Automotive security is really exciting and is an interesting topic of study for many security researchers. Automotive and hardware, for the most part, has always been off the radar. These hacks are always more difficult to pull off and at the same time, they are potentially more devastating. With the arrival of Self Driving cars like Tesla, Automotive security will only become more important.
When you are driving a car today, you are driving a hugely powerful computer that happens to have wheels and steering.
Today, when you drive a car, there’s nothing that is not mediated by a computer. And at the core of all this is the Controller Area Network or simply called CAN or sometimes CAN Bus, a central nervous system of a car responsible for intravehicular communication. This tutorial is going to be a guide for car hacking as safely as possible on reverse engineering CAN packets.
To practice CAN-Bus exploitation we will be using an ICSim package from Craig Smith. ICSim includes a dashboard with speedometer, door lock indicators, turn signal indicators and a control panel. The control panel allows the user to interact with the simulated automobile network, applying acceleration, brakes, controlling the door locks and turn signals.
“Car Hacking 101: Practical Guide to Exploiting CAN-Bus using Instrument Cluster Simulator” is a series of articles, where
Part 1 is all about Setting up the Virtual Lab
Part 2 is about Exploiting the CAN Bus
Part 3 is about SavvyCAN and doing this on a real car [TODO]
The primary goal of this tutorial is to help you get started with Automotive security. Entry barrier to Car Hacking is much higher compared to any other security fields. I hope this tutorial can play an important role in helping you clear the entry barrier.
While Car Hacking and Automotive Security is a much broader field, this tutorial only focuses on Controller Area Network(CAN) and limited to Sniffing CAN traffic, analyzing them, reverse engineer and perform replay attacks on automotive.
While it is true that we will be performing this attack/tutorial on an Instrument Cluster Simulator, this can very well be transitioned to a real car with additional hardware. I will talk about the extra hardware needed towards the end of this article.
The goal of this article is to help you get started in automotive security and/or car hacking easily without spending a lot of money on hardware.
This is NOT a “Zero to Hero in Car hacking to make you expert in X minutes” article, instead, this article just aims to help you just get started with car hacking in a simulator.
This article will help you learn
- functioning of CAN
- Gaining access to CAN via OBD-II
- Sniffing the CAN Traffic
- Analyzing and reverse-engineering the CAN Traffic
- Replay Attack
- Denial of Service in CAN Network [Part 3 TODO]
- Playing with your CAN packets using Python [Part 3 TODO]😉
If you decide to practice this tutorial, you would need:
- Any Linux distributions (I will be using Ubuntu)
- can-utils
- ICSim (ICSim is an opensource Instrumentation Cluster Simulator)
Can be downloaded from https://github.com/zombieCraig/ICSim
Controller Area Network aka CAN is the central nervous system that enables communication between all/some parts of the car. Before CAN was originally developed by BOSCH in 1985 as an intra-vehicular communication system, automotive manufacturers used point-to-point wiring systems. As we started having more and more electronic components in the cars, this only became bulky and too expensive to maintain. This problem was then fixed by replacing it with CAN.
In simple terms, CAN allows various Electronic units in cars to communicate and share data with each other. The main motive of proposing CAN was that it allowed multiple ECU to be communicated with only a single wire. A modern car can have as much as 70 ECUs. In a car, you can have components like Engine Control Unit, Airbags, Transmission, Gear Unit, Anti-lock braking system or simply ABS, infotainment systems, climate control, Windows, doors, etc. In order for all these units to communicate with each other, point-to-point wiring would have been so bulky. Imagine, every component connected to every other component, this would have been a real mess to diagnose for any troubleshooting. But with CAN, this can be replaced with single wire and communication between each unit is much simpler.
The CAN-Bus could be thought of as a noisy, crowded, slower version of Ethernet LAN except that the traffic is UDP rather than TCP.
It is worth noting that not all automobile control systems use CAN and also CAN is not only the communication protocol used in an automobile system. There could be other protocols such as Bluetooth, GSM/LTE cellular networks, satellite radios, LIN, etc. You should know that CAN is not the only attack surface, there could be many.
A car can have multiple nodes that are able to send and/or receive messages. This message consists of essentially an ID, which is a priority of the message and also it can contain CAN message that can be of eight bytes or less at a time.
If two or more node begins sending messages at the same time, the messages sent with the dominant ID will overwrite with that of less dominant. This is called priority-based bus arbitration. Messages with numerically smaller value IDs are a higher priority and are always transmitted first. This is how a node detects that higher priority messages are being placed on a bus.
