The Car Hacker's Handbook: A Guide for the Penetration Tester

by Craig Smith

Overview

Modern cars are more computerized than ever. Infotainment and navigation systems, Wi-Fi, automatic software updates, and other innovations aim to make driving more convenient. But vehicle technologies haven’t kept pace with today’s more hostile security environment, leaving millions vulnerable to attack.

The Car Hacker’s Handbook will give you a deeper understanding of the computer systems and embedded software in modern vehicles. It begins by examining vulnerabilities and providing detailed explanations of communications over the CAN bus and between devices and systems.

Then, once you have an understanding of a vehicle’s communication network, you’ll learn how to intercept data and perform specific hacks to track vehicles, unlock doors, glitch engines, flood communication, and more. With a focus on low-cost, open source hacking tools such as Metasploit, Wireshark, Kayak, can-utils, and ChipWhisperer, The Car Hacker’s Handbook will show you how to:
–Build an accurate threat model for your vehicle
–Reverse engineer the CAN bus to fake engine signals
–Exploit vulnerabilities in diagnostic and data-logging systems
–Hack the ECU and other firmware and embedded systems
–Feed exploits through infotainment and vehicle-to-vehicle communication systems
–Override factory settings with performance-tuning techniques
–Build physical and virtual test benches to try out exploits safely

If you’re curious about automotive security and have the urge to hack a two-ton computer, make The Car Hacker’s Handbook your first stop.

Product Details

ISBN-13:	9781593277031
Publisher:	No Starch Press
Publication date:	03/01/2016
Edition description:	New Edition
Pages:	304
Sales rank:	680,803
Product dimensions:	7.00(w) x 9.10(h) x 0.90(d)

About the Author

Craig Smith runs Theia Labs, a research firm that focuses on security auditing and building hardware and software prototypes. He has worked for several auto manufacturers and provided them with his public research. He is also a founder of the Hive13 hackerspace and OpenGarages.org. Craig is a frequent speaker on car hacking and has run workshops at RSA, DEF CON, and other major security conferences

