1 00:00:00,000 --> 00:00:00,780 Hello, everyone. 2 00:00:00,780 --> 00:00:03,480 My name is Marcelo Secuchin. 3 00:00:03,500 --> 00:00:06,500 Today I'm going to be talking about Chupacabra. 4 00:00:06,500 --> 00:00:15,320 It is an open source do-it-yourself tool for interacting with automotive CAN bus. 5 00:00:15,900 --> 00:00:22,540 Just a quick disclaimer, this presentation is based solely on my opinion. 6 00:00:22,540 --> 00:00:25,520 It has nothing to do with my employer. 7 00:00:26,480 --> 00:00:34,900 And keep in mind, if you attempt to do the things that I'm covering here, you might potentially damage your vehicle. 8 00:00:35,180 --> 00:00:43,420 And keep in mind, if you damage your vehicle, malfunctions may or may not incur safety issues for you and others. 9 00:00:43,420 --> 00:00:46,900 So be careful if you attempt to do stuff here. 10 00:00:46,900 --> 00:00:49,320 I cannot accept the risks. 11 00:00:50,860 --> 00:00:51,500 Okay. 12 00:00:51,500 --> 00:00:54,140 A little bit about me. 13 00:00:54,140 --> 00:00:57,220 I'm a security engineer. 14 00:00:57,300 --> 00:01:00,000 I do secure development lifecycle. 15 00:01:00,000 --> 00:01:08,640 I work close with the dev teams on my daily basis to make sure they write secure code and applications. 16 00:01:09,380 --> 00:01:13,260 I try to do a lot of automation with Python. 17 00:01:13,260 --> 00:01:24,200 And surprise, surprise, the Chupacabra that I develop uses Python a lot. 18 00:01:24,200 --> 00:01:39,280 And my first exposure to CAN, to the CAN protocol, was a while ago when I was a secured software engineer and I developed some industrial control software. 19 00:01:39,280 --> 00:01:46,700 And we know that a lot of PLCs rely on the CAN open protocol for communication. 20 00:01:46,700 --> 00:01:55,800 I also like building stuff with single board open source hardware, such as BeagleBone and Raspberry Pi. 21 00:01:56,740 --> 00:02:06,000 And one of the cool things that I built was some coding bots, so I could teach my kids learning Python. 22 00:02:06,060 --> 00:02:25,240 And this is what brought me here because I attempted to, when I tried first to do some CAN hacking, I researched and CANtact was the most known tool for doing that. 23 00:02:25,240 --> 00:02:34,520 And because of and but it was sold out on a lot of vendors and they even mentioned it was because of DEF CON. 24 00:02:34,520 --> 00:02:37,600 It was really interesting. 25 00:02:37,600 --> 00:02:55,180 And then I remembered that one of those bots that I built for my kids, I used the BeagleBone Blue, which had an embedded CAN controller and the transceiver on it. 26 00:02:55,180 --> 00:03:13,180 So and I thought considering options and I said, well, why not try doing that using a BeagleBone Blue rather than waiting longer for them to be able to buy the CANtact. 27 00:03:13,180 --> 00:03:32,020 So this presentation is about how to use BeagleBone Blue SocketCAN and PythonCAN to do to interact with the CAN bus on your vehicle, more specifically to the ODB2 CAN bus. 28 00:03:32,020 --> 00:03:43,640 At the end, I will bring some research I have ongoing, still ongoing, no solid results, but trying to connect to ECUs directly. 29 00:03:43,640 --> 00:03:47,440 It is possible, but it's still an ongoing work. 30 00:03:48,340 --> 00:03:58,540 And I plan to make it interesting for both newcomers like me that are attempting car hacking for the first time. 31 00:03:58,540 --> 00:04:06,520 So the Chupacabra is easy enough to build and plug into your car and start doing stuff. 32 00:04:06,520 --> 00:04:24,640 But it could be very useful for more experienced hackers as well, because since it's a single board computer, you could easily extend it to different applications or use cases that you might have when you're doing your hacking. 33 00:04:25,380 --> 00:04:29,740 So all the Chupacabra code is available on GitHub. 34 00:04:29,740 --> 00:04:37,120 So if you're an expert, chances are that all you need to know from this presentation is this URL. 35 00:04:37,120 --> 00:04:39,340 So you can take a look on the code. 36 00:04:39,340 --> 00:05:00,020 And also, on GitHub, I share a link to a Hackster.io tutorial that I wrote with very detailed step-by-step instructions, so you can build a Chupacabra device exactly to the one that we're going to cover today. 37 00:05:00,020 --> 00:05:08,040 And I hope that I'm going to share the mistakes that I made when I was attempting to do it for the first time. 38 00:05:08,040 --> 00:05:12,760 And hopefully, it will help others when trying to do that. 39 00:05:12,760 --> 00:05:22,840 And with a device easy enough to build, potentially, you can engage more people on attempting car hacking and growing the community. 