Twitch, please feel free to join the Discord.
Https://discord.gg, Defcon, and join the conversation.
All right, without further ado, let's discuss ClusterFuzz.
Can, so you could potentially hack this vehicle.
Please don't. It's great fun when it's driving. It's not fun when it's not.
Um, a little disclaimer down the bottom there.
Car hacking is done at your own risk.
If you brick your own car, please do not blame me or the Car Hacking Village.
So, on to my car hacking credentials.
In 2007, I hacked my own vehicle, found an issue in the Hedge Unit,
in which you could get access to personal information inside the Hedge Unit quite easily.
I disclosed that information to the manufacturer itself.
I then did a talk about it at Defcon Group in London, DC4420,
B-side London Rookie Track, and Defcon 26 Car Hacking Village.
In 2018, I was also invited to be one of 12 security researchers
to go to Bug Crowd's live car hacking event.
I then returned in 2019 to be one of 20 security researchers to go to
the same event for the same manufacturer at their factory over in the US.
Last year at Defcon 27, I was part of a Bug Crowd
car hacking panel with Cyber Giddens and Spectres hosted by Chloe.
I was also asked last year to go to the Auto Isaac Summit in Texas at Toyota's plant,
where me and a couple of others were part of a car hacking vulnerability disclosure
policy panel for HackerOne.
I also now, for my sins, run the Car Hacking Village in the UK.
I have my car in the box, PD0, which is all the electronics from a Peugeot 208 in a box,
in quite a portable form. Not as portable as being globally movable, but
last year I did about 13 events, one of which was in Europe.
I have been asked to take it all the way around the world, India, Australia, Brazil, America,
Egypt. The only continent I don't think I've been asked to go to is Antarctica.
This year I was meant to do
beside Stuttgart, beside Brussels, but things have happened, as we know,
and there's been quite a few virtual conferences,
which also means my car in the box will be available for the virtual.carhackingvillage.com
CTF. If you look for PD0, there is two Raspberry Pis attached,
one on two of the buses, one on the third. You can then basically hack that vehicle
in a safe manner. You won't break anything really, unless you try really, really hard.
It's quite good that it's actually going to be used at DEF CON
without me leaving my own home. I will miss the people. However, travel is not really fun at the
moment. So there are some hints and tips for the CTF for the Carhacking Village 101 in this
presentation and the fuzzing that I will show you. You may want to pause and rewind some of this
at a later time, but I'm not going to give you any more hints than that.
So where do we start? The assumption is you all know what CAN is. Controller Area Network.
It's a differential signalling communication system that allows lots of devices on a single
bus to communicate, and has an arbitration system to allow the most important message to go out
first. You don't really need to know much more about that, but if you want to have a read
on Carhacker's Handbook by Craig Smith, it is a good read. So first things first,
you need a cheap CAN adapter. I will go into those in a second. Once you have a cheap CAN adapter,
you could try reading your own car. Be very careful if you do. I plugged in one of my own
home-built CAN adapters into my 2017 Jaguar XE and managed to make the car lose its gearbox.
Yeah, that was one of those moments where I was thinking, oops, I probably shouldn't have done
that, and I was thinking pound signs. I did manage to get it back eventually, but it involves
disconnecting the power for a considerable length of time, about 20 minutes. Plugging it back in,
all the messages were then reset. However, the next morning when I went to drive it,
it took about three and a half weeks to learn how to change gear again, because it had the
automatic ZF gearbox as used in a lot of automatic vehicles these days. So slightly easier
and slightly less dangerous is testing something that you can actually use outside of the vehicle.
Do not test on your own vehicle, because if you break your own car and can't get Johnny to school
in the morning, your missus will kill you and you will be doing the walk of shame in the rain.
Not a good idea. So I'm going to show you an instrument cluster that I have. I will show you
how to interpret a wiring diagram, what then is required for power supply, and then some tools
that you can use. And I will show you some fuzzing, and you can see some results on the screen
of what's actually happening. So first things first is the NanoCan adapter. I use this device
as the PCB itself as my business card. I started doing it in early 2018 when I first started the
Car Hacking Village, in that it was something I could give away at the conference to say,
here's a way to start doing car hacking. All you need is five, ten dollars worth of components,
which include an Arduino Nano,
an MCP2515 module, a bit of wire, the PCB, and the OBD2 plug as shown there.