Table of Contents

Foreword Chris Evans xvii

Acknowledgments xix

Introduction xxi

Why Car Hacking Is Good for All of Us xxii

What's in This Book xxiii

1 Understanding Threat Models 1

Finding Attack Surfaces 2

Threat Modeling 2

Level 0 Bird's-Eye View 3

Level 1 Receivers 3

Level 2 Receiver Breakdown 5

Threat Identification 6

Level 0 Bird's-Eye View 6

Level 1 Receivers 7

Level 2 Receiver Breakdown 10

Threat Rating Systems 11

The DREAD Rating System 11

CVSS: An Alternative to DREAD 13

Working with Threat Model Results 13

Summary 14

2 Bus Protocols 15

The CAN Bus 16

The OBD-II Connector 17

Finding CAN Connections 17

CAN Bus Packet Layout 18

The ISO-TP Protocol 19

The CANopen Protocol 20

The GMLAN Bus 20

The SAEJ1850 Protocol 20

The PWM Protocol 21

The VPW Protocol 22

The Keyword Protocol and ISO 9141-2 22

The Local Interconnect Network Protocol 24

The MOST Protocol 24

MOST Network Layers 25

MOST Control Blocks 25

Hacking MOST 26

The FlexRoy Bus 27

Hardware 27

Network Topology 27

Implementation 27

FlexRay Cycles 28

Packet Layout 29

Sniffing a FlexRay Network 30

Automotive Ethernet 30

OBD-II Connector Pinout Maps 31

The OBD-III Standard 33

Summary 34

3 Vehicle Communication with Socketcan 35

Setting Up can-utils to Connect to CAN Devices 36

Installing can-utils 37

Configuring Built-in Chipsets 37

Configuring Serial CAN Devices 39

Setting Up a Virtual CAN Network 40

The CAN Utilities Suite 41

Installing Additional Kernel Modules 42

The can-isotp.ko Module 43

Coding SocketCAN Applications 44

Connecting to the CAN Socket 44

Setting Up the CAN Frame 45

The Procfs Interface 45

The Socketcand Daemon 46

Kayak 46

Summary 49

4 Diagnostics and Logging 51

Diagnostic Trouble Codes 52

DTC Format 52

Reading DTCs with Scan Tools 54

Erasing DTCs 54

Unified Diagnostic Services 54

Sending Data with ISO-TP and CAN 55

Understanding Modes and PIDs 57

Brute-Forcing Diagnostic Modes 58

Keeping a Vehicle in a Diagnostic State 60

Event Data Recorder Logging 61

Reading Data from the EDR 62

The SAE J1698 Standard 63

Other Data Retrieval Practices 63

Automated Crash Notification Systems 64

Malicious Intent 64

Summary 65

5 Reverse Engineering the Can Bus 67

Locating the CAN Bus 67

Reversing CAN Bus Communications with can-utils and Wireshark 68

Using Wireshark 69

Using candump 70

Grouping Streamed Data from the CAN Bus 70

Using Record and Playback 73

Creative Packet Analysis 76

Getting the Tachometer Reading 79

Creating Background Noise with the Instrument Cluster Simulator 81

Setting Up the ICSim 81

Reading CAN Bus Traffic on the ICSim 83

Changing the Difficulty of ICSim 84

Reversing the CAN Bus with OpenXC 84

Translating CAN Bus Messages 85

Writing to the CAN Bus 86

Hacking OpenXC 87

Fuzzing the CAN Bus 88

Troubleshooting When Things Go Wrong 89

Summary 90

6 ECU Hacking 91

Front Door Attacks 92

J2534: The Standardized Vehicle Communication API 92

Using J2534 Tools 93

KWP2000 and Other Earlier Protocols 94

Capitalizing on Front Door Approaches: Seed-Key Algorithms 94

Backdoor Attacks 95

Exploits 95

Reversing Automotive Firmware 96

Self-Diagnostic System 96

Library Procedures 97

Comparing Bytes to Identify Parameters 101

Identifying ROM Data with WinOLS 103

Code Analysis 106

A Plain Disassembler at Work 107

Interactive Disassemblers 110

Summary 113

7 Building and Using ECU Test Benches 115

The Basic ECU Test Bench 116

Finding an ECU 116

Dissecting the ECU Wiring 117

Wiring Things Up 119

Building a More Advanced Test Bench 119

Simulating Sensor Signals 120

Hall Effect Sensors 121

Simulating Vehicle Speed 123

Summary 126

8 Attacking ECUS and Other Embedded Systems 127

Analyzing Circuit Boards 128

Identifying Model Numbers 128

Dissecting and Identifying a Chip 128

Debugging Hardware with JTAG and Serial Wire Debug 130

JTAG 130

Serial Wire Debug 132

The Advanced User Debugger 133

Nexus 134

Side-Channel Analysis with the ChipWhisperer 134

Installing the Software 135

Prepping the Victim Board 137

Brute-Forcing Secure Boot Loaders in Power-Analysis Attacks 138

Prepping Your Test with AVRDUDESS 139

Setting Up the ChipWhisperer for Serial Communications 140

Setting a Custom Password 141

Resetting the AVR 143

Setting Up the ChipWhisperer ADC 143

Monitoring Power Usage on Password Entry 145

Scripting the ChipWhisperer with Python 147

Fault Injection 148

Clock Glitching 148

Setting a Trigger Line 154

Power Glitching 156

Invasive Fault Injection 156

Summary 156

9 In-Vehicle Infotainment Systems 157

Attack Surfaces 158

Attacking Through the Update System 158

Identifying Your System 159

Determining the Update File Type 160

Modifying the System 161

Apps and Plugins 163

Identifying Vulnerabilities 164

Attacking the IVI Hardware 166

Dissecting the IVI Unit's Connections 166

Disassembling the IVI Unit 168

