first for us, we are going to do a presentation without slides.
neither our linux or windows laptop.
>So first let me tell
paper on this presentation.
As you see we are going to miss the
We already lost some time so we
won't miss any more detail.
Go
of information there.
So basically what was this talk
So basically we are releasing a tool to audit CAN
all kinds of devices, and we are
such a tool and what you can do with this tool.
Okay okay.
Um
come up with a, one particular fact.
When you want to edit a
either you reverse the whole protocol from scratch, need to
like for example http client do all most of the communications
a man in the middle configuration you listen to
communication then at the right moment you start blocking
replaying packets.
The very idea of this mitm approach we let
work, you don't need to reverse everything, and you start
trying to exploit vulnerabilities at the right
The very problem with the CAN network is its a serial
bus network, meaning that you
For example if you do this for a web
application you simply setup
kind of tool, you are in fact intercepting all information,
With CAN serial bus you cannot unless
you physically cut the bus or
you plug out on particular device, the one device that you
And again you build a CAN bus just for this
device and you put yourself in
you start forwarding packets from these two buses then when
its a right match you start modifying packets.
>>So what was
were other tools to work with CAN.
They are mostly based on
It cant indulge the full speed of CAN, which is 1mb and there
we cant just use two serial/usb tools connected to computer to
We had to create a new tools called CAN
spy.
>>About CAN spy.
We need to
middle these are also to sniff and inject.
We need to be able
CAN 2 and from CAN2 to CAN1. and we Also want to filter to trade
because we want to pentest.
And what we want to ethernet because
like scapy or wireshark and ethernet is quite convenient and
even more CAN interface.
So our tool is based on ethernet.
We
can still get the frame on a serial port, but this is more a
We can also store the settings of the tools,
in a SD card in order to be
the car without using a computer and logging the packet.
About
avoid any complex soldering for people so that anyone can use
So the mainboard is a demo board/ demo shield you
can find on the internet, so its
the paper to find the reference and we use a shield that
card and serial.
You can also find it on the internet on
Both are less than at 60 bucks.
But still you will need to solder a small shield as
that could interface, so we have to make it.
But its very simple,
serial setting, as if you are working on real car, working on
You have to setup resistors, power supply, etc.
Everyone can solder it, its also
Less than 30 bucks.
So the complete tools is less than
100 bucks, depending on where
Actually if you dont want to solder the CAN
shield, we have some spare
try it more quickly.
Come at the end of the presentation.
You can
We have two tool running there, we are
going to talk about them.
For
car, and the other one is doing the man in the middle setup.
to do emulate CAN device without emulating the whole car.
you
whole car to make the device think its at home or you need to
middle attack so that you can modify the packet on the fly.
So
CAN spy emulating the car and one doing the man in the middle
For example I have my phone with a diagnostic tool,
thinking we are currently
That is the first CAN spy doing the
emulation.
And at any moment at
the man in the middle and to activate the internal filtering
that the tool thinks we are driving 255km which is the
one byte packet.
>>Its a cheap ODB-II dongle connected to
you can find on the store.
>>I guess we missed a bit of
manufacturers to help them find vulnerabilities before their
put in car goes into market.
That's why we build this tool.
middle you need to physically cut the bus or extract the
If you do this at home this means you need to take
apart your car.
But we are
they give us access to integration bench, where it is
CAN devices.
They can give us specifications so we can build
easily.
But the reason we chose to today use the OBD 2KS is that
same as we do, but at home.
You don't need to cut anything or to
2KS.
You just need your car the OBD device, cheap diagnostic
You can setup the CAN spy between your car and
the diagnostic tool and then you
device A little tip.
If you want to turn around a security issue
people try to attack a car.
Why not attack tool that's
These tool can be pretty sensitive for
example if you are able to
other car connecting to this diagnostic tool will be at risk
One easy way to do this is to play with diagnostic requests
which answers are fragmented
Because the diagnostic tool usually defragment those frames
initially sent by the car, and its quite easy to produce buffer
Tools always expect the car to be
compliant with the norm, which
car thats was not compliant with the norm.
But if you put your
force the for example vehicle notification number which is 17
40000 characters, you will cause a buffer overflow which can be
>>Yeah just a notice information, but everything is
you can find it on our bitbucket.
You will have to
The firmware has been designed in order to
simplify adding new
want to add new function on the shell for example: we have a
change and manage settings but you can want to add new
When designing the firmware we really think how
we can add new function.
>>A
As you may have understand with the slides, we have two kinds of
UART device, one SD card driver.
In order to never miss a frame,
to forward the full data rate, that means up to 1mb/s from to
frames between the two, we are dropping frames.
We had to
time techniques to achieve this goal.
If you add new
while complying to our abstraction layer ,you can add
are not impair the real time properties of our tool.
>>So we
about where he was talking about CAN architecture.
But without
explain I think.
>>You can try >>Yeah so.
Yeah let's try.
So a
architecture.
So what you can find in a car.
So the most basic
ECU, which is a Electronic Control Unit.
So in your car you
controlling the dashboard, the brakes, the engine, etc.
They
So if we think of the most basic
architecture this is just one
So as you can imagine you will have
congestion issue, because if
time so no one or someone can not talk.
So the mechanism is
which one will be sent if two are talking at the same time.
priority.
But as you can imagine, ECU with very low
So in the most advanced architecture
and recent car you have several
So the points to have several busses is to segment for
example with one bus
navigation, one bus for engine and the brake.
So this was more
security but its still good for security.
You can have again two
for ECU on a bus and ECU that are connected to two busses.
For
system it is connected to the entertainment but its also needs
car.
And what we can think as state of the art architecture on
and gateway between these buses.
So like network, and this
based on the ID, but they can be a little bit smarter and use the
If the vehicle is stopped, if its
running, at which speed is it
allow different ID based on state of the car.
So we can see
can play.
>>The idea is that from it occur you are first
navigation system or telematic functionalities using broadband/
and once you have compromised either one of these two type of
you need to compromise more ECUs.
But usually these ECUs are
just compromise.
So you need to move from one bus to the other,
ECU that is either on multiple busses like the first case
have a situation with a central gateway, to compromise this
And that is essentially the goal behind our tool, its
not about auditing navigation
bluetooth,wifi, usb, mobile broadband.
Its root for the
ECU from the CAN bus.
Idea is to craft attack from CAN bus.
Not
example and then reach the CAN bus.
This is the first step and
We do that step 2 when we audit ECUs.
Really there is nothing to add here.
If you
penetration testing, wifi penetration testing.
There's
plenty of literature to expand everything.
>>On the broadband
on broadband pentesting, its not specific to automatic.
>>Usually
MC(MZ) catcher to force the ECU to use your own mobile broadband
attack so you can try and modify the info coming from the car
see what happened to the car.
Mitm is really the way when you
vulnerabilities very quickly without the need to really
This was something that was lacking to us
from the CAN bus perspective,
bus.
This is really why we ended up writing this tool.
Im just
[Humming......]
Is there anyone that has questions: >>We have a
since we have time you can come and see the demonstration
We have no camera to show this and the screen of the
phone is not loud enough for
And if you have question you can ask.
And again we apologise for this issue, a
It was working in the speaker room.