Please%20read%20the%20text%20carefully.%20Identify%20the%20main%20topic%20and%20key%20points%20covered%20in%20the%20text.%20%0AWrite%20a%20concise%20summary%20of%20the%20text%20in%20exactly%203%20bullets%20in%20markdown,%20focusing%20solely%20on%20the%20main%20topic%20and%20key%20points%20you%20identified.%20Your%20output%20should%20contain%20only%20the%20summary%20text%20itself.%20Do%20not%20include%20any%20explanations,%20introduction,%20or%20other%20extraneous%20text%20like%20%22%20Here%20is%20a%20concise%20summary...%22.%20The%20summary%20should%20be%20able%20to%20stand%20alone.%20%0AHere%20is%20the%20text%20to%20summarize:%0A%3Ctext%3E%0A%0A%0AWelcome%20to%20the%20blog%20of%20Dr.%20Ken%20Tindell,%20CTO%20of%20Canis%20Automotive%20Labs.%20This%20blog%20is%20focused%20on%20the%20work%20Canis%20is%20doing%20on%20CAN%20bus%20and%20CAN%20security,%20but%20also%20covers%20the%20design%20of%20embedded%20software%20and%20hardware%20for%20automotive%20systems%20and%20the%20Yes%20We%20Can%20project%20at%20Canis%20that%20develops%20hardware,%20software%20and%20tools%20for%20CAN%20bus:%20the%20CANHack%20toolkit%20for%20injecting%20faults%20into%20the%20CAN%20protocol,%20CANPico%20and%20CANHack%20hardware%20boards%20for%20the%20Raspberry%20Pi%20Pico,%20and%20the%20can2%20logic%20analyzer%20CAN%20protocol%20decoder.%0AShare%0A%09%E2%80%A2%09%0A%09%E2%80%A2%09%0A%09%E2%80%A2%09%0A%0A%09%E2%80%A2%09%0A%0AKen%20CTO%20of%20Canis%20Automotive%20Labs%0ACAN%20Injection:%20keyless%20car%20theft%0AThis%20is%20a%20detective%20story%20about%20how%20a%20car%20was%20stolen%20-%20and%20how%20it%20uncovered%20an%20epidemic%20of%20high-tech%20car%20theft.%20It%20begins%20with%20a%20tweet.%20In%20April%202022,%20my%20friend%20Ian%20Tabor%20tweeted%20that%20vandals%20had%20been%20at%20his%20car,%20pulling%20apart%20the%20headlight%20and%20unplugging%20the%20cables.%0A%0AIt%20seemed%20like%20pointless%20vandalism,%20the%20kind%20of%20thing%20that%20makes%20it%20impossible%20to%20have%20nice%20things.%20Then%20three%20months%20later%20it%20happened%20again.%0A%0AThis%20time%20the%20bumper%20was%20pulled%20away%20and%20the%20headlight%20unplugged.%20But%20it%20turned%20out%20neither%20incident%20was%20vandalism,%20because%20a%20couple%20of%20days%20later:%0A%0AThe%20car%20was%20gone.%20And%20it%20looks%20like%20the%20headlight%20was%20how%20it%20was%20stolen.%20Ian%20is%20a%20cybersecurity%20researcher%20in%20the%20automotive%20space%20and%20has%20previously%20been%20awarded%20bug%20bounties%20for%20finding%20vehicle%20vulnerabilities,%20and%20I%20initially%20thought%20from%20reading%20his%20tweet%20that%20this%20might%20be%20a%20trophy%20hack.%20But%20it%20turns%20out%20not:%20Ian%E2%80%99s%20neighbour%20had%20their%20Toyota%20Land%20Cruiser%20stolen%20shortly%20after.%20For%20Ian%20this%20is%20personal%20and%20he%20wanted%20to%20know%20just%20how%20they%20stole%20the%20car.%20After%20all,%20it%E2%80%99s%20got%20sophisticated%20car%20security%20systems,%20including%20an%20engine%20immobilizer.%20How%20did%20they%20drive%20these%20cars%20away%3F%0AIan%20did%20some%20more%20sleuthing,%20starting%20with%20the%20%E2%80%98MyT%E2%80%99%20telematics%20system%20that%E2%80%99s%20included%20in%20a%20lot%20of%20Toyota%20cars.