Infotainment Test Benches 170

GENIVI Meta-IVI 170

Automotive Grade Linux 173

Acquiring an OEM IVI for Testing 174

Summary 175

10 Vehicle-to-Vehicle Communication 177

Methods of V2V Communication 178

The DSRC Protocol 179

Features and Uses 180

Roadside DSRC Systems 181

WAVE Standard 184

Tracking Vehicles with DSRC 186

Security Concerns 186

PKI-Based Security Measures 188

Vehicle Certificates 188

Anonymous Certificates 189

Certificate Provisioning 189

Updating the Certificate Revocation List 191

Misbehavior Reports 192

Summary 192

11 Weaponizing Can Findings 193

Writing the Exploit in C 194

Converting to Assembly Code 196

Converting Assembly to Shellcode 199

Removing NULLs 199

Creating a Metasploit Payload 200

Determining Your Target Make 202

Interactive Probing 203

Passive CAN Bus Fingerprinting 204

Responsible Exploitation 208

Summary 208

12 Attacking Wireless System with SDR 209

Wireless Systems and SDR 210

Signal Modulation 210

Hacking with TPMS 211

Eavesdropping with o Radio Receiver 212

TPMS Packets 213

Activating a Signal 214

Tracking a Vehicle 214

Event Triggering 214

Sending Forged Packets 215

Attacking Key Fobs and Immobilizers 215

Key Fob Hacks 216

Attacking a PKES System 219

Immobilizer Cryptography 220

Physical Attacks on the immobilizer System 228

Flashback: Hotwiring 230

Summary 231

13 Performance Tuning 233

Performance Tuning Trade-Offs 234

ECU Tuning 235

Chip Tuning 236

Flash Tuning 238

Stand-Alone Engine Management 239

Summary 240

A Tools of the Trade 241

Hardware 241

Lower-End CAN Devices 242

Higher-End CAN Devices 245

Software 246

Wireshark 246

PyOBD Module 246

Linux Tools 247

CANiBUS Server 248

Kayak 248

SavvyCAN 248

O2OO Data Logger 249

Caring Caribou 249

Of Fingerprinting Tool 250

UDSim ECU Simulator 250

Octane CAN Bus Sniffer 250

AVRDUDESS GUl 251

RomRaider ECU Tuner 251

Komodo CAN Bus Sniffer 251

Vehicle Spy 252

B Diagnostic Code Modes and PIDS 253

Modes Above 0×10 253

Useful PIDs 254

C Creating Your Own Open Garage 255

Filling Out the Character Sheet 255

When to Meet 257

Affiliations and Private Memberships 257

Defining Your Meeting Space 258

Contact Information 258

Initial Managing Officers 259

Equipment 259

Abbreviations 261

Index 263

Editorial Reviews

The Car Hacker's Handbook a guide on how to reverse engineer, exploit, and modify any kind of embedded system; cars are just the example. Craig presents this in a way that is eminently comprehensible and spends enough time reinforcing the idea of hacking a car safely, legally, and ethically. It’s a great read, an excellent introduction to fiddling with embedded bits, and truly owning the devices you’ve already purchased.”
—Hackaday

“Smith has done a marvelous job of providing a practical introduction to the world of vehicle systems and the tools used to interact with them for both benign and malicious purposes. Definitely a recommended read.”
—IEEE Cipher

“No matter where you stand on the vehicle cybersecurity issue—and perhaps like me you need to learn more about this subject—The Car Hacker's Handbook is an excellent guide and reference.”
—SAE International

“No Starch Press has taken on the task of turning The Car Hacker's Handbook into a beautifully produced, professional book, in a new edition that builds on the original, vastly expanding the material while simultaneously improving the organization and updating it to encompass the otherwise-bewildering array of new developments in car automation and hacking.”
—Cory Doctorow, Boing Boing

“The Car Hacker’s Handbook is a comprehensive guide to reverse-engineering and understanding the digital control systems in a modern vehicle. This book is a wake-up call to automakers, legislators, and regulators, announcing the fact that technology enthusiasts can and will continue to fiddle with their cars. The bar for automotive software quality just got raised.”
—Jeff Zurschmeide, Digital Trends

“At nearly 300 pages, The Car Hacker’s Handbook covers a lot of potential security risks, and as autonomous systems become more ubiquitous and sophisticated, there could be even more risks.”
—TechCrunch

“The Car Hacker's Handbook is well worth reading. The practical information on automotive networks and protocols is invaluable. All things considered, that is what one wants from a hacker's handbook.”
—Nathan Willis, LWN.net

“Craig Smith has written a fascinating book about how connected cars work, and how they can be hacked. For those that want to understand what goes on under the hood of the car from a software perspective, The Car Hacker's Handbook is a most worthwhile read.”
—Ben Rothke, RSA Conference

“If you have your own car and are interested in understanding the ins and outs of its networking and security, this is the reference book to use.”
—Jay Schulman, InfoSecurity Magazine

