) is 0x7e8. Some have a system where an analog input is shorted to ground and either an internal LED or the “check engine” light flashes out the code. Användarhandledningar. Node startup controller (NSC) Part of the NSM persistence. One protocol, the CAN bus, exists in a standard location on all vehicles: on the OBD-II connector. (If you’ve ever set up a modem, you should recognize this terminology. You can see that the program hangs in its infinite loop when the power reading shifts from normal to a near consistent 0 power usage. Simple, eh? No part of this work may be reproduced or transmitted in any form or by any means, electronic or mechanical, including photocopying, recording, or by any information storage or retrieval system, without the prior written permission of the copyright owner and the publisher. Of course, you’ll need to exit that infinite loop, so once you’ve tried the incorrect password and are sent into a loop, reset the device and try to enter another password. Listing 5-5 will set a basic configuration to output the engine_speed signal. Figure 2-10: MOST divided into the seven layers of the OSI model. This mode pulls DTCs that have been erased via mode 0x04. When can.ko is not loaded, you get the following: # sudo insmod ./can-isotp.koinsmod: ERROR: could not insert module ./can-isotp.ko: Unknown symbol inmodule. Hitag 2 is one of the most widely implemented (and broken) algorithms in vehicles produced around the world. You’ll need to create a virtual CAN device in order to test this program. Once inside, you’ll most likely find a circuit board like the one shown in Figure 9-7. As you might imagine, neither the author nor the publisher of this book will be held accountable for any damage to your vehicle. • Appendix A: Tools of the Trade provides a list of software and hardware tools that will be useful when building your automotive security lab. A device must update its CRL so that it can determine which certificates, if any, are no longer trustworthy. PKI uses public key cryptography and central certificate authorities (CAs) to validate public keys. You should also be able to find precompiled binaries. Hall effect sensors are often used to sense engine speed and crankshaft position (CKP) and to generate digital signals. Also, MIL-STD-882E is designed to be applied throughout the life cycle of a system, including disposal, which is a nice fit with a secure development life cycle. Some cars use CAN for the mid-speed (MS-CAN) and low-speed (LS-CAN), but many vehicles use different protocols for these communications. Under the garage illustration in the upper-left corner of the sheet are some basic questions about your space. The greater the surface area, the higher the exposure to risk. The most common signal ID based on the frequency of occurrence and interval. To confirm, enter the following: $ ifconfig slcan0slcan0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00 NOARP MTU:16 Metric:1 RX packets:0 errors:0 dropped:0 overruns:0 frame:0 TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:10 RX bytes:0 (0.0 B) TX bytes:0 (0.0 B). Ethernet implementations vary, but they’re basically the same as what you’d find in a standard computer network. MOST150 provides two additional channels: Ethernet and Isochronous. Return to the ChipWhisperer main window, click the Scope tab, and set the values as shown in Table 8-3 and Figure 8-15. Listing 11-1 shows the temp_shell exploit. Many vehicles are influenced by the SAE J1698 but don’t necessarily conform to its rules for all data retrieved from a vehicle. Subaru's EJ257 was a turbocharged, 2.5-litre horizontally-opposed (or 'boxer') four-cylinder engine.
Elgiganten Mobiltelefon Huawei,
Spillvattenlunga Polar,
Housegard Brandsläckare Service,
Interaktionsdesign Chalmers,
Bürstner Reservdelar Tyskland,
Renovera Badrum Själv Bostadsrätt,