%20The%20automotive%20industry%20has%20been%20adding%20built-in%20diagnostic%20systems%20to%20cars%20for%20decades.%20It%E2%80%99s%20called%20%E2%80%98on-board%20diagnostics%E2%80%99%20(or%20OBD%20for%20short)%20and%20when%20an%20Electronic%20Control%20Unit%20(or%20ECU)%20detects%20a%20fault,%20it%20records%20a%20code.%20In%20the%20industry,%20it%E2%80%99s%20called%20%E2%80%98dropping%20a%20DTC%E2%80%99%20(or%20Diagnostic%20Trouble%20Code).%20The%20MyT%20system%20will%20send%20DTCs%20up%20to%20Toyota%20servers,%20and%20the%20MyT%20app%20can%20show%20them.%0A%0AThese%20are%20codes%20that%20indicate%20what%20the%20detected%20fault%20is%20and%20when%20it%20occurred.%20Some%20DTCs%20include%20a%20%E2%80%98freeze%20frame%E2%80%99%20-%20a%20collection%20of%20sensor%20data%20around%20the%20time%20of%20the%20fault,%20to%20help%20a%20workshop%20mechanic%20try%20to%20diagnose%20the%20fault%20(it%20might%20be%20the%20speed%20of%20the%20vehicle,%20the%20temperature%20outside,%20the%20battery%20voltage,%20that%20kind%20of%20thing).%20In%20modern%20cars,%20ECUs%20are%20connected%20together%20with%20a%20communications%20link,%20running%20a%20protocol%20called%20CAN%20bus%20(CAN%20stands%20for%20Controller%20Area%20Network).%20It%20was%20invented%20more%20than%2030%20years%20ago,%20and%20is%20used%20today%20in%20more%20than%20cars:%20it%E2%80%99s%20built%20in%20to%20boats,%20farm%20equipment,%20aircraft,%20construction%20equipment,%20and%20even%20spacecraft%20(there%E2%80%99s%20a%20CAN%20bus%20orbiting%20Mars%20right%20now).%20One%20of%20the%20ways%20an%20ECU%20will%20diagnose%20a%20fault%20is%20if%20it%20doesn%E2%80%99t%20hear%20from%20another%20ECU%20it%20needs%20to%20talk%20to,%20and%20this%20is%20often%20done%20with%20a%20timeout:%20if%20a%20CAN%20message%20isn%E2%80%99t%20received%20regularly%20then%20after%20some%20time%20without%20hearing%20anything%20the%20listener%20assumes%20there%E2%80%99s%20a%20fault%20with%20the%20CAN%20bus%20or%20the%20other%20ECU.%20And%20sometimes%20it%E2%80%99s%20obvious%20the%20CAN%20bus%20has%20failed:%20if%20an%20ECU%E2%80%99s%20own%20messages%20are%20not%20sent,%20for%20example,%20or%20the%20CAN%20bus%20interface%20hardware%20says%20that%20communication%20has%20been%20lost.%0AIt%20turns%20out%20that%20around%20the%20theft%20of%20the%20car,%20Ian%E2%80%99s%20car%20dropped%20a%20lot%20of%20DTCs.%0AIn%20the%20front%20of%20the%20RAV4%20there%20is%20an%20ECU%20that%20controls%20the%20lights%20(the%20high%20and%20low%20beam%20headlights%20and%20the%20turn%20indicators).%20In%20most%20cars%20there%20is%20such%20an%20ECU%20because%20the%20days%20of%20there%20being%20a%20simple%20switch%20to%20turn%20on%20lights%20are%20long%20gone:%20lights%20are%20smart,%20and%20include%20things%20like%20motors%20to%20level%20the%20headlights%20(so%20when%20the%20car%20is%20loaded%20with%20heavy%20luggage,%20the%20lights%20are%20turned%20to%20compensate),%20steering%20headlights%20to%20illuminate%20the%20corners,%20to%20automatically%20detect%20if%20the%20lights%20have%20failed,%20to%20turn%20on%20pumps%20to%20spray%20water%20on%20the%20lights,%20and%20so%20on.