Hello, everyone. My name is Marcelo Secuchin. Today I'm going to be talking about Chupacabra.
It is an open source do-it-yourself tool for interacting with automotive CAN bus.
Just a quick disclaimer, this presentation is based solely on my opinion. It has nothing
to do with my employer. And keep in mind, if you attempt to do the things that I'm covering
here, you might potentially damage your vehicle. And keep in mind, if you damage your vehicle,
malfunctions may or may not incur safety issues for you and others. So be careful if you attempt
to do stuff here. I cannot accept the risks. Okay. A little bit about me. I'm a security
engineer. I do secure development lifecycle. I work close with the dev teams on my daily
basis to make sure they write secure code and applications. I try to do a lot of automation
with Python. And surprise, surprise, the Chupacabra that I develop uses Python a lot.
And my first exposure to CAN, to the CAN protocol, was a while ago when I was a secured software
engineer and I developed some industrial control software. And we know that a lot of PLCs rely on
the CAN open protocol for communication. I also like building stuff with single board open source
hardware, such as BeagleBone and Raspberry Pi. And one of the cool things that I built was some
coding bots, so I could teach my kids learning Python. And this is what brought me here because I
attempted to, when I tried first to do some CAN hacking, I researched and CANtact was the most
known tool for doing that. And because of and but it was sold out on a lot of vendors and
they even mentioned it was because of DEF CON. It was really interesting. And then I remembered that
one of those bots that I built for my kids, I used the BeagleBone Blue, which
had an embedded CAN controller and the transceiver on it. So and I thought considering
options and I said, well, why not try doing that using a BeagleBone Blue rather than waiting longer
for them to be able to buy the CANtact. So this presentation is about how to use BeagleBone Blue
SocketCAN and PythonCAN to do to interact with the CAN bus on your vehicle, more specifically to
the ODB2 CAN bus. At the end, I will bring some research I have ongoing, still ongoing, no solid
results, but trying to connect to ECUs directly. It is possible, but it's still an ongoing work.
And I plan to make it interesting for both newcomers like me that are attempting car
hacking for the first time. So the Chupacabra is easy enough to build and plug into your car and
start doing stuff. But it could be very useful for more experienced hackers as well, because
since it's a single board computer, you could easily extend it to different applications or
use cases that you might have when you're doing your hacking. So all the Chupacabra code is
available on GitHub. So if you're an expert, chances are that all you need to know from
this presentation is this URL. So you can take a look on the code. And also, on GitHub, I share
a link to a Hackster.io tutorial that I wrote with very detailed step-by-step instructions,
so you can build a Chupacabra device exactly to the one that we're going to cover today.
And I hope that I'm going to share the mistakes that I made when I was attempting to do it for
the first time. And hopefully, it will help others when trying to do that. And with a device
easy enough to build, potentially, you can engage more people on attempting car hacking and growing
the community. So this is the device. It's basically a BeagleBone, as you can see here,
with some add-ons. So basically, I connected a USB cellular modem here on the USB jack.
I connect a DC jack here, so I get power from the ODB2 port on my car. And of course, I will need
a ODB connector to connect it to my car. And here, this is the CAM port on the BeagleBone
Blue. So all you need to do is to connect a JSTSH cable here. And then on the back, you connect it
to your ODB2 extension cable. Of course, you can wire it directly to... this is the back
of the device. We can also see that I use a battery. It's completely optional, but you can
use it even if you're... let's say you were building a car tracking application. And even
after your car batteries die, using the battery, your BeagleBone will be still alive and you can
still track the GPS coordinates with this GPS module here and potentially recover your car,
if that is your goal. So I use a very simple material. So I use a plastic plate like this
to put all the pieces together. Some rubber bands, but you can build it differently. Again,
all the instructions are on the Hackster.io article. And all you need to do is to put all
those pieces together so you have a functioning BeagleBone to plug to your ODB2 port on your car.
And also, you don't need to add all those parts together. I would say if all you need to
want to do is to just use a socket cam to exchange some cam messages with your car,
all you need to do is, of course, the BeagleBone Blue and a connector like this.
