This document and its content is the property of Airbus Defence and Space.
It shall not be communicated to any third party without the owner’s written consent. All rights reserved.

CANSPYa Platform for Auditing CAN Devices

Arnaud Lebrun
Jonathan-Christofer DemayAuditing conventional IT systems• Penetration testing• A form of security audit• Assess the risks of intrusion• Actual tests instead of a review process• The point of view of a real attacker (the “black-box” approach)• Relevant evaluation of impact and exploitability• Limitations• Less time• Less resources• More ethics• Counter-measure: the “grey-box” approach
Arnaud Lebrun
Jonathan-Christofer Demay2CANSPYa Platform for Auditing CAN Devices

The CISO’s dilemma• The hand they are dealt with
• Huge scope of responsibility• Continuous changes• Major security threats• Risk of substantial damages• Limited budget• Their response• They rely on penetration testing• They welcome the “gray-box” approach• They rely on risk analysis first and foremost• They divide perimeters accordingly
Arnaud Lebrun
Jonathan-Christofer Demay3CANSPYa Platform for Auditing CAN Devices

What about car manufacturer ?
• They are starting to include cyber-security along withconventional safety• A lot of new functionalities• Using more complex software• Also, security researchers…

Arnaud Lebrun
Jonathan-Christofer Demay

4

CANSPYa Platform for Auditing CAN Devices

What about car manufacturer ?
• They are starting to include cyber-security along withconventional safety

Arnaud Lebrun
Jonathan-Christofer Demay

5CANSPY
a Platform for Auditing CAN Devices

What about car manufacturer ?
• They are starting to include cyber-security along withconventional safety

Arnaud Lebrun
Jonathan-Christofer Demay

6

CANSPYa Platform for Auditing CAN Devices

What about car manufacturer ?
• They are starting to include cyber-security along withconventional safety

Arnaud Lebrun
Jonathan-Christofer Demay

7

CANSPYa Platform for Auditing CAN Devices

What about security audit for cars ?
• The same approach can be applied∙ While True
∙ Conduct risk analysis∙ Prioritize ECUs

∙ Conduct penetration tests accordingly∙ Carry out corrective actions∙ End While• Some ECUs can be common to several vehicles• Corrective actions may be difficult to carry out
Arnaud Lebrun
Jonathan-Christofer Demay

8CANSPY
a Platform for Auditing CAN Devices

It always begins with…
Infotainment and navigation• Consumer-grade connectivity• Wi-Fi, Bluetooth and USB  Nothing new here !

• However CAN sniffing is already useful for analysis
Arnaud Lebrun
Jonathan-Christofer Demay

9CANSPY
a Platform for Auditing CAN Devices

It always begins with…
Infotainment and navigation
Seamless connectivity• Mobile broadband connectivity• Setting up an IMSI catcher and then…
• Deal with conventional protocols (TCP, HTTP, …) Again, nothing new here !
Arnaud Lebrun
Jonathan-Christofer Demay

10

CANSPYa Platform for Auditing CAN Devices

It always begins with…
Infotainment and navigation
Seamless connectivity

Other ECUs: steering, braking, etc.

• CAN attacks• Bypass CAN bus segmentation (architecture-dependant)• Reverse-engineer higher-layer/custom protocols• Break the Security Access challenge (ISO 14229)
Arnaud Lebrun
Jonathan-Christofer Demay

11

CANSPYa Platform for Auditing CAN Devices

CAN architectures• One serial bus (to rule them all)• ID-based priority mechanism• Congestion issues• Acknowledgment by anyone
ECUECU

ECU

ECU

ECU

CAN High
CAN Low

Arnaud Lebrun
Jonathan-Christofer Demay

12

CANSPYa Platform for Auditing CAN Devices

CAN architectures• Multiple separate buses• Some ECUs have to be connected to multiple buses• They can be used to bypass the segmentation