%20And%20on%20the%20RAV4,%20it%E2%80%99s%20to%20also%20choose%20which%20LEDs%20in%20a%20grid%20are%20lit%20up%20to%20not%20dazzle%20oncoming%20drivers%20but%20still%20light%20the%20rest%20of%20the%20road.%0AThe%20DTCs%20showed%20that%20communication%20with%20the%20lighting%20control%20ECU%20was%20lost.%20This%20isn%E2%80%99t%20surprising%20since%20the%20thieves%20had%20ripped%20the%20cables%20out%20of%20it.%20But%20the%20DTCs%20also%20showed%20that%20lots%20of%20systems%20had%20failed:%20the%20control%20of%20the%20front%20cameras,%20the%20hybrid%20engine%20control%20system,%20and%20so%20on.%20How%20could%20that%20be%3F%20This%20was%20the%20next%20clue:%20the%20ECUs%20probably%20hadn%E2%80%99t%20failed,%20but%20rather%20the%20communication%20to%20them%20had%20been%20lost,%20and%20the%20diagnostics%20had%20flagged%20this%20as%20a%20fault.%20The%20common%20factor:%20CAN%20bus.%0AIan%20did%20some%20more%20sleuthing%20around%20the%20dark%20web,%20sites%20that%20talked%20about%20how%20to%20steal%20cars,%20hunted%20around%20forums,%20and%20found%20YouTube%20videos%20on%20car%20thefts.%20He%20tracked%20down%20a%20web%20site%20selling%20more%20than%20a%20hundred%20products%20for%20by-passing%20car%20security,%20from%20programming%20fake%20key%20fobs%20to%20%E2%80%98emergency%20start%E2%80%99%20devices%20(a%20fiction%20that%20these%20products%20are%20for%20owners%20who%20have%20lost%20their%20keys%20or%20somehow%20reputable%20locksmiths%20will%20use%20these).%0AThe%20prices%20are%20eye-watering%20(up%20to%20%E2%82%AC5000)%20for%20an%20ordinary%20owner,%20but%20for%20a%20gang%20of%20car%20thieves%20this%20is%20an%20investment.%20There%20are%20products%20targeting%20many%20car%20models,%20including%20from%20Jeep,%20Maserati,%20Honda,%20Renault,%20Jaguar,%20Fiat,%20Peugeot,%20Nissan,%20Ford,%20BMW,%20Volkswagen,%20Chrysler,%20Cadillac,%20GMC%20-%20and%20Toyota.%0AFor%20Toyota,%20the%20%E2%80%98emergency%20start%E2%80%99%20system%20is%20a%20bit%20of%20electronics%20hidden%20inside%20a%20JBL%20Bluetooth%20speaker%20case.%20This%20gives%20thieves%20plausible%20deniability:%20if%20stopped%20by%20the%20police,%20they%20aren%E2%80%99t%20at%20first%20sight%20carrying%20obvious%20car%20theft%20tools,%20but%20what%20looks%20like%20an%20innocent%20music%20device.%20The%20web%20site%20lists%20the%20models%20of%20cars%20%E2%80%98supported%E2%80%99%20by%20the%20theft%20device:%20Lexus%20models%20including%20the%20ES,%20LC,%20LS,%20NX,%20RX%20and%20Toyota%20models%20including%20the%20GR%20Supra,%20Prius,%20Highlander,%20Land%20Cruiser%20-%20and%20RAV4.%20Ian%20had%20discussions%20with%20Noel%20Lowdon%20of%20vehicle%20forensics%20company%20Harper%20Shaw%20about%20this%20device%20and%20decided%20to%20buy%20one%20to%20reverse%20engineer%20it.%20At%20this%20point%20I%20was%20called%20in%20to%20help%20with%20how%20the%20device%20works%20on%20the%20CAN%20bus.