start	end	text
2750	11760	Hi everyone. Today I'd like to welcome you guys to Car Hacking Village of DEF CON 2020, Safe Mode.
11960	18780	Today's presentation is going to be a throwback to the times before J1939.
18920	25120	If you don't know what that is, that is a protocol that runs on top of CAN
25970	30600	and is primarily used in heavy vehicle component communications.
30600	42520	So we will be talking about how we came about the creation of a decoder slash parser for J1708 and J1587.
45180	49680	So just a quick breakdown of how this presentation is going to pan out.
49680	53440	First, we will let you know who we are.
53740	57880	We're going to let you know how this project came about.
57880	64280	And then we're going to give a brief recap of the protocols that are interesting to us.
65900	71400	And you will then see how we came across these protocols.
72660	78780	Afterward, we're going to talk about the decoder slash parser and we'll give you a quick demo.
79560	86280	Last, we'll conclude this talk with the info you'll need to pick up where we are leaving off.
88980	92280	Okay, so my name is Daniel Saloom.
92760	96880	I'm a reverse engineer at Assured Information Security.
96880	99200	We're based out of Rome, New York.
99280	104600	I've been with them for a little over a year and a half at this point.
104600	115160	And I spend my days analyzing the security of things, digging into protocols, and developing anything to support these efforts.
115880	120800	You can see in the images, I'm on the right-hand side.
121260	124240	And there's an image of Thomas on the left-hand side.
124540	128040	So now you have proof that we actually work.
131140	133960	Hi, so my name is Thomas Hayes.
133960	139580	I'm a hardware engineer at Bendix Commercial Vehicle Systems based out of Elyria, Ohio.
139580	147600	I spend most of my days designing hardware, so PCBs and digital and analog interfaces for brake control systems.
147600	150620	And I've been there for almost five years now.
155200	158980	Okay, so what are we doing here?
158980	170040	Well, we discovered that there are more than just J1939 messages that cross the networks in heavy trucks.
170040	174700	And within this traffic, there's some very interesting data.
174940	180860	So we're here to show you how it came about, as we needed a simple way to see it.
180900	185320	And I can imagine you guys want to see how the decoder works as well.
189720	191520	So is there a backstory?
191680	194520	We know trucks. I've been playing them for a while.
194520	203760	This project started off in mid-2019, when we started to do some exploratory testing on heavy vehicle systems.
203760	208980	We noticed multiple networks and interconnection between all of these modules.
209000	215580	We started to explore some tools and decoders that are already out there, available for use for people in industry.
216480	229960	These legacy protocols of J1708 and J1587 are still being sent across the bus, even though now the CAN J1939 is much more prevalent in newer vehicles.
230140	241360	It looks like it could be very interesting, as it is a very important bus that happens on the vehicle, with a lot of useful information that we were interested in looking at.
243720	247170	Okay, so how do we...
248960	253040	I'm sorry, what do we need in order to get things rolling?
254040	257440	First is an understanding of the protocols involved.
257440	263600	In this case, we mentioned J1708 and J1587. They kind of work together.
263640	269300	We also need a hassle-free way of analyzing the traffic that we see.
269300	274300	And at that point, we can decide what may or may not be done with this data.
278870	283310	So what are J1708 and J1587?
283310	290790	So they are SAE, the Society for Automotive Engineers, standards for medium and heavy-duty vehicles post-1985.
291350	296990	J1708 describes a physical layer and data links layer and defines a bidirectional serial vehicle network.
297090	301910	J1708 defines how the messages are structured and how they're distributed over the network.
301910	307410	And J1587 makes up a transport application layer and describes messages format and parameters.
307410	313310	So that's almost a big dictionary for all the possible messages that can be sent over this communication protocol.
316600	322360	So J1708 is almost always used in conjunction with the application layer protocol, J1587.
322360	325000	It's based on an RS-45 bus.
325180	330000	We can have a max of 20 nodes on a vehicle and it runs at 9600 baud.
330000	340400	A message contains a 1-byte long MID, a message identifier, followed by some data related to that MID and a 1-byte checksum.
340400	342900	The message can be up to 21 bytes long.
342900	349720	However, if the vehicle is stopped and no movement is detected, the messages can be longer if required.
353340	361300	So J1708 MIDs, we go up to 0 to 127, defined by J1708.
361300	364720	And these are defined by SAE for important vehicle systems.
364720	370840	And then from 128 to 255 are defined by J1587.
