Car Hacking Handbook The Car Hacker’s Handbook: A Guide for the Penetration Tester Car Hacking Handbook

425 Pages·2016·22.834 MB·English

by  Craig smith

THE CAR HACKER’S HANDBOOK
A Guide for the Penetration Tester
Craig Smith
San Francisco
THE CAR HACKER’S HANDBOOK. Copyright © 2016 by Craig Smith.
All rights reserved. No part of this work may be reproduced or transmitted in any form or by
any means, electronic or mechanical, including photocopying, recording, or by any information
storage or retrieval system, without the prior written permission of the copyright owner and the
publisher.
20 19 18 17 16      1 2 3 4 5 6 7 8 9
ISBN-10: 1-59327-703-2
ISBN-13: 978-1-59327-703-1
Publisher: William Pollock
Production Editor: Laurel Chun
Cover Illustration: Garry Booth
Interior Design: Octopod Studios
Developmental Editors: Liz Chadwick and William Pollock
Technical Reviewer: Eric Evenchick
Copyeditor: Julianne Jigour
Compositor: Laurel Chun
Proofreader: James Fraleigh
Indexer: BIM Indexing & Proofreading Services
The following code and images are reproduced with permission: Figures 5-3 and 5-7 © Jan-
Niklas Meier; Figures 6-17 and 6-18 © Matt Wallace; Figures 8-6, 8-7, 8-8, and 8-20 ©
NewAE Technology Inc.; Brute-forcing keypad entry code on pages 228–230 © Peter Boothe;
Figures 13-3 and A-6 © Jared Gould and Paul Brunckhorst; Figures A-1 and A-2 © SECONS
Ltd., http://www.obdtester.com/pyobd/; Figure A-4 © Collin Kidder and EVTV Motor Werks.
For information on distribution, translations, or bulk sales, please contact No Starch Press, Inc.
directly:
No Starch Press, Inc.
245 8th Street, San Francisco, CA 94103
phone: [phone]; [email protected]
www.nostarch.com
Library of Congress Cataloging-in-Publication Data
Names: Smith, Craig (Reverse engineer), author.
Title: The car hacker's handbook: a guide for the penetration
tester / by Craig Smith.
Description: San Francisco : No Starch Press, [2016] | Includes
index.
Identifiers: LCCN 2015038297| ISBN 9781593277031 | ISBN 1593277032
Subjects: LCSH: Automotive computers--Security measures--Handbooks,
manuals,
     etc. | Automobiles--Performance--Handbooks, manuals, etc. |
Automobiles--Customizing--Handbooks, manuals, etc. | Penetration
testing
     (Computer security)--Handbooks, manuals, etc. |
     Automobiles--Vandalism--Prevention--Handbooks, manuals, etc.
Classification: LCC TL272.53 .S65 2016 | DDC 629.2/72--dc23
LC record available at http://lccn.loc.gov/2015038297
No Starch Press and the No Starch Press logo are registered trademarks of No Starch Press,
Inc. Other product and company names mentioned herein may be the trademarks of their
respective owners. Rather than use a trademark symbol with every occurrence of a
trademarked name, we are using the names only in an editorial fashion and to the benefit of the
trademark owner, with no intention of infringement of the trademark.
The information in this book is distributed on an “As Is” basis, without warranty. While every
precaution has been taken in the preparation of this work, neither the author nor No Starch
Press, Inc. shall have any liability to any person or entity with respect to any loss or damage
caused or alleged to be caused directly or indirectly by the information contained in it.
About the Author
Craig Smith ([email protected]) runs Theia Labs, a security research
firm that focuses on security auditing and building hardware and
software prototypes. He is also one of the founders of the Hive13
Hackerspace and Open Garages (@OpenGarages). He has worked for
several auto manufacturers, where he provided public research on
vehicle security and tools. His specialties are reverse engineering and
penetration testing. This book is largely a product of Open Garages
and Craig’s desire to get people up to speed on auditing their vehicles.
About the Contributing Author
Dave Blundell ([email protected]) works in product
development, teaches classes, and provides support for Moates.net, a
small company specializing in pre-OBD ECU modification tools. He
has worked in the aftermarket engine management sphere for the past
few years, doing everything from reverse engineering to dyno tuning
cars. He also does aftermarket vehicle calibration on a freelance basis.
About the Technical Reviewer
Eric Evenchick is an embedded systems developer with a focus on
security and automotive systems. While studying electrical engineering
at the University of Waterloo, he worked with the University of
Waterloo Alternative Fuels Team to design and build a hydrogen
electric vehicle for the EcoCAR Advanced Vehicle Technology
Competition. Currently, he is a vehicle security architect for Faraday
Future and a contributor to Hackaday. He does not own a car.
BRIEF CONTENTS
Foreword by Chris Evans
Acknowledgments
Introduction
Chapter 1: Understanding Threat Models
Chapter 2: Bus Protocols
Chapter 3: Vehicle Communication with SocketCAN
Chapter 4: Diagnostics and Logging
Chapter 5: Reverse Engineering the CAN Bus
Chapter 6: ECU Hacking
Chapter 7: Building and Using ECU Test Benches
Chapter 8: Attacking ECUs and Other Embedded Systems
Chapter 9: In-Vehicle Infotainment Systems
Chapter 10: Vehicle-to-Vehicle Communication
Chapter 11: Weaponizing CAN Findings
Chapter 12: Attacking Wireless Systems with SDR
Chapter 13: Performance Tuning
Appendix A: Tools of the Trade
Appendix B: Diagnostic Code Modes and PIDs
Appendix C: Creating Your Own Open Garage
Abbreviations
Index
CONTENTS IN DETAIL
FOREWORD by Chris Evans
ACKNOWLEDGMENTS
INTRODUCTION
Why Car Hacking Is Good for All of Us
What’s in This Book
1
UNDERSTANDING THREAT MODELS
Finding Attack Surfaces
Threat Modeling
Level 0: Bird’s-Eye View
Level 1: Receivers
Level 2: Receiver Breakdown
Threat Identification
Level 0: Bird’s-Eye View
Level 1: Receivers
Level 2: Receiver Breakdown
Threat Rating Systems
The DREAD Rating System
CVSS: An Alternative to DREAD
Working with Threat Model Results
Summary
2
BUS PROTOCOLS
The CAN Bus
The OBD-II Connector
Finding CAN Connections
CAN Bus Packet Layout
The ISO-TP Protocol
The CANopen Protocol
The GMLAN Bus
The SAE J1850 Protocol
The PWM Protocol
The VPW Protocol
The Keyword Protocol and ISO 9141-2
The Local Interconnect Network Protocol
The MOST Protocol
MOST Network Layers
MOST Control Blocks
Hacking MOST
The FlexRay Bus
Hardware
Network Topology
Implementation
FlexRay Cycles
Packet Layout
Sniffing a FlexRay Network
Automotive Ethernet
OBD-II Connector Pinout Maps
The OBD-III Standard
Summary
3
VEHICLE COMMUNICATION WITH SOCKETCAN
Setting Up can-utils to Connect to CAN Devices