“If you are interested in what goes on behind the scenes when you drive your car, and how exploitable it is, this is a book worth reading.”
—The IT Nerd

“With people like author Craig Smith and books such as The Car Hacker's Handbook, open information and standards and shared knowledge are the ways to secure our safety on the road.”
—Network Security Newsletter

“The Car Hacker’s Handbook by Craig Smith not only details the multiplicity of hacks that have already been perpetrated on unsuspecting automobile ECUs but promises to be a 'Guide for the Penetration Tester' interested in 'attacking ECUs' and 'passive CAN bus fingerprinting.'”
—David Booth, Driving

“The Car Hacker's Handbook is not just a technical guide for car enthusiasts and those with an interest in cybersecurity. If you work on, or modify cars, this book could be your Bible.”
—Rick Limpert on WGST's The Sully Show

“The Car Hacker's Handbook by Craig Smith is an excellent resource that deserves a place next to your Chilton repair manuals. Rather than an afterthought, security is front and center with The Car Hacker's Handbook. Anyone interested in electronically breaking into cars, or ideally thwarting such intrusions, should consider cracking into Smith's book first.”
—GearBrain

“Protect yourself and your car with The Car Hacker's Handbook. This book can be a great reference tool or even a spring or summer read. Smith doesn't set out to be an alarmist, but this book really makes you think.”
—Examiner.com

“The Car Hacker’s Handbook has pages of programming and technical information for tinkerers (i.e., hackers). But it also provides a public service as the first work of its kind to analyze computer-based systems that make them vulnerable to attack and exploitation. If your company has a fleet, you might want to check it out.”
—Strategic Finance

“If you are a serious car nut who regularly tinkers around, love problem-solving codes, or are concerned about security, pick up this guide and give the tricks inside a try. It could have a significant impact on your security.”
—The News Wheel

“The Car Hacker's Handbook invites digging deep within and getting your hands “dirty” digitally. Chock full of information and diagrams. For those with a yen for hacking a two-ton computer, drive on over to a bookstore and wrap your hands around this.”
—LA Home & Technology Examiner

“A great resource if you’re trying to hone your automotive skills or if you have an interest in the networks and security of cars.”
— Makezine.com

“Even if you aren't interested in becoming a car penetration tester, but you do want to know more about the collection of computers you routinely drive, you would do well to buy and read this book.”
—;login: the Magazine of USENIX

“The Car Hacker's Handbook is, on the one hand, an important work that can be highly useful to those who want to find the ways and mean to protect vehicles from cyber-attack, and, on the other, scary as hell for the rest of us.”
—Automotive Design & Production

“Smith is set on providing knowledge that will help users improve their car’s security and performance. The ultimate goal is to shed light on the inner workings of modern cars, discover potential security weaknesses and urge automakers to fix them, discover intentional choices that shouldn’t have been made (e.g. Volkswagen emissions scandal), and to know what you are driving.”
—Help Net Security

“A car hacker's bible. Smith cites the importance of having individuals as well as auto makers continually check and test their vehicles. He also cites the importance of public awareness that can pressure both manufacturers and safety agencies into developing safeguards and standards designed to keep ahead of the threat. And these really are only the early steps in a very long haul issue.”
—The Auto Channel

“A detailed overview of the computer systems and embedded software ubiquitous in today’s new cars. The author describes the numerous entry points where a hack can occur. Starting with CAN, the infotainment system, the engine control unit (ECU), and more.”
—CAN Newsletter

“As cars become more connected and contain more software than ever, their vulnerabilities are being publicly exposed, often to the great embarrassment of automakers. Craig Smith’s excellent, detailed book lifts the lid on all the major threat vectors in the vehicle, with great technical depth. For anyone interested in security and the modern vehicle, or whose job depends on these areas, there is simply no better book out there!”
—Andrew Brown, Strategy Analytics, Executive Director of Enterprise and IoT Research

“The Car Hacker's Handbook is useful, insightful, and brimming with pragmatic advice. Highly recommended to those in the automotive and security industries.”
—Prof. Christof Ebert, Vector Consulting Services

“Easily the best book I have ever found for learning about how to use a CAN bus. I would recommend this book for engineers working with embedded systems, even if they do not work with cars. I give this book 5 out of 5.”
—Robots for Roboticists

“A useful resource for cybersecurity experts.”
—Mercury Blog

From the Publisher