370840	376260	And these are used a little bit more for maintenance and information on the vehicle, more for a diagnostic side.
376680	381960	It's very cool. The MIDs also serve as an arbitration method for the communication.
381960	389040	So the lower your MID number is, let's say 0 to 7 for engine, that means it's a very high important message
389040	395180	and will be passed before perhaps the trip recorder message with MID at 56 and 61.
395460	399880	The checksum is quite simple. It's a two's complement of the sum of the message.
399920	403540	And the data content is defined by the application document given by the supplier.
403540	413680	So you can send the messages defined by SAE or possibly something defined by you as a manufacturer
413680	417000	if you need to send something specific or proprietary across the bus.
419760	424360	So J1587 defines the PID, the parameter identifier.
424360	427480	So that's a little bit of a complement to the MID.
427660	433020	So if you have an MID for the engine, a PID can be related to your engine oil
433020	437200	or a knock sensor or something in your camshaft.
437200	442260	So it's a little bit more information for the PID for the system to recognize if there's a fault
442260	444360	and direct where that fault can be.
444980	449800	So it consists of one MID, one or more PIDs, and a checksum.
449800	455160	The data length of 1587 messages is mostly limited to 21 bytes according to J1708.
455280	466100	And if a message needs to be longer than 21 bytes, we can use the C-C-O-T-S, the TP4.
466100	470000	So that can be used to segment and reassemble large messages if needed.
470000	472380	And a lot of the PIDs are standard.
474350	480110	The PIDs range from 0 to 4 bytes, and the units for elucidating the range will be defined in the spec
480110	482810	or by whoever is sending them out.
482810	490650	So if you're a one-engine manufacturer, you could say the PID for oil pressure is 1 psi per bit,
490650	494990	or another one could say it's 5. So it just depends on the manufacturer for that PID.
495470	501970	There's also SIDs. These are related to the MID, but these are more related to anything that can be used
501970	509650	to identify a section that is not necessarily covered under a PID, but covered under a diagnostic MID.
509670	517370	So the MIDs for using SIDs will begin at 128. That's defined by 1587.
517370	522550	And these are really used for something that can be troubleshooted or replaced by a field technician if needed.
525720	532600	So what's in the data? Now, a lot of our testing was in the communication between trucks and trailers.
532600	537960	So the trailer has an ABS ECU, and the trailer also has an ABS ECU,
537960	540840	and those two will talk to each other using this protocol.
541640	547620	The trailer ABS can have all kinds of diagnostic messages. A trough test is a test of the system.
547620	552860	It will modulate the air solenoids a little bit and dispense a bit of air.
552860	556760	Like when you hear a truck brake, you hear a large air release sound,
556760	559440	and that's kind of just making sure that your system is working properly.
559440	566360	You can restart the ECU, you can check the status of the ECU, and most importantly, demonstrate an ABS fault.
566460	573220	So as per SAE standard, the ABS fault, if the trailer has an issue,
573220	579260	the trailer ECU has to communicate to the truck ECU and illuminate a light on the dash,
579260	586240	as well as a light on the trailer itself, indicating that there is an issue with the ABS and it needs to be resolved.
587340	591080	Diving a little bit deeper, there's also configuration options on the ECU,
591080	594060	so wheel size, which then relates to the speed of the vehicle,
594060	597420	as there's a tone ring that counts the amount of rotations done,
597860	604160	and driver info, so where the trailer is going and what truck it is connected to at the lot,
604160	609240	and sensor data, so the speed, mileage, odometer stored on the ABS,
609940	613800	location, temperature, and many proprietary vendor messages.
615600	620560	So who uses J1708 and J1587? So any kind of heavy vehicles that we all know,
620560	624240	but also school buses with all that same platform, military vehicles,
624240	628220	and we even found that yachts will be using the same communication platform.
629900	633740	So our use case, we were observing exchanges between a tractor and a trailer.
633740	637920	As we said, the brake controllers communicate over J1708 and J1587,
637920	642120	and these messages actually pass over a power line, which is very cool.
642120	649000	Trailer manufacturers did not want to add another wire or two needed for an ABS communication,
649000	654180	so they superimposed a sinusoidal wave on the power line going from the trailer,
654180	657800	which then gets filtered out on the trailer side and on the truck side,
657800	659640	depending if it's using that communication.
659640	663360	It's very cool, but Dan and I did not focus our time on this.
663360	667540	We were working on the J1708 and J1587 protocol.