40 00:05:22,840 --> 00:05:25,080 So this is the device. 41 00:05:25,080 --> 00:05:34,280 It's basically a BeagleBone, as you can see here, with some add-ons. 42 00:05:34,280 --> 00:05:41,320 So basically, I connected a USB cellular modem here on the USB jack. 43 00:05:41,320 --> 00:05:50,460 I connect a DC jack here, so I get power from the ODB2 port on my car. 44 00:05:50,460 --> 00:05:57,720 And of course, I will need a ODB connector to connect it to my car. 45 00:05:58,280 --> 00:06:04,280 And here, this is the CAM port on the BeagleBone Blue. 46 00:06:04,280 --> 00:06:11,440 So all you need to do is to connect a JSTSH cable here. 47 00:06:11,440 --> 00:06:19,680 And then on the back, you connect it to your ODB2 extension cable. 48 00:06:19,680 --> 00:06:27,660 Of course, you can wire it directly to... this is the back of the device. 49 00:06:27,660 --> 00:06:32,040 We can also see that I use a battery. 50 00:06:32,040 --> 00:06:42,160 It's completely optional, but you can use it even if you're... let's say you were building a car tracking application. 51 00:06:42,160 --> 00:07:01,220 And even after your car batteries die, using the battery, your BeagleBone will be still alive and you can still track the GPS coordinates with this GPS module here and potentially recover your car, if that is your goal. 52 00:07:01,220 --> 00:07:03,320 So I use a very simple material. 53 00:07:03,320 --> 00:07:08,380 So I use a plastic plate like this to put all the pieces together. 54 00:07:08,380 --> 00:07:13,040 Some rubber bands, but you can build it differently. 55 00:07:13,280 --> 00:07:17,680 Again, all the instructions are on the Hackster.io article. 56 00:07:17,700 --> 00:07:29,580 And all you need to do is to put all those pieces together so you have a functioning BeagleBone to plug to your ODB2 port on your car. 57 00:07:29,740 --> 00:07:36,360 And also, you don't need to add all those parts together. 58 00:07:36,360 --> 00:07:57,020 I would say if all you need to want to do is to just use a socket cam to exchange some cam messages with your car, all you need to do is, of course, the BeagleBone Blue and a connector like this. 59 00:07:57,020 --> 00:08:00,880 The name is a JSTSH connector. 60 00:08:00,880 --> 00:08:14,580 You connect it to one end of the BeagleBone and then you can use solid hookup wires like this to connect it to this connector. 61 00:08:14,580 --> 00:08:23,160 And then the other end directly to the ODB ports to your car if you want to keep things simple. 62 00:08:23,220 --> 00:08:30,740 Or you can just build it using the ODB2 extension like this. 63 00:08:30,940 --> 00:08:33,020 Okay, so what does... 64 00:08:33,760 --> 00:08:36,580 once you build your device, what does it do? 65 00:08:36,580 --> 00:08:48,560 So the idea here is to create a connection between your CAN bus from inside your vehicle to the outside world. 66 00:08:48,560 --> 00:09:02,620 So from my perspective, I can assume that most of the manufacturers create a threat modeling of their CAN bus system, assuming that they are going to be isolated from the outside world. 67 00:09:02,620 --> 00:09:07,100 So of course, you would need physical access to the car. 68 00:09:07,100 --> 00:09:17,760 But the idea here is to create an easy way of so you can exfiltrate data from your car to the CAN bus. 69 00:09:17,760 --> 00:09:27,820 And the BeagleBone Blue makes it very convenient because it's really easy to connect the GPS module that I showed before. 70 00:09:28,000 --> 00:09:36,820 And on the top of that, it already has the embedded Wi-Fi access point and interface. 71 00:09:36,820 --> 00:09:42,980 So you can connect it directly or connect it to your Wi-Fi network and access the internet. 72 00:09:42,980 --> 00:09:50,880 Or as I showed, you could use a cellular modem like this to the USB port. 73 00:09:50,880 --> 00:10:03,780 And even if your car drives away and goes out of the range of your Wi-Fi network, you still have communication to your vehicle and you would be able to potentially send CAN messages to your car remotely. 74 00:10:04,740 --> 00:10:15,040 And one other cool thing about doing it using a single board computer, you can easily expand it to some other different applications. 75 00:10:15,040 --> 00:10:19,020 You can, for instance, create a geofence application. 76 00:10:19,020 --> 00:10:23,080 You want to maybe disable your car if it goes too far. 77 00:10:23,080 --> 00:10:25,880 Or maybe you want to track it back. 78 00:10:26,120 --> 00:10:33,780 You can, for instance, plug USB cameras and microphones. 