ECU

ECU

ECU

CAN1 HighCAN1 LowECU

ECU

CAN2 HighCAN2 Low

Arnaud Lebrun
Jonathan-Christofer Demay

13

CANSPYa Platform for Auditing CAN Devices

CAN architectures• Multiple interconnected buses• A gateway is routing frames between CAN buses• It may take into account the state of the vehicle• Both safety and cyber-security can be considered
ECUGateway

ECU

CAN1 HighCAN1 LowECU

ECU

CAN2 HighCAN2 Low

Arnaud Lebrun
Jonathan-Christofer Demay

14

CANSPYa Platform for Auditing CAN Devices

Crafting CAN attacks• Several attack vectors• Misuse of intrinsic capabilities (e.g., remote diagnostic tool)• Exploit a higher-level parsing vulnerability• Break the Security Access challenge• Etc.

• This will imply a substantial amount of work• Unsolder EEPROM or identify on-chip debug (JTAG/BDM) andconventional debug (UART/WDBRPC) interfaces• Extract the firmware• Reverse-engineer the aforementioned items• Craft actual attacks
Arnaud Lebrun
Jonathan-Christofer Demay

15

CANSPYa Platform for Auditing CAN Devices

The Man In The Middle• Taking advantage of the client-server model• Insert yourself in-between them

• Do not alter traffic until you see something interesting• Then start to drop/alter/replay/…
• Finalize with targeted reverse-engineering• In theory, this is transposable to the CAN bus• We are auditing one device
 We could proxy the traffic from and to that device• We are working with the car manufacturer
 We can ask for a restricted devices (e.g., a remote diagnostic tool)This is limited by third-parties intellectual properties

Arnaud Lebrun
Jonathan-Christofer Demay

16CANSPY
a Platform for Auditing CAN Devices

However, in practice…
• CAN is a serial bus• Physically cut the bus and insert yourself in-between• Forward traffic between the split parts• Etc.

ECUECUMITMECUECUCAN High
CAN Low• 2 possible options (other than deep diving into the car)• Emulate the car from the point of view of the audited device• Use an integration bench provided by the car manufacturer
Arnaud Lebrun
Jonathan-Christofer Demay

17

CANSPYa Platform for Auditing CAN Devices

However, in practice…
• CAN is a serial bus• Physically cut the bus and insert yourself in-between• Forward traffic between the split parts• Etc.

ECU

ECU

ECU

MITM

ECU

CAN High
CAN Low• 2 possible options (other than deep diving into the car)• Emulate the car from the point of view of the audited device• Use an integration bench provided by the car manufacturer
Arnaud Lebrun
Jonathan-Christofer Demay

18

CANSPYa Platform for Auditing CAN Devices

What about existing (open-source) tools ?
• CAN was designed to meet timing constraints• Bridging two devices could add high latencies• Slow Arduino-like microcontrollers will drop frames

Arnaud Lebrun
Jonathan-Christofer Demay

19

CANSPYa Platform for Auditing CAN Devices

What about existing (open-source) tools ?
• CAN was designed to meet timing constraints• Bridging two devices could add high latencies• Slow Arduino-like microcontrollers will drop frames• UART (over USB) is a bottleneck• The default is usually 115 200 bauds (and even at max speed it is limiting)• CAN buses can go as far as 1Mbit/s (OBD-II is 250 or 500 Kbit/s)• We need two of them (cf. timing constraints)

Arnaud Lebrun
Jonathan-Christofer Demay

20

CANSPYa Platform for Auditing CAN Devices

What about existing (open-source) tools ?
• CAN was designed to meet timing constraints• Bridging two devices could add high latencies• Slow Arduino-like microcontrollers will drop frames• UART (over USB) is a bottleneck• The default is usually 115 200 bauds (and even at max speed it is limiting)• CAN buses can go as far as 1Mbit/s (OBD-II is 250 or 500 Kbit/s)• We need two of them (cf. timing constraints)• Lack of a mature framework• We get frustrated when we cannot use Scapy• Federate higher-layers reverse-engineering efforts
Arnaud Lebrun
Jonathan-Christofer Demay21CANSPYa Platform for Auditing CAN DevicesCANSPY objectives• Two dedicated CAN interfaces• Using independent CAN cores• With the ability to manipulate acknowledgments• Frame forwarding w/ or w/o filtering• Low latencies (even with filtering)• At the full data rate of the CAN standard• Sniffing and injection capabilities• CAN interfaces  Ethernet (with Wireshark dissector compatibility)• CAN interfaces  UART (mostly for setting/debugging purposes)• PCAP and settings read/write from SD card (autonomous mode)• Configurable settings via Ethernet (fully scriptable)
Arnaud Lebrun
Jonathan-Christofer Demay