Message from Brakes has a higher priority than a message from the audio player.
Note down that, Lowest ID = Highest Priority.
If two or more node begins sending messages at the same time, the messages sent with the dominant ID will overwrite with that of less dominant.
CAN bus consists of two different wires. As it is a bus, multiple devices can be connected to these wires. A CAN frame has 3 major parts:
- Arbitration Identifier
- Data Length Code
- Data field
Let’s have a look at the CAN data frame:
This is a legit question that must be going through your head, as there are many other buses that can be easily implemented but why CAN? Before the CAN bus was invented, automotive manufactures used to do point to point wiring systems, if you have three components in the car, all three components were connected to each other with a point to point wiring system.
Consider these three components are steering system, gear unit, and ABS. Now on a typical point to point wiring system, you need a steering system to be directly connected to a gear unit and to the ABS as well with wires. Also, your gear unit needs to be connected to the ABS and Steering System, with a bunch of wires. This is perfectly fine with cars with fewer components. Can you imagine this in a modern car that has as much as 100 different ECU and other components? This is going to be messy and bulky! Also impossible to identify faults in the wiring system, (if any), the diagnosis would have been a real nightmare, and very much expensive to maintain.
This is when automotive manufacturers came up with the idea of CAN.
The point to point wiring problem can be replaced with two wires, i.e, CANH and CANL, CAN HIGH and CAN LOW respectively. Now, this way communication is much faster, simpler and very easy to diagnose.
It is because CAN is being used in pretty much every car, this is mandated by law so CAN is not going anywhere soon. Also, CAN bus was not developed keeping modern security in mind.
In order for you to access the CAN bus in your car, you need to have access to the onboard diagnostic port, aka OBD. While there may be hundreds of other diagnostic standards and ports, basically all the cars these days use OBD-II. This is exactly what your car mechanics usees to identify the faults in your car. OBD is the most direct access to CAN. Locating OBD-II is pretty easy. This is located somewhere near the passenger’s seat or driver’s seat. And this should be accessible without the need of a screwdriver.
This is how exactly an OBD looks like.
If you are wondering about the pinouts of the OBD, here’s the pinout for the OBD port.
If you look carefully, pin 6 and pin 14 are the same CANH and CANL that I had mentioned earlier.
In order for you to interact with the CAN bus, since now you already know you need an OBD port, you need something like USB to CAN because your computer can’t talk to CAN directly. You need something that connects to the OBD-II port via USB so that you can send/receive the CAN packets. Also on the software, you need something that can read and/or write CAN packets as well as encode and/or decode the CAN packets. With a little bit of hardware and software, you definitely can hop into the CAN.
Hardware
The hardware needed for you to connect to the OBD-II can be easily found in the market. There are expensive as well as inexpensive hardware devices. High-end devices include Kvaser and EMS, which are expensive and overkill.
You have USB2CAN, a native can interface for Linux that offers great value for money.
Also, many times you will come across this ELM327, Bluetooth based devices, they are terrible for hacking for a reason that they have slower data rates and you will end up losing so many packets.
Macchina M2
Macchina M2 is my personal favorite one. Macchina M2 is an opensource automotive interface that allows you to communicate to the CAN bus via OBD-II. The best part about Macchina M2 is that it is modular, meaning you can add WiFi, GSM, LTE, BLE modules on top of M2. M2 has 2 CAN channels. M2 also has LIN 😉 You can find more about Macchina M2 here.
I have used USB2CAN and Macchina M2, they provide great value for money and does the job.
CLX000
Another low-cost option is the CLX000 from CSS Electronics, which lets you log and stream CAN data for e.g. car hacking purposes. Data can be visualized in the free open-source Wireshark software and a plugin enables useful reverse engineering functionality.
CLX000 is great for visualisation and telematics.
You can find more information about CLX000 here, they’ve some great articles on CAN as well.
I would recommend going through their blogs: https://www.csselectronics.com/screen/page/reverse-engineering-can-bus-messages-with-wireshark/language/en
Software
On the software side, you have SocketCAN, can-utils, vcan built into the Linux kernel. They serve the purpose of sending and receiving the CAN packets, encode and/or decode them.
You also have Wireshark that can analyze CAN packets.
If you want to learn more about CAN exploitation without worrying to harm your Car, ICSim is the tool to go for!