The name is a JSTSH connector. You connect it to one end of the BeagleBone and then
you can use solid hookup wires like this to connect it to this connector. And then
the other end directly to the ODB ports to your car if you want to keep things simple. Or
you can just build it using the ODB2 extension like this. Okay, so what does...
once you build your device, what does it do? So the idea here is to create a connection
between your CAN bus from inside your vehicle to the outside world. So from my perspective,
I can assume that most of the manufacturers create a threat modeling of their CAN bus system,
assuming that they are going to be isolated from the outside world. So of course, you would need
physical access to the car. But the idea here is to create an easy way of so you can exfiltrate
data from your car to the CAN bus. And the BeagleBone Blue makes it very convenient because
it's really easy to connect the GPS module that I showed before. And on the top of that,
it already has the embedded Wi-Fi access point and interface. So you can connect it directly
or connect it to your Wi-Fi network and access the internet. Or as I showed, you could use
a cellular modem like this to the USB port. And even if your car drives away and goes out of
the range of your Wi-Fi network, you still have communication to your vehicle and you would be
able to potentially send CAN messages to your car remotely. And one other cool thing about
doing it using a single board computer, you can easily expand it to some other different
applications. You can, for instance, create a geofence application. You want to maybe disable
your car if it goes too far. Or maybe you want to track it back. You can, for instance,
plug USB cameras and microphones. So if you want to capture audio. You can even use servos because
the BeagleBone Blue is a robotic... it's intended for robotic applications. So you can plug servos
here on those rails and perform some physical actions inside your car if you need it. You can
even try to robotify your car, let's put it that way. So this is what it... oops, sorry. This is
what it does. And once we run the Chupacabra inside your car, you're going to see on your
local terminal, I'm assuming you SSH to your BeagleBone, and you're going to see once you run
the Python script, you're going to see on your terminal what we have on the left. By default,
it will start monitoring your vehicle speed from the ODB2 port, the RPM, and the temperature.
And we'll also start sending all that information along with the GPS coordinates
to a Flask application running on AWS. The source code for the Flask application is also available
on the GitHub repo. So as I mentioned, by default, it will send only vehicle speeds,
temperature, and RPM. But if you want to use other ODB2 PID from your ODB2 port,
I created this convenient CSV file that if on the left column here, on the Enable Disabled
column, you just set 0 and 1 to the ODB2 PIDs that you want to enable or disable. So as you
can see here, this is one example. And all you need to do is customize it, and then you should
be able to monitor other information from the ODB2 port other than the speed, temperature,
and RPM. Okay, so how do you connect a BeagleBone to your ODB2 port? As I mentioned before,
you have the CAN connector here. You use the JST connector to plug it here. And then all you need
to do is to go to the female ODB2 port on your car and connect the CAN high and CAN low pins to
the pin 6 and 14 respectively on your ODB2 port on your car. And it brings me to the first mistake
I made. Keep in mind that this schematic, these pin numbers, are related to the female ODB2 port.
So initially, what I tried to do, as you can see here on this picture, I connected the JST
connector to the BeagleBone, and I used some hookup cables, and I cut a cable like this,
and for convenience, I would connect my BeagleBone hookup wires to a male ODB2 connector.
And keep in mind, if you do that, the numbers 1 to 8 will be mirrored because the female connects
front to front, the male and female connects like this. So the eighth pin here on the female
is actually the third pin here on the male. So keep those things in mind. This is a mistake that
I made, and I believe I want to just prevent you from wasting time troubleshooting those things.
And other mistakes that I did, and it could potentially help you when attempting this.
So use a multimeter is your friend. I would be able to easily catch up that mistake if you use
a multimeter and make sure you have some voltage on the pins that you want to tap in. And by the
way, on my car, the pins 3 and 11 that I connected by mistake initially, they don't have any voltage
there because they don't do anything. So with a multimeter, you would be able to catch issues
like this. Another mistake that I did was when I saw CAN dump, I assume a TCP dump. So
it's a sniffer, right? Sniffing traffic, so they should be similar. They are in some extent.
However, CAN bus is not Ethernet. You need at minimum two nodes on the bus so you can
potentially transmit and sniff some traffic. So initially, I enabled the CAN interface on my
BeagleBone. I started CAN dump on one terminal. I started doing CAN send on the other. And I didn't
see anything. And I didn't know why. The reason is because you need two nodes so you have at
minimum, so you have a CAN. But even before doing that, what I would recommend, play a little bit
with vCAN first. It's very easy to install vCAN on a Ubuntu Linux, for instance, and then you can
do the CAN send and CAN dump and monitor the messages and understand how it works before
even attempting to a real physical CAN. Another common issue that I had to face is you have to
know the bitrate. So if you want a CAN bus to work properly. And for my vehicle, by default, it
uses 500k baud rate. And yours might be different. So keep that in mind. So this is a suggestion.
