Learn how to get started with Car Hacking and CAN message structures. Basic vehicle network explanation. What are some hardware and software tools for CAN sniffing and CAN injection. Finally how to build your own ECU testing buck.

2. Car Hacking 101
> How to get started
> Car Hacking tools
> Vehicle networking basics
> Build your own testing buck

3. @carloopio
Disclaimer:
The objective of this talk is
to create awareness and promote
a more informed audience about
car network security. It is not
intended to encourage unlawful
practices.

4. > How to get started
> Car Hacking tools
> Vehicle networking basics
> Build your own testing buck
@carloopio

5. 1st Published in 2016
Free Download link
Tools, Protocols,
References
Entire chapter
dedicated to SocketCAN
How to Reverse
Engineer an ECU
@carloopio

6. More Reading Material
http://illmatics.com/c
ar_hacking.pdf
@carloopio

7. Internet Shortcuts 2 Car Hacking
opengarages.org
Don’t scoff at the Wikipedia link – it’s actually very complete!
community.carloop.io
https://en.wikipedia.org/wiki/On-board_diagnostics
@carloopio

8. What you’ll need
1) Access to the OBD-II port
2) CAN connection tool like
USB2CAN
4) A laptop with Linux
3) OBD-II to Serial (RS-232) cable
(Mac OS o.k.)
@carloopio

9. Or less cables
1) Carloop
2) Particle Photon
3) WiFi
@carloopio

10. > How to get started
> Car Hacking tools
> Vehicle networking basics
> Build your own testing buck
@carloopio

11. A Vehicle’s CAN Bus
Controller Area Network
2 Wires: CAN High and CAN Low
More than 1 CAN bus on vehicle
ENGINE
BODY TRANSMISSIONDASHBOARD
AIRBAG INFOTAINMENT
@carloopio

12. CAN & OBDII
There are many protocols
1997-present
2008-presentCAN
OBDII
J1850 PWM
J1850 VPWM
KWP2000
Chrysler uses
same pins but
with ISO 9141-
2 std
Ford / GM
@carloopio

13. CAN & OBDII
Why focus on CAN?
Required vehicles built since 2008
Shares pins with OBD-II
More than just diagnostics…
@carloopio

14. How is information transmitted
Resting voltage 2.5V
Changes by 1V to generate data packets (1 and 0) in
sequence
Differential Signaling: CAN high increases to 3.5V
CAN low drops to 1.5V
@carloopio

15. How it looks like on an oscilloscope
@carloopio

16. Anatomy of a CAN message
Arbitration ID: 0x14 (in hex)
IDE: 0 (always 0 for CAN)
Data length: 1 byte
Data: 1 (in hex)
@carloopio

17. How it looks like on your laptop
@carloopio

18. > How to get started
> Car Hacking tools
> Vehicle networking basics
> Build your own testing buck
@carloopio

19. > Car Hacking tools
Hardware Software
http://opengarages.org/index.php/Tools
GNU Radio
PyOBD
Linux
CANiBUS
Kayak
SavvyCAN
O2OO
Caring
Caribou
C0f
UDSim
Octane
AVRDUDESS
RomRaider
Komodo
Vehicle Spy
@carloopio

20. Hardware Software
http://opengarages.org/index.php/Tools
Linux + can-utils
>cansniffer
>candump
>cansend
>cangen
CAN
sniffing/CAN
injection
(beginner)
Create Apps/
CAN injection
(intermediate)
Arduino sketch
github.com/carloop
Goal
@carloopio

21. > How to get started
> Car Hacking tools
> Vehicle networking basics
> Build your own testing buck
@carloopio

22. If you don’t feel like hacking
on your own car, try on a test
bench first
@carloopio

23. Power supply
Engine Control Module Simple ECU Test Buck
Car-part.com $35
Amazon $37
@carloopio

24. > Now go hack on something!
@carloopio

25. > Credits/Attributions
Links from opengarages.org
Pictures from Craig Smith’s Car
Hacker’s Handbook
Video by Craig Smith from
opengarages.com
@carloopio