What you would then do is solder it all together as shown on the GitHub
instructions. You then can program the Arduino Nano with a basic sketch that reads all messages,
and you get an output like this. You can reprogram it with other sketches that allow you to
read and write data, but unless you know what you're doing, have a play with something first
listening and not sending. Here is the same output but using Putty to interpret the data
instead of the Arduino IDE. Again, if anyone wants one of these PCBs, hit me up on Slack or on
Twitter or email me if you want to. I will put it in the post. If you're a distance away it might
cost you the postage, which isn't that expensive. However, at the moment postage around the world
is getting silly because of COVID costing extra money, but hit me up anyway. I will be online
after this talk on the Discord channels for questions etc. Here's a second one of my
adapters that I built. That is a PoundCoin 4Scale. That little device there is based on an ATTiny
1614 processor which costs about 50 pence or about 50 cents, maybe a little bit less if you buy
quantity. It uses the same MCP2515 CAN controller and a SN65HVD230 CAN transceiver from Texas
Instruments. The other two are from Microchip. This will allow you to build a CAN device for
probably less than three dollars for all the components there. However, you need some extra
parts to actually connect it to the vehicle if you want to connect it to the vehicle.
There are two versions of this board. The red board is the main brains. The other board behind
it, the little blue board you can see there, has the power supply and the connectivity onto the
CAN bus. This one here is for nefarious purposes in that you can program the board at the top to
listen for certain messages. When it sees a certain message it can then start sending
messages back onto the bus. This is powered from the CAN bus port. The blue PCB in the middle has
the power supply that brings it down from 12 volts to 3.3 and the plug at the back will then go into
the OBD2 port and allow you to do various things. Be careful when you're doing this, again you could
break things unless you know what you're doing. The other version of the TinyCAN adapter is here.
This is a green board in the middle. This green board has an extra connector for a USB to TTL
adapter. This adapter allows you to connect it to a Linux system using SL-CAN, so serial line CAN
and socket CAN and CAN utils. You can then send messages from the Linux system
using CAN utils which I will go into in a second. This again, all of the hardware there is probably
about seven dollars worth of hardware. At some point in the future I will put this up on GitHub
as another repository. If you want me to, just pester me, I'll do it quicker.
Another cheaper CAN adapter you can use if you've got a Raspberry Pi lying around doing not a lot.
Here is the PiCAN for Raspberry Pi. This is made by SK Pang in the UK.
It uses the similar Microchip CAN transceiver and CAN controller, however it's got a DB9 adapter
to connect it to the CAN OBD2 port on the vehicle. You can also use the screw terminals.
One little hint is just behind the DB9 connector are some solder pads. You have to solder them in
such a way that it uses the correct pins, because there are two different versions of the same
cable that may or may not work. It took me a while to work that one out, but
this will cost you probably about 35 to 40 dollars, 35 to 40 UK pounds. The website there
is in the UK, but I believe he sells them in the US as well through other outlets.
Here again is a screenshot of CANdump showing CAN messages from the CAN bus.
And finally out of the cheaper end of the CAN adapters is the CANtact,
which is by Eric Evencheck, linked down the bottom there. This I believe is based on the STM32
and inbuilt CAN controller and CAN transceiver. This has got the same 9-pin adapter on the end,
a large USB-B connector. These retail I believe around 75 dollars, which is okay if you're in
America, but if you're in the UK you get stuck with customs and VAT. The jumpers in the middle
there are for changing which pins go to where, slightly similar to the PiCan. He's currently
on Kickstarter though doing the CANtact Pro, which uses a slightly different processor
that gives you two isolated CAN FD channels. Worth a look if you're interested in backing
a Kickstarter. I might end up backing it myself if I haven't already done by then,
by the time this goes out. So on to the instrument cluster itself. Here is the instrument
cluster. It came from a Citroën DS3. They are not sold in the US. None of Citroën's group
vehicles are sold in the US. This cost me about £30, which is probably about 25-ish dollars.
You can get these from eBay, Scrapyard yourself, Vehicle Dismantler, Recycler etc.
This one has an OBD2 port underneath in the middle there. This is because I use it for
training purposes. So this is a very similar instrument cluster with regard to messages
as my car in the box. A little hint here, listen up. The car in the box is based on a Peugeot 208,
which is a similar sized vehicle to a DS3. However, it's just got a slightly different
cluster. The message structures are very similar, if not the same.
Here's the back of the instrument cluster. As you can see, there's some screw holes which
hold it into the vehicle. One of which screw holes is blocked up with a barrel jack socket.
You've then got a 18-pin connector for the device. If you are purchasing it from a
vehicle recycler or scrapyard, see if you can get the cable as well because it's always easier
to attach something to a cable that goes in specifically to that device, as opposed to
DuPont cables and trying to select the right cable.