%0AIan%20calls%20me%20a%20CAN%20guru:%20I%20worked%20with%20Volvo%20on%20their%20first%20CAN-based%20car%20platform%20and%20architected%20the%20first%20low-cost%20CAN%20hardware%20for%20small%20chips%20used%20in%20cars,%20my%20start-up%20company%20produced%20the%20CAN%20networking%20software%20used%20by%20Volvo%20in%20all%20their%20cars,%20and%20I%20was%20part%20of%20the%20team%20that%20won%20the%20Volvo%20Technology%20Award%20for%20the%20CAN%20networking%20system%20(my%20start-up%20was%20later%20sold%20to%20Bosch%20and%20today%20is%20a%20thriving%20part%20of%20Bosch%E2%80%99s%20ETAS%20group%20for%20in-car%20software%20technology).%20Together,%20we%20started%20to%20tear%20apart%20the%20theft%20device%20to%20see%20how%20it%20worked.%0ABefore%20I%20go%20any%20further,%20I%20must%20make%20a%20disclaimer:%20this%20story%20will%20not%20disclose%20details%20that%20make%20it%20easier%20for%20someone%20to%20build%20a%20copy%20of%20the%20theft%20device.%20The%20creator%20is%20a%20criminal%20and%20neither%20I%20nor%20Ian%20will%20ever%20help%20these%20people.%20The%20purpose%20of%20telling%20this%20story%20is%20to%20help%20law%20enforcement%20and%20car%20makers%20to%20do%20something%20about%20these%20devices%20(at%20the%20end%20I%20will%20give%20some%20ways%20that%20car%20makers%20and%20their%20suppliers%20can%20update%20their%20ECU%20software%20to%20defeat%20thieves).%20I%20also%20want%20to%20emphasize%20that%20this%20is%20not%20something%20specific%20to%20Toyota:%20Ian%20investigated%20the%20RAV4%20because%20his%20stolen%20car%20was%20a%20RAV4,%20and%20other%20manufacturers%20have%20car%20models%20that%20can%20be%20stolen%20in%20a%20similar%20way.%0AA%20new%20theft%20technique:%20CAN%20Injection%0AModern%20cars%20are%20protected%20against%20thefts%20by%20using%20a%20smart%20key%20that%20talks%20to%20the%20car%20and%20exchanges%20cryptographic%20messages%20so%20that%20the%20key%20proves%20to%20the%20car%20that%20it%E2%80%99s%20genuine.%20This%20messaging%20scheme%20is%20generally%20reckoned%20to%20be%20secure%20and%20can%E2%80%99t%20be%20broken%20without%20huge%20resources%20(of%20the%20type%20only%20a%20nation%20state%20has).%20But%20thieves%20don%E2%80%99t%20attack%20the%20hard%20part:%20they%20find%20a%20weakness%20and%20work%20around%20it.%20In%20the%20past,%20this%20was%20done%20with%20a%20Relay%20Attack.%20Normally,%20the%20car%20asks%20the%20key%20by%20radio%20to%20prove%20itself,%20and%20then%20when%20it%20receives%20a%20valid%20message%20back%20by%20radio%20it%20unlocks%20the%20car%20and%20disables%20the%20engine%20immobilizer.%20The%20thieves%20found%20a%20simple%20way%20around%20this:%20they%20used%20a%20hand-held%20radio%20relay%20station%20that%20beams%20the%20car%E2%80%99s%20message%20into%20the%20home%20to%20where%20the%20keys%20are%20kept,%20and%20then%20relays%20the%20message%20from%20the%20keys%20back%20to%20the%20car.%20The%20car%20accepts%20the%20relayed%20message%20as%20valid%20because%20it%20is%20-%20the%20real%20keys%20were%20used%20to%20unlock%20the%20car.%20Now%20that%20people%20know%20how%20a%20relay%20attack%20works%20generally%20possible%20to%20defeat%20it:%20car%20owners%20keep%20their%20keys%20in%20a%20metal%20box%20(blocking%20the%20radio%20message%20from%20the%20car)%20and%20some%20car%20makers%20now%20supply%20keys%20that%20go%20to%20sleep%20if%20motionless%20for%20a%20few%20minutes%20(and%20so%20won%E2%80%99t%20receive%20the%20radio%20message%20from%20the%20car).