So if you want to make sure your Chupacabra is working and you understand a little bit how CAN
works, create a CAN bus breadboard like this. It's really simple. You just use some
jump wires to hook your JST connectors to a breadboard. The only thing you need to know is
I'm using blue for CAN high here and white for CAN low. The only thing that you need to know is you
need a 120 ohms resistor at each end connecting the CAN high and CAN low
rails. It's going to be very helpful because then you can plug two BeagleBones, for instance,
and exchange some CAN messages between each other with CAN dump. Another useful thing
that I would recommend, not necessarily, but it might be helpful, is to cut a extension cable
like this. So if things are not working properly, for instance, I bought a very simple device like
this. It's a scan tool that supports scan ODB2. It's very cheap. And it was working. And I didn't
know why my BeagleBone wasn't working properly. So I created this. I cut this cable and hooked
one through 16, all the pins on my breadboard rails. And then I was able to connect it,
this device to this extension and the extension to the car. And then here on the picture with
the zoom, I could hook the JST connector to this breadboard and then start CAN dump there.
And for instance, use this device to retrieve the VIN number. And then I would see the exactly
messages that it was exchanging and understand what could be wrong with my BeagleBone that I
wasn't getting right. And in my case, what I didn't know at that time was this. I was expecting
to plug the BeagleBone to the ODB2 port, start CAN dump, and I was expecting to see a lot of
traffic there. But what I noticed is that my ODB2 port was silent. It was just listening to...
because it was segmented to the other CAN buses on the car. So it was just waiting for
some specific CAN messages to reply to it. And this is exactly what happened. This is
when I sniffed the comments from this device here, that was the CAN message I saw. And then
using the CAN dump on the CAN0 from the BeagleBone, I saw the request and the response
with my VIN number there. All right. So let's say you're confident enough, you understand how to
play with CAN bus using a BeagleBone. And now you wanna... and you built your Chupacabra device,
you wanna run it on your vehicle. So my suggestion would be play a little bit first
with a socket CAN and make sure everything is working. So just try different bit rates,
for instance, here on this, I'm trying the 500k, which is what worked for my car.
Enable the CAN0 interface and open another terminal with CAN dump. And on a different
terminal, you send the request VIN message. And by the way, all those messages, including
this request VIN, is available on the CSV worksheet that I have available on GitHub.
So you can try different stuff there. Once you know, once you see the request and the response,
you know that your Chupacabra and your BeagleBone is able to properly use socket CAN in your car.
And then if you want to test the GPS module, you would recommend using this TIO command.
By default, it uses the serial port TTY02 with baud rate 4800. This is a specific one that I
use it. All the parts are listed on the Hackster.io article, and I point to vendors that supply them.
So, and when you start the TIO command, you're going to see a lot of GPS sentences
flowing around. And wait a little bit for the module to find a GPS satellite.
And once you get some GPRMC sentences, similar to this one that I have on screen,
you can use an online decoder, just like this RL.SC. It's really cool, by the way.
You just need to provide the GPRMC and it will plot your exact locations on a map.
For cellular connection, so for connection, all you need to do is to make sure you have
internet connection from your BeagleBone, either by using a Wi-Fi network or a cellular LTE modem,
which is what I did. I use the hologram vendor because it's very Python friendly.
The documentation is really good, so it was really easy to install it and get it working on my
BeagleBone. Again, all the documentation is available on my Hackster.io article.
And at the end of the day, all you need to do is to ping a public server on the internet and make
sure you have internet connection so the data that your Chupacabra is capturing can be exfiltrated
to a server. And once you know everything is working properly, it is time for you to clone
the repo. Go to the Chupacabra folder and play around a little bit with the CSV files and enable
and disable the ODB2 PIDs that you are interested in. And then just run the Python script. And by
the way, it's all Python 3 basic. I don't think it works with Python 2. And if everything goes
well, you're going to see all the ODB2 PIDs that you enabled being displayed on the screen.
And also, if you have an internet connection, by default, it's going to be exfiltrated to this
public AWS Flask app that I had running. And by default, the script points to that. If you want
to create your own, just use the code available on this server or on this GitHub repo. And then
you can customize it, run in a different cloud environment and customize it any way you want.