Just zoom in on the plug itself. It's 18 pins. Pin 1 is bottom right, pin 9 is top right,
pin 10 is bottom left, pin 18 is top left, and as you can see there, pin 8 is CAN HIGH,
pin 9 is CAN LOW, pin 15 is 12V, and pin 18 is GROUND. Some of the other pins do things,
some of the other pins do not. But be careful because you may break things if you send
the wrong voltage up the wrong pin. So how do you work out what pin does what? You have to get the
wiring diagram. This is the wiring diagram for the DS3 for the head unit and infotainment system.
If you zoom in right in the middle of there, there is the device that is the instrument cluster.
As you can see it has a little microprocessor and a couple of dials that basically shows you
what's inside it. It means it's got some brains and it is a cluster. There is a
key that tells you 0004 is an instrument cluster, however it might be called something else
as in the language that it was originally written in, say in French. Looking at the wiring it says
18V which means it's 18 pins. BA means the color of the plug which I believe is white. I can't
remember. I may be wrong but pin 18 or green is ground. Pin yellow is switched live. Pins 8 and
9 are CAN HIGH and CAN LOW. It's sort of potluck on that one. You might get it right first time,
you might not. But if you don't get any messages back out of the device, swap them over and see
what happens. So power supply. This power supply here came from Amazon. It's a USB to 12V
barrel jack. So USB at 5V at one end, it's got a boost converter in the middle.
That then can step it up to the 12V that is required for the cluster.
Technically you need 13 point something volts if it was running with the alternator at full
chat, but 12V should be enough. You could potentially use an ATX power supply,
but I think it's overkill to have something that could potentially put 40 amps through it.
So this is slightly safer. So on to the Linux software. When using CAN under Linux you need
the package that is called CANutils. If you're running on a Raspberry Pi,
install CANutils. It will then install all these components here.
CANdump, it will basically output all CAN messages from the bus that is currently
coming off the CAN bus. CANsniffer shows all messages that are changing on the bus.
It does not show by default any message that is static. It will remove them from the screen,
only shows you stuff that's changing. You can then make it highlight things to show
when things change and when things don't. You can make it show all messages,
but it's just one of the options. CANsend allows sending of a single CAN message.
If you're very good at shell scripting you may be able to use that to send multiple
messages in a for loop. It's not that easy to do unless you're really shithot
at doing bash scripts. CANgen is a slightly better version of the same thing,
in that it can generate messages either randomly or with specified logic.
Finally, the last part is CANplayer. Basically, this will replay messages that you have logged
to a text file using CANdump. And then you can then record something on a vehicle,
bring it back to your cluster, and then replay it and see what happens.
And then by selectively grepping those messages, you could replay it and find out which message
does the speed, which message does whatever, or just fuzz it and see what happens.
So, shall we start fuzzing?
Good morning, good afternoon, good evening, depending on which time zone you're in.
I'm Ian Tabor, or atminternet. This is my talk about Car Hacking Village.
Sorry, Ian, we accidentally restarted.
First things first, who am I? You could sound the ultimate car hacker.
I built this kit car 15 years ago now.
But I think we can probably take questions, yeah?
It was just about finished. You were working on the fuzzing of
and showing the different possibilities to fuzz the...
Okay.
So, if you do have questions to MintyNed or to Ian, please go ahead,
write them in the text, the support, the CHV 101 support text group, and we can answer them.
Ian, can you describe to us a little bit about what you built up there with your test rig?
Got a lot of wiring there. And it actually thinks it's a running vehicle.
So, not only does the lights work, and there's an indicator to show you like something on and off,
etc. The engine thinks it's rotating by the Arduino attached to the crank and cam sensors.
And that is basically spoofing the correct waveform that is used by the crank and cam
sensors to work out where the engine is in the firing order.
And then an indicator showing the injectors and the fuel being fired.
So, if you were here in person, you would actually be able to see the lights flashing
to show spark going off. There are some other simulators being used as well.
So, there's a couple of potentiometers for the fuel gauge and the water temperature gauge.
So, if you twist the fuel gauge potentiometer, you can make the fuel gauge go up and down.
But it's still connected to where the fuel gauge would normally be.
There's also a O2 simulator, which is required to get rid of one of those annoying
engine warning lights. But that uses a 555 timer to generate an AC wave on a DC offset.
And basically, it just varies between mean, rich, mean, rich, mean, rich,
for both the pre and post. So, that's that.
The hardest one to actually simulate is actually to get the car to think it was moving.