%20Faced%20with%20this%20defeat%20but%20being%20unwilling%20to%20give%20up%20a%20lucrative%20activity,%20thieves%20moved%20to%20a%20new%20way%20around%20the%20security:%20by-passing%20the%20entire%20smart%20key%20system.%20They%20do%20this%20with%20a%20new%20attack:%20CAN%20Injection.%0AThe%20diagram%20below%20shows%20how%20ECUs%20in%20a%20RAV4%20are%20wired%20together%20with%20CAN%20bus%20(it%E2%80%99s%20a%20very%20simplified%20diagram%20and%20doesn%E2%80%99t%20show%20every%20ECU%20or%20CAN%20bus).%0A%0AThere%20are%20three%20CAN%20buses%20shown:%0A%09%E2%80%A2%09A%20control%20CAN%20bus%20(which%20has%20ECUs%20for%20headlights,%20door%20control,%20telematics,%20aircon,%20etc.)%0A%09%E2%80%A2%09A%20powertrain%20CAN%20bus%20(which%20has%20ECUs%20for%20engine%20control,%20the%20hybrid%20battery%20and%20motor%20control,%20etc.)%0A%09%E2%80%A2%09An%20autonomy%20CAN%20bus%20(which%20has%20ECUs%20for%20radar,%20forward%20looking%20camera,%20and%20self-parking)%0AThe%20way%20CAN%20Injection%20works%20is%20to%20get%20into%20the%20car%E2%80%99s%20internal%20communication%20(i.e.%20the%20CAN%20bus)%20and%20inject%20fake%20messages%20as%20if%20from%20the%20smart%20key%20receiver,%20essentially%20messages%20saying%20%E2%80%9CKey%20validated,%20unlock%20immobilizer%E2%80%9D.%20In%20most%20cars%20on%20the%20road%20today,%20these%20internal%20messages%20aren%E2%80%99t%20protected:%20the%20receivers%20simply%20trust%20them.%20You%20can%20see%20how%20it%20can%20work%20in%20the%20RAV4%20from%20the%20wiring%20diagram%20above:%20thieves%20break%20into%20the%20wiring%20for%20the%20red%20CAN%20bus%20(the%20one%20the%20smart%20key%20receiver%20ECU%20-%20shown%20in%20yellow%20-%20is%20connected%20to)%20and%20then%20use%20a%20simple%20electronic%20device%20to%20send%20CAN%20frames%20on%20to%20the%20red%20CAN%20bus%20to%20send%20fake%20%E2%80%9CKey%20is%20validated%E2%80%9D%20messages%20as%20if%20from%20the%20smart%20key%20receiver.%20The%20gateway%20ECU%20(a%20simple%20device%20that%20just%20copies%20certain%20CAN%20messages%20back%20and%20forth)%20will%20copy%20that%20fake%20message%20over%20to%20the%20green%20CAN%20bus,%20and%20the%20engine%20control%20system%20(shown%20in%20blue)%20will%20accept%20the%20message%20and%20deactivate%20the%20immobilizer%20function.%0AThe%20thieves%20can%20then%20use%20their%20CAN%20Injector%20device%20to%20send%20a%20different%20fake%20CAN%20message%20that%20the%20door%20ECU%20(also%20shown%20in%20blue)%20that%20in%20essence%20says%20%E2%80%9CKey%20is%20valid,%20unlock%20the%20doors%E2%80%9D.%20So%20they%20don%E2%80%99t%20even%20need%20to%20damage%20the%20car%20to%20break%20into%20it:%20they%20can%20simply%20open%20the%20door,%20get%20in,%20and%20drive%20the%20car%20away%20-%20all%20without%20needing%20the%20key.%0AThe%20CAN%20injection%20device%0AHere%E2%80%99s%20what%20the%20CAN%20Injector%20theft%20device%20that%20Ian%20bought%20looks%20like:%0A%0ALooks%20just%20like%20a%20JBL%20Bluetooth%20speaker.%20And%20inside%20it%20mostly%20still%20is%20(it%E2%80%99s%20missing%20the%20speaker).%0A%0AThe%20CAN%20Injector%20is%20grafted%20on%20to%20the%20JBL%20circuit%20board,%20enclosed%20in%20a%20big%20blob%20of%20resin.