The best and inexpensive way to practice car hacking is by running an instrumentation cluster simulator. Thanks to Craig Smith and his open-source repo called ICSim. Using ICSim, it’s pretty easy to set up and inexpensive to learn CAN-Bus exploitation.
Let’s do the setup.
Instrument Cluster Simulator requires SDL libraries
SDL is a cross-platform development library for computer graphics and audio. Since ISCim draws and animates a virtual dashboard, this is required. This can be installed via apt-get.
sudo apt-get install libsdl2-dev libsdl2-image-dev -yInstalling CAN Utils
In order for us to send, receive and analyze CAN packets, we need CAN utils. can-utils is a Linux specific set of utilities that enables Linux to communicate with the CAN network on the vehicle. The canutils consist of 5 main tools that we use very frequently:
- cansniffer for sniffing the packets
- cansend for writing a packet
- candump dump all received packets
- canplayer to replay CAN packets
- cangen to generate random CAN packets
can-utils can be installed via apt-get
sudo apt-get install can-utils -yDownload the Instrumentation Cluster Simulator
Instrumentation Cluster Simulator is used to generate the simulated CAN traffic.
This can be downloaded by cloning the project via a git repository.
git clone https://github.com/zombieCraig/ICSimIf everything goes well, you should see this
Once you navigate inside the ICSim directory, there’s a shell script called setup_vcan.sh
The modprobe command here is used to load kernel modules like can and vcan modules. The last two lines will create a vcan0 interface in order to simulate the car network.
You can run the following commands to set up a virtual can interface
./setup_vcan.shTo verify vcan0 interface, ifconfig vcan0 will show
Now it’s time to run the simulator. Running the ICSim simulator at least requires two components. A dashboard and a controller to simulate the acceleration, brakes, controlling the doors, turn lights, etc. You would require at least 3 terminal windows/tabs for these to run. We would require these terminals to run dashboard, controller and another for running can-utils.
Running the dashboard
In order to run the dashboard, you could run a file called icsim with an argument vcan0, the interface we created earlier.
./icsim vcan0At this point in time, the dashboard won’t be functioning including speedometer, turn lights, brakes or doors. It is because there is no traffic on the interface vcn0. In order to simulate traffic on interface vcan0, we need to start the controller.
Control Panel can be started by
./controls vcan0The vcan0 is the virtual CAN interface through which our ICSim will send and receive CAN frames. As soon as you start the control panel, you can observe speedometer making some fluctuations. This is because of the noise simulated by the control panel.
Once the control panel has been started, you can use keyboard keys in order to simulate traffic.
Using the key combinations below, you can make changes in the ICSim Dashboard.
Once I press the up arrow key and left arrow key, this is what you can observe.
That’s all for the setup. If you have followed everything, you must be good to go. In Part 2, I will be talking about ways to exploit CAN traffic.
Next: Part 2: Exploiting the CAN Bus
References:
Some of the illustrations have been taken from “CSS Electronics” https://www.csselectronics.com
If you believe the illustrations listed here are yours, please feel free to message me, I will add credits to your illustrations.
FAQs
Can you control a car with CAN bus? ›
Self-Driving Cars and the CAN Bus
By reverse engineering the CAN bus of a vehicle, it enables an engineer to issue commands to the car via software. The most necessary commands, as you can imagine, are steering (angle) and acceleration and braking.
The rules of CAN-bus messages decoding are described by DBC-files. Each parameter (SPN) has its own decoding rule which you can edit, clone or delete in SPN editor. Depending on the settings, the uploaded log can be either public (open to everyone) or private (default setting).
What is a canbus simulator? ›The CAN BUS multiple ECU simulator provides a professional OBD development platform which allow the user to test the OBD functionality on the table.
What is Icsim? ›ICSIM: International Conference on Software Engineering and Information Management.
CAN you bypass CAN bus system? ›The CAN Bus bypass relay solves this issue by using a small low current relay that you connect a clean ignition live feed to which in turn powers the accessory. The vehicles reverse light or brake light circuit is only used to switch the bypass relay in turn activating the parking sensor kit or rear camera.
How CAN I tell if my car has CAN bus wiring? ›Typical places to pick up CAN include the ABS system (look for a pair of twisted wires, but ignore the four wheel speed wires) or on the back of the dashboard (look for a pair of twisted wires). If the vehicle does have CAN Bus on the OBD connector, it will normally be on Pins 6 and 14 as indicated below.
How many wires are in a CAN bus? ›The CAN-bus uses 3 wires (CANH, CANL, GND) for communication between nodes. The CANH and CANL signal form a differential signal pair.