79 00:10:33,780 --> 00:10:36,220 So if you want to capture audio. 80 00:10:36,580 --> 00:10:46,900 You can even use servos because the BeagleBone Blue is a robotic... it's intended for robotic applications. 81 00:10:46,900 --> 00:10:54,520 So you can plug servos here on those rails and perform some physical actions inside your car if you need it. 82 00:10:54,520 --> 00:11:00,880 You can even try to robotify your car, let's put it that way. 83 00:11:01,560 --> 00:11:04,200 So this is what it... oops, sorry. 84 00:11:04,200 --> 00:11:06,540 This is what it does. 85 00:11:06,540 --> 00:11:25,200 And once we run the Chupacabra inside your car, you're going to see on your local terminal, I'm assuming you SSH to your BeagleBone, and you're going to see once you run the Python script, you're going to see on your terminal what we have on the left. 86 00:11:25,200 --> 00:11:34,540 By default, it will start monitoring your vehicle speed from the ODB2 port, the RPM, and the temperature. 87 00:11:35,320 --> 00:11:48,020 And we'll also start sending all that information along with the GPS coordinates to a Flask application running on AWS. 88 00:11:48,040 --> 00:11:55,380 The source code for the Flask application is also available on the GitHub repo. 89 00:11:55,680 --> 00:12:03,700 So as I mentioned, by default, it will send only vehicle speeds, temperature, and RPM. 90 00:12:03,700 --> 00:12:33,380 But if you want to use other ODB2 PID from your ODB2 port, I created this convenient CSV file that if on the left column here, on the Enable Disabled column, you just set 0 and 1 to the ODB2 PIDs that you want to enable or disable. 91 00:12:33,380 --> 00:12:36,720 So as you can see here, this is one example. 92 00:12:37,460 --> 00:12:52,220 And all you need to do is customize it, and then you should be able to monitor other information from the ODB2 port other than the speed, temperature, and RPM. 93 00:12:52,220 --> 00:12:59,000 Okay, so how do you connect a BeagleBone to your ODB2 port? 94 00:12:59,000 --> 00:13:05,880 As I mentioned before, you have the CAN connector here. 95 00:13:05,880 --> 00:13:11,140 You use the JST connector to plug it here. 96 00:13:11,140 --> 00:13:32,340 And then all you need to do is to go to the female ODB2 port on your car and connect the CAN high and CAN low pins to the pin 6 and 14 respectively on your ODB2 port on your car. 97 00:13:32,340 --> 00:13:36,280 And it brings me to the first mistake I made. 98 00:13:36,280 --> 00:13:45,660 Keep in mind that this schematic, these pin numbers, are related to the female ODB2 port. 99 00:13:45,660 --> 00:14:11,940 So initially, what I tried to do, as you can see here on this picture, I connected the JST connector to the BeagleBone, and I used some hookup cables, and I cut a cable like this, and for convenience, I would connect my BeagleBone hookup wires to a male ODB2 connector. 100 00:14:12,280 --> 00:14:24,120 And keep in mind, if you do that, the numbers 1 to 8 will be mirrored because the female connects front to front, the male and female connects like this. 101 00:14:24,120 --> 00:14:31,180 So the eighth pin here on the female is actually the third pin here on the male. 102 00:14:31,180 --> 00:14:32,700 So keep those things in mind. 103 00:14:32,700 --> 00:14:43,180 This is a mistake that I made, and I believe I want to just prevent you from wasting time troubleshooting those things. 104 00:14:43,400 --> 00:14:50,940 And other mistakes that I did, and it could potentially help you when attempting this. 105 00:14:51,580 --> 00:14:54,900 So use a multimeter is your friend. 106 00:14:54,900 --> 00:15:06,400 I would be able to easily catch up that mistake if you use a multimeter and make sure you have some voltage on the pins that you want to tap in. 107 00:15:06,740 --> 00:15:15,300 And by the way, on my car, the pins 3 and 11 that I connected by mistake initially, they don't have any voltage there because they don't do anything. 108 00:15:15,300 --> 00:15:20,360 So with a multimeter, you would be able to catch issues like this. 109 00:15:20,360 --> 00:15:28,000 Another mistake that I did was when I saw CAN dump, I assume a TCP dump. 110 00:15:28,000 --> 00:15:31,360 So it's a sniffer, right? 111 00:15:32,040 --> 00:15:35,160 Sniffing traffic, so they should be similar. 112 00:15:35,160 --> 00:15:37,660 They are in some extent. 113 00:15:37,660 --> 00:15:41,080 However, CAN bus is not Ethernet. 114 00:15:41,080 --> 00:15:48,860 You need at minimum two nodes on the bus so you can potentially transmit and sniff some traffic. 115 00:15:48,860 --> 00:15:54,940 So initially, I enabled the CAN interface on my BeagleBone. 