670700	677520	Okay, so the question comes up now, how do we look at these messages?
677940	679620	There's a couple of options.
679620	683320	We can use tools that were developed for J1939
683320	689500	and are backward compatible with the other two protocols we mentioned,
689500	695980	or we can get our hands on an RS-485 transceiver, some bubble gum, a paper clip,
695980	699660	maybe a tinfoil hat and see what we can hack up.
700940	704380	But what happens when our bus is a power line?
704640	708380	In this case, you need a specialty diagnostic tool.
709360	714760	Some of the larger companies like Nexic, Halidex, Digitech, they provide these.
715200	719240	But the problem with this approach is it's going to cost you some moolah.
719240	723240	And flow between programs is not really there,
723240	728440	as software is kind of tied with the hardware and it's all proprietary,
728440	732100	which means minimal flexibility.
733940	738500	So our solution is pretty J1587.
738800	744080	This is a decoder that helps with at least part of the problem.
745260	749220	By default, this takes in hexadecimal bytes.
749220	755420	Which are comma delimited, but really it can take in a stream of any bytes.
755600	764620	And a user can define how to manipulate that data to be parsed correctly by the decoder.
765220	773540	It also supports reading from standard in files or sockets, UDP or TCP.
773660	778400	And what it does is it takes this information, these messages,
778400	783160	and it will break them down into a human tolerable format.
783160	787220	So they can be easily analyzed by an end user.
788080	799980	So to start off, what happens is the parser will read the SAE documentation PDFs.
799980	803690	Okay, and it will do this to set up a primary database,
804850	808950	which is used for interpreting the data that's coming in.
809410	816670	And this is needed because there's no simple database holding the data that we need in a convenient format.
816670	822430	Okay, it's all in the specifications or proprietary by vendors.
822830	829430	So there is an option for an end user to create custom messages with this tool.
829430	832790	And this will be handy for working with proprietary data.
834350	845870	The benefit of this, using this tool, is that it can be piped from or to other programs, as it's just a command line utility.
848150	852690	So there are some requirements. What do we need to get this off the ground?
852690	859750	Well, the first part is on you guys, you're going to need an interface to some bus to get the traffic.
860750	873690	The next part is, it uses the program PDF2Text, which is contained within the popular udos package standard on most Linux distributions.
873710	888050	Okay, and what happens with this is we use this tool to convert the SAE portable document format specifications into formatted text files.
888050	900090	Okay, then you need Python 2. We are hoping to port this to Python 3, but it started as a spaghetti code project that we just needed up and running.
900150	907950	And Python 2 was default here. And that's what we stuck with until now when we realized it's actually useful.
909030	916830	There's still some minor issues with it. The spec obviously was not written with being parsed in mind.
916830	925470	Okay, so there's a lot of regular expressions and things that parse this information out of these files.
927650	937470	Okay, so I think at this point, I'm going to give you guys a quick demo about how this thing works.
938650	963670	It's a repository, which will be made public after this talk. And you can just clone it. And at that point, you will set up the configuration file to point at the text files that you've created from using PDF2Text on the SAE J1587 and 1708 specifications. Okay.
963670	973090	So the first thing that I'll mention is this repository. Within it, we have a tool called Fuzzy Messages, which I'll be using for the demo.
973090	992830	All right, this program just creates random bytes, I believe 1 to 19 bytes in length. And this winds up working out as a nice test environment to create a robust program. That way, it's not just failing on any sort of messages.
992830	1015910	As you might see, when running different types of hardware, you'll get funky bytes that aren't actually part of the message at times. So we've decided to make this program a little bit robust, and that it won't just error out on an incorrect message. It might print a warning to standard out, and it'll keep chugging.
1015910	1038910	Okay, so the first thing I'm going to do is I'm going to create a file with, let's say, 100 messages, and I'm going to write that to temp. Okay, let me just make sure that that worked. Yep, seems like I got messages in there.
1038910	1052390	All right, so now to run the tool, I just point it at that file that I created with all the messages. I'm also going to give it a flag to print the limiters between the messages.
1053470	1081490	So you can see, when there are errors, it gets printed to standard error. So these can be piped to DevMill if you're not interested. But you can also see here the original message MID in hexadecimal, and these also are accompanied by decimal forms. And then the PIDs and the meanings of the PIDs, along with the accompanying bytes.
1081490	1093270	Okay, so that's pretty good. But if you want more information, you can give this program a little bit more verbosity, like so.
