All right, so our next talk coming up
is about automotive ethernet fuzzing,
from purchasing ECU to some IP fuzzing.
Please help me welcome to our stage our next speaker.
Hello everyone, my name is Jong Hyuk Song,
who is the first author of this research.
The title of this talk is Automotive Ethernet Fuzzing,
from purchasing ECU to some IP fuzzing.
In this talk, I would like to describe
how to purchase automotive ECU,
how to set up them, and how to do some IP fuzzing.
So, who we are?
We are all, sorry,
we are all red team and blue team members in Autocrypt.
Autocrypt is a mobility security company,
and especially we focus on the automotive cybersecurity.
We have a conducting,
pentesting, and fuzzing testing
with automakers and tier suppliers.
Also, currently we are developing a fuzzer
for automotive-specific protocols,
such as CAN and automotive ethernet.
So in this talk, I would like to share tips,
know-how, and my experience,
how to do automotive ethernet fuzzing using your own ECU.
But you know, 20 minutes is not enough to talk the details,
so please don't hesitate to contact me.
So, this talk is trying to answer the following two questions.
First, how to set up test environment
with the real ECUs.
Second, how to do automotive ethernet fuzzing on the issue.
So, this talk will be a practical guide
to some IP fuzzing with the real issue.
I hope that it'll be useful for car hacking beginners.
So, let's talk about.
first, the advent of automotive Ethernet.
Recent vehicles are becoming more complex than smartphones,
so they are required higher data bandwidth
for various functions, such as ADAS
and infotainment system.
But CAN is not enough to handle it.
So, automakers have started to adapt automotive Ethernet.
After BMW released their cars with automotive Ethernet,
many automakers have released their car
supporting automotive Ethernet.
Let's take a look at the automotive Ethernet network layers.
Automotive Ethernet is based on TCP and UDP.
There are two main protocols in automotive Ethernet.
First one is 2IP.
It's a diagnostic protocol.
It's almost like UDS CAN.
Second one is 2IP, which will be covered in this talk.
It's a control communication protocol
between ECU, such as remote procedure controls
and event notification.
And actually there is one more, 2IP SD,
which is 2IP Service Discovery Protocol.
It's a service discovery protocol.
Using this protocol, ECU advertises their services,
and can get the information about services running
in other issue.
Sorry about bad condition.
So, why we do automotive Ethernet fuzzing?
As you know, automotive Ethernet has adapted recently.
So, automotive Ethernet has not yet been tested enough.
So, there is not much research about,
also there is not much research about it.
So, let's try some IP fuzzing with me.
you don't need to touch the likely path.
It will be fun.
Then should we buy a car?
Is it essential?
You know, it's expensive to buy a whole car
for every single test.
This is why we cannot try car hacking.
We cannot buy a car everytime whenever we want to test.
So, in this talk, we suggest that. Let's hack ECU first.
If you successfully successfully tested one PC сегодня
to find vulnerability in that issue,
maybe you can exploit a real car.
But how?
Buying a car is difficult, but buying an issue
and set up them is not also easy.
First, where can you buy the issue?
And which issue is proper for test?
Can you know the issue is supporting some IP or not?
If we know that, how to set up the issue?
How to connect and how to wire that with my PC?
In this talk, I'm going to tell you how to do that,
step by step.
First step is selecting issue.
Not all issue support automotive internet.
So we should buy an issue
that support automotive internet.
We can get this information in the wiring diagram
of the issue.
Second step is buying issue.
You can buy the used issue in eBay,
but we bought the issue from BMW official service center.
This is new one.
Third step is set up test environment.
In this step, we wire and connect between the issue.
We can connect between my laptop and issue
by referencing the diagram and pin map of the issue.
Fourth step is network configuration for some IP.
We should configure our laptop's network setting
to communicate with some IP services in the issue.
And next step is discovering some IP services.
We should find out the service ID and port number
of the some IP services running the issue.
After that, we can set up the issue.
And finally, we can do fuzzing.
Okay, let's talk about how to select issue first.
First, we should select issue.
In this research, we chose a head unit issue
of BMW iX model.
The reason why we select the head unit is
most head unit issue support automotive internet.
The reason why we chose BMW is
BMW is automotive internet industry leader.
