And OBD, what can we do with it?
So OBD-2 is a port that is usually located in the footwell of the driver's side of a car.
It's been mandated in cars since 1996.
OBD-2 standard itself defines both the electrical interface and messages.
Primarily the DTCs created to be used as a standard way for vehicles of any manufacturer to allow independent repair shops and dealers to test for emissions.
OBD-2 is a 16-pin connector port.
Although only 9 pins are mandated by the standard itself, most vehicles include an additional connectivity such as GM LAN or Chrysler CCD.
They are used at the dealership, for example, to update software on the ECUs, to perform additional software testing, or to troubleshoot problems specific to that vehicle's make and model.
Aftermarket OBD-2
At first, only standard OBD-2 connectors were able to read diagnostic information.
Manufacturers have been able to over the years reverse engineer the communication architectures to enhance their own offerings.
With the advent of inexpensive cellular, Wi-Fi, and Bluetooth components, aftermarket OBD-2 manufacturers have expanded their products to include entirely new classes of services, such as pay-by-the-mile insurance, vehicle use tracking, and commercial fleet management.
So what can we do with this?
Way more than transmitting DTC. CAN controls hundreds, if not thousands of sensors and ECUs that control everything from operating the vehicle, steering, accelerating, braking, all the way to infotainment and locking the doors.
All this information is being passed over the CAN bus.
The CAN bus is nothing more than a TCP-based packet switching network.
This is the same stuff that you see on your day-to-day jobs and most organizations' IT infrastructure.
The CAN protocol sends all this data to all the nodes on each giving bus, and each CAN frame includes a destination address.
How do we attack it?
OBD-2 aftermarket devices can potentially retrieve CAN traffic from outside of the vehicle from something like a Wi-Fi connectivity.
And pass it through unfiltered internal CAN bus through OBD-2 ports.
So nodes inside of the CAN network on the CAN bus are expected to ignore traffic that's not addressed to them.
But CAN frames don't have source addresses.
So there's no way for you to be able to tell legit data from spoof data.
This is where our journey begins as security researchers.
And for us to be able to go and continue to reverse engineer these protocols to understand exactly what's happening over these CAN buses.
For us to be able to use things such as OBD-2 potentially leveraging connectivity that's being built into the vehicles such as Wi-Fi or Bluetooth.
For us to be able to utilize those connectivities to leverage that to further attack.
Thank you. And if you have any questions, please don't hesitate to reach out.
My Twitter is Infinite.
And take care.