1093270	1115350	And you'll get details. This is the same message here that we saw previously. But now you can see it's giving details about the individual bytes related to a PID. So here we can see there's one byte and this has to do with the extended range barometric pressure. Okay, and here are the units right here.
1115350	1140810	I just want to mention one thing. We are using random bytes for this data. So this MID says idle adjust system. And it's not necessarily in a real world scenario, this PID is probably not going to be matched with this MID. Okay. But we don't error out, we just want to parse the data as it comes.
1142770	1150090	There's a couple of other options I wanted to mention. So some people prefer JSON.
1150970	1153570	We added a flag for JSON.
1153570	1163390	I will disable the output that you just saw, which can be easily grepped. And I will print these messages in JSON format.
1163390	1169850	And I'm also going to pipe the standard out to dev null.
1170370	1187470	Okay, so you can see in here, same messages, but these are output as JSON formatted messages. This could be convenient if you use the JQ tool, and you want to filter these messages the way you'd wish.
1187470	1193590	But there's another option for you. And that is, we have a whitelist here.
1197110	1210350	So what we can do is specify specific PIDs, like if we are interested in certain PIDs within a message, we only want to print those messages, we use the whitelist option.
1210350	1213130	So I will just grab one from here.
1218960	1224860	And so you can see I printed out one message with that PID, 48.
1225760	1230540	And that is in actually decimal form for that.
1231540	1234900	Okay, so there's a couple other things that this can do.
1235500	1240220	If you just give it the dash H, it'll give you some help.
1240720	1263480	One of the options is for a custom database. Now this means if you want to define your own messages, and overwrite those that are provided by the spec, or let's say you're working with some proprietary messages, and you have a good idea what it means, you can define that.
1263480	1280900	We provide a sample file in the repo. And you can see here that basically, this is the format, it's just JSON. And you just give it your definitions, you can use this file as a guide.
1280900	1297720	Okay, there are still some issues. There are a few PIDs that are a little bit more tricky to work with. And those might not have their individual byte definitions overwritten, but it's a work in progress there.
1297720	1322640	I wanted to mention that, okay, if you want to read from standard input, the way that you do it is you just pipe hexadecimal delimited bytes, as I mentioned, to this, and you will use this usual format for reading from standard input.
1322640	1349780	Okay, I'll also use the... I'll use packet delimiters here. And you can see what the meaning is. But one of my colleagues came to me and he said, well, you know what, you know, we have an issue because the output that I'm getting from my program is not set up like that, it doesn't have the comma delimited values, it's all just a string of hexadecimal bytes.
1349780	1375960	So what we did was we added the option here, if you look in this file called canon functions, an end user can define a function to be called on the command line that will manipulate this format. And the only requirement is that the output would be a Python list of bytes, okay, or a Python list of integers.
1375960	1403880	So in this case, we can use the dash j option and say canon no delims, I believe I called it. And you can see that it will just parse the message in that format. Okay, so it doesn't really matter. All you need to do is know what your input looks like, and figure out how to get that into a Python list of integers.
1407600	1418760	Let me see if there's anything else I want to mention. I think that's it for now. I'll let you guys play with the rest of those options as you see fit.
1423830	1437030	So getting back, what are the benefits of using this decoder? Well, there's no real software investment, other than getting your hands on the SAE specs.
1437030	1452990	Okay, I'm sorry, we can't just provide them for free. But SSA, sorry, SAE would not be happy with us. And they take the intellectual property very seriously. So I'm sorry about that. You can handle it, I'm sure.
1454070	1461610	The other benefit is that you can work with anything that outputs 1708, 1587 messages.
1464270	1482430	So where can you get it? If you want to get your hands on this tool, you'll go to this URL. After the talk, we will make this a public repo. We're rolling with an MIT license, so don't forget where it came from, and feel free to make money on it.
1482430	1492330	But remember that there are a few dependencies. So you need the specs, you need PDF to text tool, and Python 2 at the moment.
1494830	1507150	We wanted to give a special thank you to NMFTA for giving us the opportunity to do this work, and our friendly motor freight carriers for allowing us to play with their trucks.
1507150	1517690	Also the Hilton Executive Lounge for hosting a nice, hectic atmosphere by letting this group meet and set up mobile test benches.
1518350	1523190	We only left a few solder burns under nice wood grain tables.
1526290	1531390	We just want to thank you for joining us, and enjoy the rest of your DEF CON talks.