THE CAR HACKER HAND BOOK

 THE CAR HACKER HAND BOOK

Fore word

The world needs more hackers, and the world defi- nitely needs more car hackers. Vehicle technology is

 trending toward more complexity and more connectivity. Combined, these trends will require a greater focus on automotive security and more talented individuals to provide this focus.

But what is a hacker? The term is widely corrupted by the mainstream media, but correct use of the term hacker refers to someone who creates, who explores, who tinkers—someone who discovers by the art of experimentation and by disassembling systems to understand how they work. In my experience, the best security professionals (and hobbyists) are those who are naturally curious about how things work. These people explore, tinker, experiment, and disassemble, sometimes just for the joy of discovery.

These people hack.

A car can be a daunting hacking target. Most cars don’t come with a keyboard and login prompt, but they do come with a possibly unfamiliar array of protocols, CPUs, connectors, and operating systems. This book will demystify the common components in cars and introduce you to readily available tools and information to help get you started. By the time you’ve finished reading the book, you’ll understand that a car is a collection of connected computers—there just happen to be wheels attached. Armed with appropriate tooling and information, you’ll have the confidence to get hacking.

This book also contains many themes about openness. We’re all safer when the systems we depend upon are inspectable, auditable, and documented—and this definitely includes cars. So I’d encourage you to use the knowledge gained from this book to inspect, audit, and document. I look forward to reading about some of your discoveries!

Br i e f Contents

Foreword by Chris Evans . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xvii

Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xix

Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xxi

Chapter 1: Understanding Threat Models . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1

Chapter 2: Bus Protocols . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15

Chapter 3: Vehicle Communication with SocketCAN . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35

Chapter 4: Diagnostics and Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51

Chapter 5: Reverse Engineering the CAN Bus . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67

Chapter 6: ECU Hacking . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 91

Chapter 7: Building and Using ECU Test Benches . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 115

Chapter 8: Attacking ECUs and Other Embedded Systems . . . . . . . . . . . . . . . . . . . . . . . 127

Chapter 9: In-Vehicle Infotainment Systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 157

Chapter 10: Vehicle-to-Vehicle Communication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 177

Chapter 11: Weaponizing CAN Findings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 193

Chapter 12: Attacking Wireless Systems with SDR . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 209

Chapter 13: Performance Tuning . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 233

Appendix A: Tools of the Trade . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 241

Appendix B: Diagnostic Code Modes and PIDs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 253

Appendix C: Creating Your Own Open Garage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 255

Abbreviations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 261

Index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 263