So, originally, I tried to do it using an Arduino or something with a similar
microcontroller. But I actually had to do it using a motor and a plastic disc.
And it's actually a plastic disc with a reluctor ring that would normally be on your
sub-axle attached to your wheel. So, there is a single motor with a reluctor ring attached to
a plastic. Around that motor is four wheel speed sensors. And then there is an Arduino
attached to that motor using PWM to vary the speed of that motor, and then thus vary the
speed of the wheels that it thinks are rotating. There is then some feedback to that same circuitry
that reads the speed of the can bus to see how fast it thinks it's going,
try and match one to the other. But I was playing around with it earlier to try and
fix it to make it slightly more accurate. And I worked with the encoder on the Arduino.
So, I'm just really writing it as we speak. But I can get it to go full tilt, which means it goes
at 181 miles an hour. And if you've ever seen a Project 208, I wouldn't want to do 181 now.
I think it wrote itself a bit fast, but yeah. Disco mode is quite trippy.
I have a couple of my little nano cans, or tiny cans, configured so that it sends it
into Disco mode, makes all the dials go absolutely nuts. It's always good to show someone
what you can do with CAN by just sending the right messages, but slightly faster,
you would actually want to send them. My car in a box probably cost me about £2,000 to build.
But I could have probably done it a bit cheaper by buying a whole car and saving the bits I didn't
actually use. But then you've got the whole hassle of disposing of parts off the interior
and body shells. I may be making another one again soon. But that's for my work.
Which car are you thinking about doing next?
I don't know, it depends on the budget. They won't tell me the budget yet.
So if you can lend me one, I don't mind. I'll build one for you if you like.
Well, I would really love for you to do it for me, actually.
But I think this is something we'll have to talk about offline, huh?
Yep. All right. Any more questions? Actually, I don't see so many questions in the chats.
What's that? Apologies for the audio. I will be around tomorrow to talk over it.
Yeah, it's pretty strange what happened. But it's, you know, this is part of the fun with
our first virtual conference. So totally understandable. We'll try to fix it for next
time. Ian, just quickly, because we're all beginners in this chat, in this talk,
what type of tools or what can you tell us a little bit more about where you learn,
which hardware you're using, which software you're using, what tools would you recommend?
The stuff I've already mentioned in the talk, I've previously used on numerous occasions.
There are the microcontrollers that have built-in fan controllers in them. There are also
software for those on GitHub as well. And quite funny, when I was at the
Bug Bash in 2018, we found a major vulnerability with the hardware that cost me about $30
worth of hardware. And we got a payout of five figures, because we were just a bit cheeky and
found somewhere that the manufacturer hadn't thought of which software to actually break
into the vehicle from. I won't tell you which vehicle, I won't tell you exactly how I broke
into the vehicle. But yeah, you can buy very expensive things, like vehicles by value counting,
things like that. But I would start at the beginning with something in the, like,
nano-fan or something like that, just to see what you want to do, whether you can actually
get used to it more than anything. Because there's no point in spending a few hundred dollars on
hardware, and then you do it three times, and then you leave it and go, oh no, you've wasted
your money. You may be able to resell it, you may not. But if you build something yourself,
for five, ten dollars, it's no big deal if you never actually use it again.
So, granted, yes, if I worked in one of those companies and I got them for free, I would say,
buy one of those really expensive ones. But I don't, and I didn't, and I've managed to get
through quite well where I am at the moment. Okay, well, Ian, thank you so much for the
information, the great talk and presentation as well. I think we don't have any further questions,
so unless you have something you would like to say to the audience, I think we can close out for
today. If anyone needs any help with any of the challenges related to PvZero, just hit me up on
Discord. I'm at Minternet on Twitter. I'm here to help. If you want me to make the car do other
things so you can see what's going on, I can interact with it, make it go faster or slower,
turn lights on, turn lights off, so you can see what's going on. I don't mind.
If you don't do it, I'll just be sat here trying to rewrite that bit of software,
getting a little more depressed. But yes, it's very strange being in Vegas time but being in London.
And you're talking about the CTF or the virtual car hacking, of course, right?
Yeah.
Great. Well, Ian, thank you so much for the great talk. I'm sure everybody learned a lot.
We have the next talk coming up in about 20 minutes. We're going to be talking about Bluetooth
security and automotive with Kamil. So if you guys want to come learn about what's going on
in Bluetooth security, please come join us here in 20 minutes. We'll be right back with Kamil,
and he's going to talk about the Bluetooth interfaces of vehicles. All right. Thank you
very much, guys.