Is CAN bus an Ethernet? ›Like the CAN bus, Ethernet is a pack- etized system, where information is transferred in packets between nodes on various parts of the network. Also like the CAN bus, Ethernet is bidirectional, and the speed possible on any individual link decreases as the number of nodes on the system increases.
How many ohms does a CAN bus have? ›The resistance of the CAN bus terminal is usually 120 ohms. Two 60 ohm resistors are linked in series in the design, and there are usually two 120 ohm nodes on the bus. Basically, persons who are familiar with the CAN bus system. This is common knowledge.
What will replace CAN bus? ›MOST, FlexRay and Automotive Ethernet in brief
A promising alternative to CAN is Automotive Ethernet.
Do cars still use CANbus? ›
The CAN bus standard is widely accepted and is used in practically all vehicles and many machines. This is mainly due to below key benefits: Simple and Low Cost: ECUs communicate via a single CAN system instead of via direct complex analog signal lines - reducing errors, weight, wiring, and costs.
Is CAN bus the same as OBD2? ›CAN is a method for communication (like a phone). In particular, the OBD2 standard specifies the OBD2 connector, incl. a set of five protocols that it can run on (see below). Further, since 2008, CAN bus (ISO 15765) has been the mandatory protocol for OBD2 in all cars sold in the US.
What is the usage of cansniffer? ›cansniffer is a tool that organizes can information by Arbitration ID and allows users to determine what values are changing. by default, if any arbitration ID doesn't receive "Different" information in the packet after 5 seconds, the data will be cleared from the screen.
How do you terminate a CAN bus? ›A CAN bus termination (of 120 Ohm each) must be present at the two physical end points of the CAN network. The CAN network has to be connected from one node to the other with a bus termination for each of the two end points.
What are the two wires in a CAN bus? ›The bus line is a twisted pair wire with a termination resistor (120 Ohm) on each side. One wire is called CAN High and one wire is called CAN Low. Both wires are needed for proper communication. A device which is connected to the bus is called a 'Node'.
What color are CAN bus wires? ›CAN is generally wired with yellow and green wire with yellow acting as the CAN-High and green as the CAN-Low signals. Many devices show this yellow and green color scheme to indicate how the wires should be plugged in.
Do CAN bus wires need to be twisted? ›All CANBUS wire must be twisted pair cable, even short lengths (longer than 1 inch / 2 cm). The twisted pair wire is an essential part of how the differential mode filtering works on CANBUS, and without it, the signal can be easily distorted.
CAN you wire a bus cable? ›CAN bus cable consists of a pair of wires known as CAN high and CAN low (indicating high and low speed, respectively). Both wires are twisted tightly together to ensure that electromagnetic interference affects the signal in both wires uniformly, limiting errors.
CAN bus wiring voltage? ›Standard CAN bus transceivers operate over a limited common mode voltage range that extends from −2V to +7V. In commercial or industrial environments, ground faults, noise, and other electrical interference can induce common mode voltages that greatly exceed these limits.
Does CAN bus need shielding? ›The CAN bus cable must be shielded and twisted pair cable, CAN L and CAN H twisted together and the shield connected to enclosure ground (ENC GND, pin 35) from both ends and from all stubs to create the lowest possible impedance from the shield to the ground.
Is CAN bus obsolete? ›
By the time, CAN XL effectively reaches the automation market, it will be considered obsolete compared to improved and thus much more powerful Ethernet technologies.
How are devices connected to a CAN bus? ›CAN bus devices feature a multiplex wiring system that connects to each node (i.e., connected unit) in a network and allows them to communicate with each other.
What is connected to a CAN bus? ›The devices that are connected by a CAN network are typically sensors, actuators, and other control devices. These devices are connected to the bus through a host processor, a CAN controller, and a CAN transceiver.
CAN bus wire distance? ›At a speed of 1 Mbit/s, a maximum cable length of about 40 meters (130 ft.) can be used.
What is the color of CAN high wire? ›The CAN Bus wire is a 4 conductor. Two wires are for power regulation: CAN Power (Red), CAN Ground (Black). The other two wires are CAN High (Yellow), and CAN Low (Green).
Why only 120 ohm is used in CAN? ›Why has the CAN standard selected 120 Ohm resistors? The answer is that most automotive cables are single wire. If you take the wires typically used in a car and twist them into a pair, you will get an impedance of 120 Ohm.