116 00:15:55,020 --> 00:15:58,080 I started CAN dump on one terminal. 117 00:15:58,080 --> 00:16:00,620 I started doing CAN send on the other. 118 00:16:00,620 --> 00:16:02,440 And I didn't see anything. 119 00:16:02,440 --> 00:16:03,720 And I didn't know why. 120 00:16:03,720 --> 00:16:10,040 The reason is because you need two nodes so you have at minimum, so you have a CAN. 121 00:16:10,040 --> 00:16:16,980 But even before doing that, what I would recommend, play a little bit with vCAN first. 122 00:16:17,080 --> 00:16:37,480 It's very easy to install vCAN on a Ubuntu Linux, for instance, and then you can do the CAN send and CAN dump and monitor the messages and understand how it works before even attempting to a real physical CAN. 123 00:16:38,560 --> 00:16:44,340 Another common issue that I had to face is you have to know the bitrate. 124 00:16:44,700 --> 00:16:48,220 So if you want a CAN bus to work properly. 125 00:16:48,220 --> 00:16:54,940 And for my vehicle, by default, it uses 500k baud rate. 126 00:16:55,560 --> 00:16:57,420 And yours might be different. 127 00:16:57,420 --> 00:16:59,120 So keep that in mind. 128 00:16:59,660 --> 00:17:01,620 So this is a suggestion. 129 00:17:01,620 --> 00:17:13,860 So if you want to make sure your Chupacabra is working and you understand a little bit how CAN works, create a CAN bus breadboard like this. 130 00:17:13,860 --> 00:17:14,800 It's really simple. 131 00:17:14,800 --> 00:17:22,360 You just use some jump wires to hook your JST connectors to a breadboard. 132 00:17:22,360 --> 00:17:28,800 The only thing you need to know is I'm using blue for CAN high here and white for CAN low. 133 00:17:28,800 --> 00:17:44,240 The only thing that you need to know is you need a 120 ohms resistor at each end connecting the CAN high and CAN low rails. 134 00:17:44,340 --> 00:17:57,520 It's going to be very helpful because then you can plug two BeagleBones, for instance, and exchange some CAN messages between each other with CAN dump. 135 00:17:57,520 --> 00:18:08,600 Another useful thing that I would recommend, not necessarily, but it might be helpful, is to cut a extension cable like this. 136 00:18:08,600 --> 00:18:17,320 So if things are not working properly, for instance, I bought a very simple device like this. 137 00:18:17,320 --> 00:18:21,880 It's a scan tool that supports scan ODB2. 138 00:18:21,880 --> 00:18:23,360 It's very cheap. 139 00:18:23,360 --> 00:18:24,820 And it was working. 140 00:18:24,820 --> 00:18:29,220 And I didn't know why my BeagleBone wasn't working properly. 141 00:18:29,220 --> 00:18:31,120 So I created this. 142 00:18:31,120 --> 00:18:38,580 I cut this cable and hooked one through 16, all the pins on my breadboard rails. 143 00:18:38,580 --> 00:18:47,420 And then I was able to connect it, this device to this extension and the extension to the car. 144 00:18:47,420 --> 00:19:01,100 And then here on the picture with the zoom, I could hook the JST connector to this breadboard and then start CAN dump there. 145 00:19:01,100 --> 00:19:04,680 And for instance, use this device to retrieve the VIN number. 146 00:19:04,680 --> 00:19:16,960 And then I would see the exactly messages that it was exchanging and understand what could be wrong with my BeagleBone that I wasn't getting right. 147 00:19:17,060 --> 00:19:21,560 And in my case, what I didn't know at that time was this. 148 00:19:21,560 --> 00:19:30,900 I was expecting to plug the BeagleBone to the ODB2 port, start CAN dump, and I was expecting to see a lot of traffic there. 149 00:19:30,900 --> 00:19:35,340 But what I noticed is that my ODB2 port was silent. 150 00:19:35,340 --> 00:19:37,980 It was just listening to... 151 00:19:37,980 --> 00:19:42,080 because it was segmented to the other CAN buses on the car. 152 00:19:42,080 --> 00:19:49,600 So it was just waiting for some specific CAN messages to reply to it. 153 00:19:49,600 --> 00:19:52,400 And this is exactly what happened. 154 00:19:52,400 --> 00:20:01,420 This is when I sniffed the comments from this device here, that was the CAN message I saw. 155 00:20:01,420 --> 00:20:10,940 And then using the CAN dump on the CAN0 from the BeagleBone, I saw the request and the response with my VIN number there. 156 00:20:13,320 --> 00:20:15,160 All right. 157 00:20:15,160 --> 00:20:24,320 So let's say you're confident enough, you understand how to play with CAN bus using a BeagleBone. 158 00:20:24,380 --> 00:20:31,460 And now you wanna... and you built your Chupacabra device, you wanna run it on your vehicle. 159 00:20:31,820 --> 00:20:39,540 So my suggestion would be play a little bit first with a socket CAN and make sure everything is working. 