%20Ian%20melted%20the%20resin%20with%20a%20heat%20gun,%20worked%20out%20how%20it%E2%80%99s%20wired%20to%20the%20JBL%20circuit%20board,%20and%20even%20worked%20out%20what%20the%20chips%20are%20(using%20the%20technique%20of%20matching%20pinouts%20against%20chips%20until%20the%20right%20pattern%20is%20found).%0AIt%20turns%20out%20it%E2%80%99s%20about%20$10%20of%20components:%20a%20PIC18F%20chip%20that%20contains%20CAN%20hardware,%20plus%20software%20pre-programmed%20into%20the%20chip%20(known%20as%20firmware),%20a%20CAN%20transceiver%20(a%20standard%20CAN%20chip%20that%20turns%20digital%20signals%20from%20the%20CAN%20hardware%20on%20the%20PIC18F%20into%20the%20analog%20voltages%20sent%20on%20CAN%20wires),%20and%20an%20extra%20circuit%20connected%20to%20the%20CAN%20transceiver%20(more%20on%20this%20shortly).%20The%20device%20takes%20its%20power%20from%20the%20speaker%20battery,%20and%20connects%20to%20a%20CAN%20bus.%20A%20CAN%20bus%20is%20basically%20a%20pair%20of%20wires%20twisted%20together,%20and%20in%20a%20car%20there%20are%20several%20CAN%20buses%20joined%20together,%20either%20directly%20with%20connectors,%20or%20wired%20digitally%20via%20a%20gateway%20computer%20that%20copies%20some%20CAN%20messages%20back%20and%20forth%20between%20the%20CAN%20buses%20it%20is%20connected%20to.%0AThe%20theft%20device%20is%20designed%20to%20be%20connected%20to%20the%20control%20CAN%20bus%20(the%20red%20bus%20in%20the%20wiring%20diagram)%20to%20impersonate%20the%20smart%20key%20ECU.%20There%20are%20several%20ways%20to%20get%20to%20the%20wires%20for%20this%20CAN%20bus,%20the%20only%20requirement%20being%20that%20the%20wires%20need%20to%20come%20to%20the%20edge%20of%20the%20car%20so%20that%20they%20can%20be%20reached%20(wires%20buried%20deep%20in%20the%20car%20are%20impractical%20to%20reach%20by%20thieves%20trying%20to%20steal%20a%20parked%20car%20on%20the%20street).%20By%20far%20the%20easiest%20route%20in%20to%20that%20CAN%20bus%20on%20the%20RAV4%20is%20through%20the%20headlights:%20pulling%20the%20bumper%20away%20and%20accessing%20the%20CAN%20bus%20from%20the%20headlight%20connector.%20Other%20access%20would%20be%20possible:%20even%20punching%20a%20hole%20in%20a%20panel%20where%20the%20twisted%20pair%20of%20CAN%20wires%20goes%20past,%20cutting%20the%20two%20wires,%20and%20splicing%20in%20the%20CAN%20Injector%20would%20also%20work,%20but%20the%20diminished%20value%20of%20a%20car%20with%20a%20hole%20in%20it%20means%20thieves%20take%20the%20easiest%20route%20(Ian%E2%80%99s%20sleuthing%20found%20that%20mostly%20these%20cars%20are%20destined%20for%20export,%20sent%20via%20shipping%20container%20to%20places%20in%20Africa).%0AWhen%20first%20powered%20on,%20the%20CAN%20Injector%20does%20nothing:%20it%E2%80%99s%20listening%20for%20a%20particular%20CAN%20message%20to%20know%20that%20the%20car%20is%20ready.%20When%20it%20receives%20this%20CAN%20message%20it%20does%20two%20things:%20it%20starts%20sending%20a%20burst%20of%20CAN%20messages%20(at%20about%2020%20times%20per%20second)%20and%20it%20activates%20that%20extra%20circuit%20connected%20to%20its%20CAN%20transceiver.