What is the difference between CAN bus and Ethernet? ›The key differences between CAN and automotive Ethernet and the advantages of Ethernet include: Supports significantly higher throughput rates (up to 10Gbps and working on more), allowing to aggregate multiple CAN buses into a single Ethernet link. This results in smaller wiring harnesses than CAN.
Is CAN bus open drain? ›CAN bus transceivers use a unique open drain design (Figure 3). The driver uses a pair of open drain devices to create a differential signal consisting of CANH (high) and CANL (low) on the bus. Combined, these signals produce the dominant signal level on the bus.
What is CAN bus failure? ›Introduction CANBUS is a high-speed network which requires high quality wiring in order to operate properly. As such, it is sensitive to improper wiring. The majority of CANBUS communication problems are caused by poor wiring, incorrect termination, or the use of multiple frequencies on the same bus.
What does a CAN bus do for headlights? ›To put it simply, a CANbus control unit is a small cable and adapter system, which is installed in between the wiring of your vehicle and the LED bulb. Because LED car bulbs use a lower wattage than other bulbs, the CANbus canceller helps to increase the current safely and without damaging the bulb.
How do I know if my car needs a CAN bus? ›
If the vehicle warns you when a bulb is out, it is equipped with CAN Bus. The easiest way is to contact the vehicle's supplier or dealership. If you're still not sure, we normally tell customers to remove a light and drive the vehicle to see if it gives a warning.
Is CAN bus needed for LED lights? ›Why do LED bulbs sometimes need a CANbus adapter? If your vehicle's lighting is not producing the wattage your vehicle expects, the canbus system will detect this, and interpret it as a fault - again triggering an error message.
CAN bus DTC codes? ›Diagnostic trouble code (DTC) U0001 stands for “High Speed CAN communication bus.” Your vehicle's CAN system connects various modules in your vehicle.
What cars use CAN bus? ›- 2008-2011 BMW 1 Series.
- 2007-2008 BMW 3 Series.
- 2006-2011 BMW 323i.
- 2002-2006 BMW 325i.
- 2002-2006 BMW 330i.
- 2008-2010 BMW 6 Series.
- 2014-2020 BMW i3.
- 2008-2013 BMW M3.
It's also called an OBD reader. An AutoZoner will get it for you and will have some tips for performing the reading.
CAN bus sniffer free software? ›CanKing is a CAN bus analyzer tool free of cost. Supports CAN FD. Suited for development work. You can send and receive CAN messages, log the data, filter messages, virtual CAN channels.
What is MCP2515? ›Microchip Technology's MCP2515 is a stand-alone Controller Area Network (CAN) controller that imple- ments the CAN specification, Version 2.0B. It is capable of transmitting and receiving both standard and extended data and remote frames.
CAN bus used in automotive? ›A Controller Area Network (CAN bus) is a robust vehicle bus standard designed to allow microcontrollers and devices to communicate with each other's applications without a host computer.
What is the advantage of using a CAN bus system on a car? ›Low Cost. When the CAN protocol was first created, its primary goal was to enable faster communication between electronic devices and modules in vehicles while reducing the amount of wiring (and the amount of copper) necessary.
What are the biggest limitations of the CAN bus? ›Advanced software capabilities require a high-performance hardware foundation, and the current CAN bus networking backbone is stretched to its limit. The biggest problem with CAN is the limited bandwidth it provides.
CAN bus voltage in cars? ›
Standard CAN bus transceivers operate over a limited common mode voltage range that extends from −2V to +7V. In commercial or industrial environments, ground faults, noise, and other electrical interference can induce common mode voltages that greatly exceed these limits.
Which cars use CAN bus? ›- 2008-2011 BMW 1 Series.
- 2007-2008 BMW 3 Series.
- 2006-2011 BMW 323i.
- 2002-2006 BMW 325i.
- 2002-2006 BMW 330i.
- 2008-2010 BMW 6 Series.
- 2014-2020 BMW i3.
- 2008-2013 BMW M3.
| Advantages | Disadvantages |
|---|---|
| High speed data rate | Limited number of nodes (up to 64 nodes) |
| Low cost and light in weight and robustness | High cost for software development and maintenance |
| Supports auto retransmission for attribution lost messages | Possibility of signal integrity issues |
Still, Ethernet can transport data over a link 100 times faster than a CAN bus. Ethernet is good for midbandwidth communications in applications such as navigation systems and control. It can be used in much the same way as a CAN bus while provid- ing much more bandwidth.