160 00:20:39,540 --> 00:20:48,600 So just try different bit rates, for instance, here on this, I'm trying the 500k, which is what worked for my car. 161 00:20:48,600 --> 00:20:55,700 Enable the CAN0 interface and open another terminal with CAN dump. 162 00:20:55,700 --> 00:21:02,220 And on a different terminal, you send the request VIN message. 163 00:21:02,260 --> 00:21:11,940 And by the way, all those messages, including this request VIN, is available on the CSV worksheet that I have available on GitHub. 164 00:21:11,940 --> 00:21:14,240 So you can try different stuff there. 165 00:21:14,600 --> 00:21:25,900 Once you know, once you see the request and the response, you know that your Chupacabra and your BeagleBone is able to properly use socket CAN in your car. 166 00:21:26,720 --> 00:21:34,920 And then if you want to test the GPS module, you would recommend using this TIO command. 167 00:21:35,200 --> 00:21:43,340 By default, it uses the serial port TTY02 with baud rate 4800. 168 00:21:43,340 --> 00:21:45,380 This is a specific one that I use it. 169 00:21:45,380 --> 00:21:53,640 All the parts are listed on the Hackster.io article, and I point to vendors that supply them. 170 00:21:53,640 --> 00:22:02,580 So, and when you start the TIO command, you're going to see a lot of GPS sentences flowing around. 171 00:22:02,700 --> 00:22:07,940 And wait a little bit for the module to find a GPS satellite. 172 00:22:08,000 --> 00:22:20,600 And once you get some GPRMC sentences, similar to this one that I have on screen, you can use an online decoder, just like this RL.SC. 173 00:22:20,600 --> 00:22:22,180 It's really cool, by the way. 174 00:22:22,600 --> 00:22:29,520 You just need to provide the GPRMC and it will plot your exact locations on a map. 175 00:22:31,180 --> 00:22:50,380 For cellular connection, so for connection, all you need to do is to make sure you have internet connection from your BeagleBone, either by using a Wi-Fi network or a cellular LTE modem, which is what I did. 176 00:22:50,380 --> 00:22:55,240 I use the hologram vendor because it's very Python friendly. 177 00:22:55,320 --> 00:23:03,680 The documentation is really good, so it was really easy to install it and get it working on my BeagleBone. 178 00:23:03,680 --> 00:23:07,560 Again, all the documentation is available on my Hackster.io article. 179 00:23:07,760 --> 00:23:22,380 And at the end of the day, all you need to do is to ping a public server on the internet and make sure you have internet connection so the data that your Chupacabra is capturing can be exfiltrated to a server. 180 00:23:23,020 --> 00:23:27,940 And once you know everything is working properly, it is time for you to clone the repo. 181 00:23:28,420 --> 00:23:38,800 Go to the Chupacabra folder and play around a little bit with the CSV files and enable and disable the ODB2 PIDs that you are interested in. 182 00:23:38,800 --> 00:23:42,060 And then just run the Python script. 183 00:23:42,060 --> 00:23:44,940 And by the way, it's all Python 3 basic. 184 00:23:44,940 --> 00:23:47,620 I don't think it works with Python 2. 185 00:23:48,020 --> 00:23:56,220 And if everything goes well, you're going to see all the ODB2 PIDs that you enabled being displayed on the screen. 186 00:23:56,400 --> 00:24:09,160 And also, if you have an internet connection, by default, it's going to be exfiltrated to this public AWS Flask app that I had running. 187 00:24:09,160 --> 00:24:10,940 And by default, the script points to that. 188 00:24:10,940 --> 00:24:20,780 If you want to create your own, just use the code available on this server or on this GitHub repo. 189 00:24:20,780 --> 00:24:29,100 And then you can customize it, run in a different cloud environment and customize it any way you want. 190 00:24:30,140 --> 00:24:39,640 Okay, let me run a quick demo video here so we have an idea how the Chupacabra works. 191 00:24:40,560 --> 00:24:42,500 So, this is the device. 192 00:24:42,500 --> 00:24:48,000 I'm going to plug into the ODB2 port from my car. 193 00:24:48,000 --> 00:24:51,060 The engine is on, already running. 194 00:24:53,740 --> 00:24:58,020 Yeah, so I'm just showing where is the ODB2 port on my vehicle. 195 00:24:58,020 --> 00:25:03,100 It's usually some close to the steering wheel. 196 00:25:03,380 --> 00:25:08,520 And then I'm going to put it on the dashboard because I'm going to monitor it from outside the vehicle. 197 00:25:08,520 --> 00:25:12,620 This is something that is really convenient compared to the other solutions. 