As I said, BMW is the first automakers
to release a car with automotive internet.
Another reason why we chose BMW is
BMW provides their issue information
on technical information site.
So we can get the information about the issue
such as wiring diagram pin map on the TIS.
This is why we chose BMW.
So now we have to check the wire diagrams to find the issue.
We can find out whether head unit issue
really supports automotive internet.
These are some screenshots of the BMW TIS site.
Actually, this is the paid service,
so I should hide some parts of the screenshot.
Please understand that.
You can see the whole information on the TIS if you pay.
In this site, of course, there are lots of issue data,
so you can search the data by pin number
to find what you want.
So right figure shows, you can see the data.
It shows that we found the wiring diagram
of the head unit issue by searching.
Maybe you don't have a BMW car,
so maybe you don't have a VIN number,
but don't worry about that.
You can find the VIN number on Google.
So finally, we can get the wiring diagram in TIS.
You can see that there is internet line in the diagram.
So finally, we can be sure that this head unit issue
supports automotive internet.
So let's buy it.
In South Korea, some official BMW service center
sells issue, but I don't know the other country
service center also sell issue.
Anyway, we bought the new issue from service center.
We just called to the service center
and asked to buy the issue,
and we visited the service center to get the issue.
Tesla also sells issue, but you should install the issue
on your car in the service center.
It means you cannot bring out only the issue
to the out of the service center.
In Hyundai case, you can get Hyundai's issue
from the Hyundai Mobis center.
Of course, you don't have to buy the new issue always.
You can buy used issue from eBay.
If you search the issue on eBay,
maybe you can find lots of used issue,
but I cannot guarantee that the used issue works well.
So, let's go to the service center.
Also, it's difficult to find the latest model.
Okay, now we've got the issue.
Let's set up the test environment.
This is the overview of our test environment.
This is the issue.
There is no my mouse cursor.
Above there, there is issue.
And left side, there is my laptop.
And we connected the laptop and the issue
using the media converter.
The media converter is the essential device
for testing automotive Ethernet.
Automotive Ethernet is different from the standard Ethernet
used in the normal PC environment.
So, if we want to communicate with the issue
using automotive Ethernet, you should convert it.
The media converter can do that conversion.
And there should be power supply
to supply power to the issue.
This is the real photo of the previous overview.
And there is issue, and there is a laptop,
there is a media converter.
And actually, we also bought the display
because we expected to see something on the display,
but it was not that useful in this test.
Anyway,
there is a power supply to supply the power.
And, oh, sorry.
If you want to connect like this,
you will need a wiring diagram and pin map
to know which port in the issue.
And which port in the issue is for automotive Ethernet,
and which port is for power,
and which port is for display.
I'm gonna show in detail how each part was connected.
So, let's connect power first.
To connect power, you should find power pin, ground pin,
and the Ethernet wake-up pin in the pin-map.
If you find all of them in the pin-map,
you can match the battery with the real issue of pin.
Then you can connect them to power supply.
I cannot show you the real pin-map in this slide
because that's...
not free...
All right.
data. Anyway, then we connected the display by also referring pin map. Now let's turn
on. The BMW string showed up on the display. So we can know that we successfully supplied
power to each device. Now let's connect the ECU and the laptop to communicate automotive
internet. Also, you should check the pin map and find the automotive internet port. In
this case, the rightest port of the ECU is the internet port. So we connect it to the
media converter. Then we connect the media converter to the laptop. This media converter
has two internet ports, SFP port and RJ45 port. SFP port is used to exchange some IP
data between laptop and ECU.
RJ45 port is connecting control page of the media converter. Maybe each media converter
has different interface, so you should check the manual of your media converter.
Now connecting and wiring is finished, then we should configure our laptop's network settings
to communicate some IP service. Before that, I'm going to tell you virtual LAN, which is
VLAN.
.
Automotive internet uses VLAN to separate in-vehicle network logically, because they
want to isolate traffic from different domains. So anyway, if you want to communicate with
the ECU by automotive internet, you should know the VLAN ID of the ECU's network. The
VID is in the VLAN tag. There is one more feature in internet frame with the VLAN tag.
So to communicate automotive internet, you, we should find out the VID. In previous step,
we connected the ECU and the laptop so we can see the SOMIP packets by using wireshark.
.