Okay, let me run a quick demo video here so we have an idea how the Chupacabra works.
So, this is the device. I'm going to plug into the ODB2 port from my car. The engine is on,
already running. Yeah, so I'm just showing where is the ODB2 port on my vehicle. It's usually
some close to the steering wheel. And then I'm going to put it on the dashboard because I'm
going to monitor it from outside the vehicle. This is something that is really convenient
compared to the other solutions. Because you have the embedded access, Wi-Fi access point on the
vehicle, you can just connect to it and run Chupacabra from there. This is what you would
get on your terminal if everything goes well. And then you can monitor your car. Of course,
if it goes out of range, it will want to work. But you can monitor your ODB2 data
from outside the car. Now, I have a test from inside the car. Here is I'm running
the same test from inside the car. But the cool thing here is I'm going, I perform a lap around
the course, and I'm monitoring the GPS data. So, it's exfiltrating using the cellular network to
AWS server that I had running, right? And you're going to freeze the video exactly
where the coordinates was exfiltrated. Then when I got home, I just visited the public
AWS Flask application, and I saw all the GPRMC sentences available there, and I could plot them
on the map. So, if I was away from the vehicle, I would be able to track it wherever it was.
And if you plot all the, and it will, GPS will also give you the speed. And if you plot all the
coordinates that are available in the application, you would have an idea from where the vehicle was
traveling. So, I performed a course around a few blocks, and this is what I show here.
All right. So, this is how the device works, right? So, it is able to exfiltrate
ODB2 and GPS data. But what's next? And this is a currently work. I have only preliminary results,
but probably the next thing that you want to do is to go beyond of the ODB2 CAN bus,
and actually tap into a real CAN bus for your vehicle. And you can do it using the exactly
same device. So, what I've been doing so far, so rather than reverse engineering every wire inside
and disassembling my dashboard, that would be insane hard work to do, you can alternatively
go to your dealership and get a book like this, a supplemental, electric supplemental manual,
and it will give you a lot of detailed information about all the cables, where all the
electronic components from your vehicles are located, and the connections between them.
So, for instance, really close to my steering wheel on my vehicle, I have this ETAC ECU
that is also located pretty close to the ODB2 connector. So, I thought, okay, let me connect
those two CAN buses that are segmented from my vehicle, and then I can monitor everything.
And that was my goal. So, knowing where the ECU is, it's pretty, helps a lot.
And here is a picture of the vehicle. So, to get physical access to that specific ECU,
all we needed to do was to remove a couple of plastic covers from my vehicle.
And that was it. I could see the ECU from the bottom of the driving seat.
And also, the electronic supplemental will give you detailed information about the ECUs on your
car. So, for this one specifically, if you look to the picture on the left, on the bottom, I have
this C411 connector. And if you go deep on the manual, you're going to notice, then on the
diagram on the right, on the top, you have, you know, you would know that the C411 connector
is actually connected to a CAN drive. And the pins eight and nine are connected respectively
to CAN low and high to another component they call ECM on this vehicle. And not only that,
you know, you have the wiring colors used for those cables. So, I know that the CAN high
on pin nine is BR, which is brown cable, and the CAN low on pin eight is Y, a yellow cable.
So, looking carefully inside my dashboard, I was able to find this ETOX ECU with this specific
connector. And you can see the brown and yellow cable on pins eight and nine. And also close to
the arrow that I put, you can see the ODB2 port on the top. So, again, so what I needed to do,
all I needed to do is to use a hookup wire like this. This is not the actual CAN cable. It's just
a hookup wire that I manually twisted myself. Oh, this is another common mistake. Make sure
you either use a real CAN cable, or if you're using hookup wires like me, make sure they are
not too long, because they might not function well. And you can try to manually twist them to
mimic what a real CAN cable would, the physical properties of a real CAN cable.
But back to this, be aware that by bridging those segmented CAN buses on your car,
you may, you might damage your electronic components on your car,
and incur safety issues for you and for others. So be sure you know what you're doing, and be
careful. Okay, so once I got a good physical connection with those pins, I used a multimeter
to make sure I had good wiring. On this specific ACU, when I have the ignition off, it gives me
1.13 volts, but when I turn the ignition on, I get the expected 2.5 volts. Another mistake that I
did, I recommend turning on the engine, because you would very quickly kill your battery. I did
that, don't make the mistakes that I did. Okay, so now that I know with the multimeter that I have
a good physical connection with the ACU, I connected the other end of the hookup wires
directly to the back of the BeagleBone with the other, with the existing CAN high and CAN low
cables, wires that I had to the ODB2. And that's all I needed to do. And then by doing that,
as opposed to the initial result that I had only with the CAN, the ODB2 CAN, now if I run
CAN dump from the Chupacabra device, now I see a lot of traffic between this ETACC ACU
that I connected and the other electronic device ECM from my vehicle. I can tell,
and exchange information through the CAN bus. All right, so that's where I got so far.