198 00:25:12,620 --> 00:25:23,260 Because you have the embedded access, Wi-Fi access point on the vehicle, you can just connect to it and run Chupacabra from there. 199 00:25:23,260 --> 00:25:27,660 This is what you would get on your terminal if everything goes well. 200 00:25:27,660 --> 00:25:31,240 And then you can monitor your car. 201 00:25:31,240 --> 00:25:35,360 Of course, if it goes out of range, it will want to work. 202 00:25:35,360 --> 00:25:41,240 But you can monitor your ODB2 data from outside the car. 203 00:25:43,780 --> 00:25:47,760 Now, I have a test from inside the car. 204 00:25:48,520 --> 00:25:53,320 Here is I'm running the same test from inside the car. 205 00:25:53,320 --> 00:26:03,040 But the cool thing here is I'm going, I perform a lap around the course, and I'm monitoring the GPS data. 206 00:26:03,040 --> 00:26:14,020 So, it's exfiltrating using the cellular network to AWS server that I had running, right? 207 00:26:14,020 --> 00:26:22,240 And you're going to freeze the video exactly where the coordinates was exfiltrated. 208 00:26:22,240 --> 00:26:37,560 Then when I got home, I just visited the public AWS Flask application, and I saw all the GPRMC sentences available there, and I could plot them on the map. 209 00:26:37,560 --> 00:26:45,860 So, if I was away from the vehicle, I would be able to track it wherever it was. 210 00:26:47,140 --> 00:26:52,580 And if you plot all the, and it will, GPS will also give you the speed. 211 00:26:52,720 --> 00:27:02,260 And if you plot all the coordinates that are available in the application, you would have an idea from where the vehicle was traveling. 212 00:27:02,260 --> 00:27:09,760 So, I performed a course around a few blocks, and this is what I show here. 213 00:27:10,200 --> 00:27:11,620 All right. 214 00:27:16,070 --> 00:27:19,690 So, this is how the device works, right? 215 00:27:19,690 --> 00:27:26,150 So, it is able to exfiltrate ODB2 and GPS data. 216 00:27:26,150 --> 00:27:27,910 But what's next? 217 00:27:27,910 --> 00:27:30,330 And this is a currently work. 218 00:27:30,330 --> 00:27:44,230 I have only preliminary results, but probably the next thing that you want to do is to go beyond of the ODB2 CAN bus, and actually tap into a real CAN bus for your vehicle. 219 00:27:44,230 --> 00:27:47,670 And you can do it using the exactly same device. 220 00:27:47,790 --> 00:28:11,930 So, what I've been doing so far, so rather than reverse engineering every wire inside and disassembling my dashboard, that would be insane hard work to do, you can alternatively go to your dealership and get a book like this, a supplemental, electric supplemental manual, 221 00:28:11,930 --> 00:28:26,090 and it will give you a lot of detailed information about all the cables, where all the electronic components from your vehicles are located, and the connections between them. 222 00:28:26,570 --> 00:28:41,250 So, for instance, really close to my steering wheel on my vehicle, I have this ETAC ECU that is also located pretty close to the ODB2 connector. 223 00:28:41,250 --> 00:28:52,010 So, I thought, okay, let me connect those two CAN buses that are segmented from my vehicle, and then I can monitor everything. 224 00:28:52,070 --> 00:28:53,550 And that was my goal. 225 00:28:53,550 --> 00:28:59,910 So, knowing where the ECU is, it's pretty, helps a lot. 226 00:29:00,370 --> 00:29:02,430 And here is a picture of the vehicle. 227 00:29:02,430 --> 00:29:10,850 So, to get physical access to that specific ECU, all we needed to do was to remove a couple of plastic covers from my vehicle. 228 00:29:10,850 --> 00:29:12,470 And that was it. 229 00:29:12,470 --> 00:29:18,770 I could see the ECU from the bottom of the driving seat. 230 00:29:20,190 --> 00:29:27,210 And also, the electronic supplemental will give you detailed information about the ECUs on your car. 231 00:29:27,210 --> 00:29:36,890 So, for this one specifically, if you look to the picture on the left, on the bottom, I have this C411 connector. 232 00:29:36,950 --> 00:29:52,610 And if you go deep on the manual, you're going to notice, then on the diagram on the right, on the top, you have, you know, you would know that the C411 connector is actually connected to a CAN drive. 233 00:29:52,690 --> 00:30:06,290 And the pins eight and nine are connected respectively to CAN low and high to another component they call ECM on this vehicle. 234 00:30:06,290 --> 00:30:13,130 And not only that, you know, you have the wiring colors used for those cables. 235 00:30:13,130 --> 00:30:29,350 So, I know that the CAN high on pin nine is BR, which is brown cable, and the CAN low on pin eight is Y, a yellow cable. 