You know, wireshark is amazing tool. There is already what we plug in in wireshark so
we can see the SOMIP packets very comfortably. As you can see, we can see the VID has been
in the packet, and of course you can know
the IP address of the issue.
One thing you need to be aware is some USB to Ethernet
adapter doesn't show VLAN ID.
I don't know why exactly.
Maybe some adapter, network adapter doesn't support VLAN.
Anyway, if you cannot see the VLAN ID,
it's a good idea to change to another adapter.
So now we can configure the network setting for laptop.
In Windows, you can find VLAN configuration
in Ethernet properties.
You should set packet priority and VLAN enable,
and insert the VLAN ID in the VLAN ID section.
You should set IP address,
which is in the same subnetwork of the issue.
Okay, now let's talk about how to discover
the some IP services.
Usually there are several some IP services
running in the issue,
and each service are running on the different ports
with different service ID.
So to��s some IP service,
we should know the port number and service ID.
There are two ways to get the port,
and service ID.
First one is checking offer message.
Usually, most issue periodically broadcast offer message
containing the service ID and port numbers.
This offer message is the one of the some IPSD message.
It's a kind of advertising message.
So we can note port and service ID from the offer message.
Second method is sending find message to the issue.
Find message is also one of the some IPSD message type.
If there is no offer message in the target issue,
you can use the find message.
If you send a find message to the issue
with all possible service ID,
the issue will respond with offer message
only for the available service IDs in the issue.
So from the response,
we can know the available service IDs and port in the issue.
Right figure show that one of the offer message,
as you can see, there are port number
and service ID in the offer message.
So now we are ready to pause.
This is a structural some IPSD packet
to generate pausing input, we should know about it.
First, there are service ID,
and method ID.
I recommend that you use the available service ID,
method ID in pausing data.
If pausing input contains unavailable service
or method ID, the input will be filtered.
An issue will return unavailable service
or unavailable method ID.
I already described how to find available service ID
in the previous slide.
You can find the available method ID using similar method.
And next, client ID and session ID
is not that important in my experience.
Also, protocol version and interface version
are fixed to always one.
You don't need to pausing them.
And there are several message types in some IP.
The message type of the pausing input
should be one of the values in this table, right table.
And last one is payload.
It's the most important.
Each some IP service have their own payload.
They load format.
So, mutating normal packet is the best strategy.
The way to get normal packet
is just connecting several issues.
If you can connect multiple issue
by automotive internalized,
they will exchange some IP packets.
Then you can get the normal packets
that can be used for seed of the pausing.
Then how to monitor the issue state?
How do we know whether the pause or pause?
How to find crash or issues?
We recommend the three method.
First one is return code.
In some IP message, there is return code.
You can guess the issue state,
but it's hard to know the detail information.
Second is checking response to the valid request.
After pausing input transmission,
you can send a valid message to the issue.
Then if there is no response from the issue,
we can guess that the some IP service is there.
Third method is checking periodic some IP SD message
from the issue.
If target issue broadcast some IP SD message periodically,
you can check whether the message is still transmitted
after pausing.
Also, how to implement some IP fuzzer?
Luckily, sorry, there are already some IP Python library
in SCAPI.
So you can easily implement some IP fuzzer using Python.
So we've, until now, we've tried fuzzing test
to the BMW head unit.
Actually, we tried to many OEMs.
And we still keep trying to for our strategies,
but we cannot find any issues from BMW yet.
But actually, we found some crashes from other OEMs issue.
I want to share it, but I cannot disclose it
because of NDA.
Please understand that.
The point of this talk is describing the method,
how to some IP fuzzing using your own issue,
not describing vulnerability that I found.
So anyway, I conclude my talk.
In this talk, I want to tell you two things.
First, you can do car hacking using ECU.
You don't need to buy a car.
I hope that you will try your car hacking
by buying and setting up ECUs.
Second, I introduced how to do fuzzing
on some IP services of the real issue.
I think fuzzing, automotive Ethernet,
has not been sufficiently studied.
It's early stage.
There is still much to fuzz.
So I recommend you guys to try test automotive Ethernet.
This talk can be a good guide.
In fact, recently, we are also trying to IP fuzzing.
I hope that you can share some results soon.
Okay, this is end of my talk.
Thank you very much.