What I'm planning to do, that's what I'm trying to do right now, is to reverse engineering some
of those messages. For instance, I'm trying to use a CAN dump to write, to save the traffic,
to dump the traffic to a local file, do something on the vehicle, for instance,
opening and closing the power window, and then using CAN player, try to replay the traffic,
and try to open and close the window just by replaying the messages. The problem is,
I wasn't so successful doing that so far. And every time I try that, I get a beautiful and
shining service engine light on my vehicle, and I might break my vehicle at some point.
And not only that, maybe I'm not even connected to the right CAN bus that I should be tapping
into if I want to open and close the window. So I have a lot of work to do to do that yet.
But what tells me I'm on the right path is, when I do CAN sniffer, unfortunately,
because it's a very busy CAN bus, it's still very polluted to me to tell exactly what's going on
when I open and close the window. But I see something go, some action, there are some
different, some new messages showing up when I'm doing those actions. So I still don't know
what's going on, but that's what I'm trying to do. Get some interesting CAN messages so I can
replay them later. So since I wasn't able to get, for instance, the opening and closing window yet,
let's assume the message that I want to do remote execution on my car is the retrieve
VIN message, right? Which is the one I'm highlighting here with the CAN send command.
So my goal is to create a kind of RPC where I have a new endpoint on the
on the Flask application running on the cloud that I would be able to send any CAN message
that I wanted to be executed remotely on the car. Of course, I had to URL encode the
hashtag here so I could post this URL to my Flask application and get it available.
And in order to do that, here's an oversimplified version of the changes that
would be needed on the current Chupacabra implementation. And by the way, once I get it
working, I will update the code and make it available. But if community guys, if you feel
free to fork the code and or even submit pull requests, I would be very excited if people
would start doing that, actually. But the idea here is to do what I showed before,
submitting messages remotely to create this kind of reverse HTTP command and control,
I would create on the server application a queue into new endpoints, a GET and POST endpoint on
this RPC endpoint. And whenever you send a GET a POST message with the CAN message,
it would add to the queue. And then on the GET request, you would pop a message,
CAN message from the queue and then you execute it on the client. So the changes on the client,
the Chupacabra.py, would be basically hitting the RPC flask application with the GET request.
It would give you a keyword CAN message that you submitted, and then it would send it to the bus
and execute on your car. Of course, this is a very oversimplified version. Just to illustrate,
you would need to add some error catches here, some logic, and even you would need to parse
the JSON data to put your CAN message together. But that's the idea. So this is one suggestion,
this is what I'm going for. But again, it's a Python code on an open source hardware platform.
Feel free to do whatever you want to do with it. And the takeaways here from this presentation
is, again, I want to build an open source hardware and software platform that could be
useful for newcomers that are attempting this for the first time, but also for more experienced
guys that see a need for a single board computer running on a car where they could remotely
do some stuff there. Currently, the code that I have on GitHub only do GPS and ODB2 CAN
messages, data exfiltration. But as I just showed, I plan to expand it in the future.
Yeah, so let's use it, guys. I'm open to feedback. Let's grow the community.
And let's have fun. Oh, one thing I would like to thank my friend Robert from Autobahn AI.
He helped me a lot with all his knowledge on Automagic CAN with issues that I have,
troubleshooting things and attempt different approaches. So thank you, Robert. It was really
appreciated. And that's all I have, guys. So again, all the information that you need to
build the Chupacabra is available on GitHub. And if you have any questions, suggestions,
hit me on social media. I would be very happy to see people using the device. And
if people have the same issue that I have trying to buy other open source tools because they were
sold out, let's make BeagleBone sold out. I'm going to measure the success of this presentation
based on whether or not we can sold out all the BeagleBone Blues next year because everybody
will be trying to hack their cards using this open source platform. So again, thank you, guys.
I'm open for questions. Reach out to me either on social media or on the Q&A session.