236 00:30:29,350 --> 00:30:40,470 So, looking carefully inside my dashboard, I was able to find this ETOX ECU with this specific connector. 237 00:30:40,630 --> 00:30:47,290 And you can see the brown and yellow cable on pins eight and nine. 238 00:30:47,290 --> 00:30:54,750 And also close to the arrow that I put, you can see the ODB2 port on the top. 239 00:30:55,690 --> 00:31:04,070 So, again, so what I needed to do, all I needed to do is to use a hookup wire like this. 240 00:31:04,070 --> 00:31:05,810 This is not the actual CAN cable. 241 00:31:05,810 --> 00:31:10,270 It's just a hookup wire that I manually twisted myself. 242 00:31:10,270 --> 00:31:13,870 Oh, this is another common mistake. 243 00:31:13,910 --> 00:31:25,010 Make sure you either use a real CAN cable, or if you're using hookup wires like me, make sure they are not too long, because they might not function well. 244 00:31:25,010 --> 00:31:34,610 And you can try to manually twist them to mimic what a real CAN cable would, the physical properties of a real CAN cable. 245 00:31:35,470 --> 00:31:57,710 But back to this, be aware that by bridging those segmented CAN buses on your car, you may, you might damage your electronic components on your car, and incur safety issues for you and for others. 246 00:31:57,710 --> 00:32:01,830 So be sure you know what you're doing, and be careful. 247 00:32:04,150 --> 00:32:14,810 Okay, so once I got a good physical connection with those pins, I used a multimeter to make sure I had good wiring. 248 00:32:15,270 --> 00:32:32,230 On this specific ACU, when I have the ignition off, it gives me 1.13 volts, but when I turn the ignition on, I get the expected 2.5 volts. 249 00:32:32,230 --> 00:32:42,110 Another mistake that I did, I recommend turning on the engine, because you would very quickly kill your battery. 250 00:32:42,110 --> 00:32:45,910 I did that, don't make the mistakes that I did. 251 00:32:45,910 --> 00:33:14,290 Okay, so now that I know with the multimeter that I have a good physical connection with the ACU, I connected the other end of the hookup wires directly to the back of the BeagleBone with the other, with the existing CAN high and CAN low cables, wires that I had to the ODB2. 252 00:33:14,290 --> 00:33:16,990 And that's all I needed to do. 253 00:33:16,990 --> 00:33:42,910 And then by doing that, as opposed to the initial result that I had only with the CAN, the ODB2 CAN, now if I run CAN dump from the Chupacabra device, now I see a lot of traffic between this ETACC ACU that I connected and the other electronic device ECM from my vehicle. 254 00:33:42,910 --> 00:33:54,110 I can tell, and exchange information through the CAN bus. 255 00:33:54,990 --> 00:34:00,810 All right, so that's where I got so far. 256 00:34:00,810 --> 00:34:08,630 What I'm planning to do, that's what I'm trying to do right now, is to reverse engineering some of those messages. 257 00:34:08,630 --> 00:34:36,110 For instance, I'm trying to use a CAN dump to write, to save the traffic, to dump the traffic to a local file, do something on the vehicle, for instance, opening and closing the power window, and then using CAN player, try to replay the traffic, and try to open and close the window just by replaying the messages. 258 00:34:36,110 --> 00:34:41,550 The problem is, I wasn't so successful doing that so far. 259 00:34:41,550 --> 00:34:54,530 And every time I try that, I get a beautiful and shining service engine light on my vehicle, and I might break my vehicle at some point. 260 00:34:54,550 --> 00:35:03,370 And not only that, maybe I'm not even connected to the right CAN bus that I should be tapping into if I want to open and close the window. 261 00:35:03,370 --> 00:35:08,210 So I have a lot of work to do to do that yet. 262 00:35:08,210 --> 00:35:25,010 But what tells me I'm on the right path is, when I do CAN sniffer, unfortunately, because it's a very busy CAN bus, it's still very polluted to me to tell exactly what's going on when I open and close the window. 263 00:35:25,010 --> 00:35:34,030 But I see something go, some action, there are some different, some new messages showing up when I'm doing those actions. 264 00:35:34,030 --> 00:35:38,950 So I still don't know what's going on, but that's what I'm trying to do. 265 00:35:40,030 --> 00:35:44,710 Get some interesting CAN messages so I can replay them later. 266 00:35:44,870 --> 00:36:00,290 So since I wasn't able to get, for instance, the opening and closing window yet, let's assume the message that I want to do remote execution on my car is the retrieve VIN message, right? 267 00:36:00,290 --> 00:36:06,170 Which is the one I'm highlighting here with the CAN send command. 