22

CANSPYa Platform for Auditing CAN Devices

CANSPY hardware• STM32F4DISCOVERY board• 168 MHz 32bit ARM Cortex M4• COTS ($20)

Arnaud Lebrun
Jonathan-Christofer Demay

23

CANSPYa Platform for Auditing CAN Devices

CANSPY hardware• STM32F4DISCOVERY board• 168 MHz 32bit ARM Cortex M4• COTS ($20)• STM32F4DIS-BB extension board• 1 RS232 interface• 1 Ethernet port
• 1 SD card drive• COTS ($40)

Arnaud Lebrun
Jonathan-Christofer Demay

24

CANSPYa Platform for Auditing CAN Devices

CANSPY hardware• STM32F4DISCOVERY board• 168 MHz 32bit ARM Cortex M4• COTS ($20)• STM32F4DIS-BB extension board• 1 RS232 interface• 1 Ethernet port
• 1 SD card drive• COTS ($40)• DUAL-CAN extension board• Configurable resistors, power supplies and circuit grounds• 2 CAN interfaces and easy to build• Custom-made ($30 worth of PCB and components)
Arnaud Lebrun
Jonathan-Christofer Demay

25

CANSPYa Platform for Auditing CAN Devices

CANSPY firmware
Non-preemptive priority scheduler
High-priority cyclic executive
for synchronous services

Low-priority cyclic executive
for asynchronous services

ServiceServiceServiceServiceService

ServiceServiceServiceService

Transmit buffer

Transmit buffer

Transmit buffer

Receive buffer

Receive buffer

Receive buffer

Mutex

Mutex

Mutex

Device handler

Device handler

Device handler

https://bitbucket.org/jcdemay/canspy

Hardware Abstraction Layer
Device driver

Device driver

Arnaud Lebrun
Jonathan-Christofer Demay

Device driver

26

CANSPYa Platform for Auditing CAN Devices

CANSPY firmware• Event-driven scheduler• Real-time approach• Asynchronous I/O operations• Open source licensed• Low latency processing• Built-in services• 1 functionality == 1 service• CAN: Forward/Filter/Inject• Start only what you need

• Ethernet: Wiretap/Bridge• Read from all devices, write to only one• SDCard: Capture/Replay/Logdump• Mutual exclusion is possible• UART: Monitor/Logview/Shell• CAN devices• Autonomous mode
• In-built filtering/altering engine• Two independent handlers• SD card for read or write operations• Support all standard speeds• Throttling mechanisms• Power supply from the car battery
Arnaud Lebrun
Jonathan-Christofer Demay27

CANSPYa Platform for Auditing CAN Devices

Handling congestion issues• MITM setups can tamper with congestion• Filtering or dropping will modify the available bandwidth• ECUs behavior may thus be impacted• Two possible throttling mechanisms• Dummy frame injection• Delaying acknowledgments

ECU

ECU

ECU

MITM

ECU

CAN High
CAN Low

Arnaud Lebrun
Jonathan-Christofer Demay28

CANSPYa Platform for Auditing CAN Devices

CAN over Ethernet• The SocketCAN format• Ethertype 0x88b5• Different MAC addresses• Acknowledgments

Arnaud Lebrun
Jonathan-Christofer Demay29CANSPYa Platform for Auditing CAN Devices