268 00:36:06,170 --> 00:36:26,170 So my goal is to create a kind of RPC where I have a new endpoint on the on the Flask application running on the cloud that I would be able to send any CAN message that I wanted to be executed remotely on the car. 269 00:36:26,170 --> 00:36:42,030 Of course, I had to URL encode the hashtag here so I could post this URL to my Flask application and get it available. 270 00:36:42,190 --> 00:36:51,770 And in order to do that, here's an oversimplified version of the changes that would be needed on the current Chupacabra implementation. 271 00:36:52,570 --> 00:36:57,930 And by the way, once I get it working, I will update the code and make it available. 272 00:36:57,930 --> 00:37:10,390 But if community guys, if you feel free to fork the code and or even submit pull requests, I would be very excited if people would start doing that, actually. 273 00:37:10,390 --> 00:37:34,530 But the idea here is to do what I showed before, submitting messages remotely to create this kind of reverse HTTP command and control, I would create on the server application a queue into new endpoints, a GET and POST endpoint on this RPC endpoint. 274 00:37:34,550 --> 00:37:42,370 And whenever you send a GET a POST message with the CAN message, it would add to the queue. 275 00:37:42,370 --> 00:37:56,050 And then on the GET request, you would pop a message, CAN message from the queue and then you execute it on the client. 276 00:37:56,050 --> 00:38:08,570 So the changes on the client, the Chupacabra.py, would be basically hitting the RPC flask application with the GET request. 277 00:38:08,570 --> 00:38:18,350 It would give you a keyword CAN message that you submitted, and then it would send it to the bus and execute on your car. 278 00:38:18,350 --> 00:38:21,210 Of course, this is a very oversimplified version. 279 00:38:21,210 --> 00:38:35,750 Just to illustrate, you would need to add some error catches here, some logic, and even you would need to parse the JSON data to put your CAN message together. 280 00:38:36,010 --> 00:38:37,130 But that's the idea. 281 00:38:37,130 --> 00:38:43,250 So this is one suggestion, this is what I'm going for. 282 00:38:43,470 --> 00:38:51,130 But again, it's a Python code on an open source hardware platform. 283 00:38:51,130 --> 00:38:57,250 Feel free to do whatever you want to do with it. 284 00:38:57,250 --> 00:39:27,490 And the takeaways here from this presentation is, again, I want to build an open source hardware and software platform that could be useful for newcomers that are attempting this for the first time, but also for more experienced guys that see a need for a single board computer running on a car where they could remotely do some stuff there. 285 00:39:27,630 --> 00:39:38,750 Currently, the code that I have on GitHub only do GPS and ODB2 CAN messages, data exfiltration. 286 00:39:38,750 --> 00:39:44,600 But as I just showed, I plan to expand it in the future. 287 00:39:46,210 --> 00:39:49,850 Yeah, so let's use it, guys. 288 00:39:49,850 --> 00:39:51,610 I'm open to feedback. 289 00:39:51,690 --> 00:39:53,680 Let's grow the community. 290 00:39:54,590 --> 00:39:57,090 And let's have fun. 291 00:39:57,210 --> 00:40:05,090 Oh, one thing I would like to thank my friend Robert from Autobahn AI. 292 00:40:05,090 --> 00:40:16,950 He helped me a lot with all his knowledge on Automagic CAN with issues that I have, troubleshooting things and attempt different approaches. 293 00:40:16,950 --> 00:40:18,570 So thank you, Robert. 294 00:40:18,570 --> 00:40:20,770 It was really appreciated. 295 00:40:21,630 --> 00:40:24,050 And that's all I have, guys. 296 00:40:24,050 --> 00:40:32,830 So again, all the information that you need to build the Chupacabra is available on GitHub. 297 00:40:32,910 --> 00:40:38,850 And if you have any questions, suggestions, hit me on social media. 298 00:40:38,850 --> 00:40:45,310 I would be very happy to see people using the device. 299 00:40:45,310 --> 00:40:57,650 And if people have the same issue that I have trying to buy other open source tools because they were sold out, let's make BeagleBone sold out. 300 00:40:57,650 --> 00:41:17,530 I'm going to measure the success of this presentation based on whether or not we can sold out all the BeagleBone Blues next year because everybody will be trying to hack their cards using this open source platform. 301 00:41:17,530 --> 00:41:20,190 So again, thank you, guys. 302 00:41:21,410 --> 00:41:23,570 I'm open for questions. 303 00:41:25,410 --> 00:41:29,550 Reach out to me either on social media or on the Q&A session.