CAN over Ethernet• The SocketCAN format• Ethertype 0x88b5• Different MAC addresses• Acknowledgments

class SocketCAN(Packet):name = "SocketCAN"
fields_desc = [BitEnumField("EFF", 0, 1, {0:"Disabled", 1:"Enabled"}),BitEnumField("RTR", 0, 1, {0:"Disabled", 1:"Enabled"}),BitEnumField("ERR", 0, 1, {0:"Disabled", 1:"Enabled"}),XBitField("id", 1, 29),
FieldLenField("dlc", None, length_of="data", fmt="B"),ByteField("__pad", 0),
ByteField("__res0", 0),
ByteField("__res1", 0),
StrLenField("data", "", length_from = lambda pkt: pkt.dlc),]
def extract_padding(self, p):
return "",pbind_layers(Ether, SocketCAN, type=0x88b5)

Arnaud Lebrun
Jonathan-Christofer Demay30

CANSPYa Platform for Auditing CAN Devices

CAN over Ethernet• The SocketCAN format• Ethertype 0x88b5• Different MAC addresses• Acknowledgments#wireshark -X lua_script:ethcan.lua
local sll_tab =DissectorTable.get("sll.ltype")
local can_hdl =sll_tab:get_dissector(0x000C)
local eth_tab =DissectorTable.get("ethertype")
eth_tab:add(0x88b5, can_hdl)

Arnaud Lebrun
Jonathan-Christofer Demayclass SocketCAN(Packet):name = "SocketCAN"
fields_desc = [BitEnumField("EFF", 0, 1, {0:"Disabled", 1:"Enabled"}),BitEnumField("RTR", 0, 1, {0:"Disabled", 1:"Enabled"}),BitEnumField("ERR", 0, 1, {0:"Disabled", 1:"Enabled"}),XBitField("id", 1, 29),
FieldLenField("dlc", None, length_of="data", fmt="B"),ByteField("__pad", 0),
ByteField("__res0", 0),
ByteField("__res1", 0),
StrLenField("data", "", length_from = lambda pkt: pkt.dlc),]
def extract_padding(self, p):
return "",pbind_layers(Ether, SocketCAN, type=0x88b5)

31

CANSPYa Platform for Auditing CAN Devices

The OBD-II use case• No need to physically cut anything• Buy a Goodthopter-compatible OBDII-to-DB9 cable• Build its female counterpart ($10 worth of components)• Setup the DUAL-CAN extension properly• Have fun• Several interesting cases• Professional/consumer car diagnostic tools• Usage-based policies from insurance companies

DO TRY THISAT HOME• Air-pollution control from law enforcement• They expose sensitive networks/hosts
Arnaud Lebrun
Jonathan-Christofer Demay32

CANSPYa Platform for Auditing CAN Devices

Demonstration bench
Man-In-The-Middle

Emulated ECUs
OBD2 Diagnostics

CAN2

MITM

ETH

Emulated ECUs

CAN1

OBD2 Device

Arnaud Lebrun
Jonathan-Christofer Demay33

CANSPYa Platform for Auditing CAN Devices

Demonstration bench

OBD2 Diagnostics

CAN2

MITM

ETH

Emulated ECUs

CAN1Start ofemulation

Start offiltering (frame modification)

Arnaud Lebrun
Jonathan-Christofer Demay34

CANSPYa Platform for Auditing CAN Devices

Demonstration bench• What about buffer overflows ?
• ISO-TP layer provided for Scapy
OBD2 Diagnostics• Identify fragmented responses• E.g., VIN request (17 ASCII characters)

CAN2• Increase response length

MITM• Debug and exploit

ETH

Emulated ECUs

CAN1

• We need more Scapy layers !
• For documented standards (e.g., SAE J1939)• For proprietary standards (i.e., reversing…)
Arnaud Lebrun
Jonathan-Christofer Demay35

CANSPYa Platform for Auditing CAN Devices

Thank you foryour attention
https://bitbucket.org/jcdemay/canspy

Arnaud Lebrun
Jonathan-Christofer Demay36

CANSPYa Platform for Auditing CAN Devices