%20The%20burst%20of%20CAN%20messages%20contains%20a%20%E2%80%98smart%20key%20is%20valid%E2%80%99%20signal,%20and%20the%20gateway%20will%20relay%20this%20to%20the%20engine%20management%20ECU%20on%20the%20other%20bus.%20Normally,%20this%20would%20cause%20confusion%20on%20the%20control%20CAN%20bus:%20CAN%20messages%20from%20the%20real%20smart%20key%20controller%20would%20clash%20with%20the%20imposter%20messages%20from%20the%20CAN%20Injector,%20and%20this%20could%20prevent%20the%20gateway%20from%20forwarding%20the%20injected%20message.%20This%20is%20where%20that%20extra%20circuit%20comes%20in:%20it%20changes%20the%20way%20a%20CAN%20bus%20operates%20so%20that%20other%20ECUs%20on%20that%20bus%20cannot%20talk.%20The%20gateway%20can%20still%20listen%20to%20messages,%20and%20can%20of%20course%20still%20send%20messages%20on%20to%20the%20powertrain%20CAN%20bus.%20The%20burst%20repeats%2020%20times%20a%20second%20because%20the%20setup%20is%20fragile,%20and%20sometimes%20the%20gateway%20is%20not%20listening%20because%20its%20CAN%20hardware%20is%20resetting%20itself%20(because%20it%20thinks%20that%20being%20unable%20to%20talk%20is%20an%20indication%20of%20a%20fault%20-%20which%20in%20a%20way%20it%20is).%0AThere%20is%20a%20%E2%80%98Play%E2%80%99%20button%20on%20the%20JBL%20Bluetooth%20speaker%20case,%20and%20this%20is%20wired%20into%20the%20PIC18F%20chip.%20When%20this%20button%20is%20pressed,%20the%20burst%20of%20CAN%20messages%20changes%20slightly%20and%20they%20instruct%20the%20door%20ECU%20to%20unlock%20the%20doors%20(as%20if%20the%20%E2%80%98unlock%E2%80%99%20button%20on%20the%20wireless%20key%20had%20been%20pressed).%20The%20thieves%20can%20then%20unhook%20the%20CAN%20Injector,%20get%20into%20the%20car,%20and%20drive%20it%20away.%20There%20is%20CCTV%20of%20this%20taking%20place%20for%20another%20victim%20(if%20impatient,%20seek%20to%202%20minutes%2055):%0A%0AThe%20modified%20CAN%20transceiver%0ALet%E2%80%99s%20revisit%20that%20modification%20to%20the%20CAN%20transceiver%20that%20changes%20how%20CAN%20works%20(this%20section%20is%20going%20to%20go%20into%20detail%20about%20how%20CAN%20bus%20operates%20so%20feel%20free%20to%20skip%20to%20the%20section%20%E2%80%98Defeating%20the%20CAN%20Injector%E2%80%99%20where%20I%20discuss%20how%20Toyota%20and%20other%20manufacturers%20stop%20the%20thieves).%0ANormally%20CAN%20operates%20as%20a%20giant%20AND%20gate,%20where%20the%20bus%20will%20read%20logic%201%20if%20all%20devices%20are%20inputting%20logic%201,%20and%20will%20read%20logic%200%20if%20any%20device%20inputs%20a%20logic%200.%20It%20works%20by%20the%20bus%20%E2%80%98floating%E2%80%99%20to%20what%E2%80%99s%20called%20a%20recessive%20level:%20the%20two%20CAN%20wires%20H%20and%20L%20are%20each%20at%20about%202.5V,%20and%20the%20difference%20between%20them%20is%20close%20to%20zero%20(the%20level%20is%20floating%20because%20a%20CAN%20transceiver%20in%20recessive%20state%20is%20high%20impedance).%20This%20is%20translated%20by%20the%20CAN%20transceiver%20into%20a%20logic%201%20(and%20the%20RX%20pin%20of%20the%20transceiver%20outputs%20a%20logic%201%20to%20the%20CAN%20hardware%20embedded%20in%20the%20main%20processor%20chip).%20Any%20CAN%20controller%20can%20drive%20the%20bus%20to%20a%20dominant%20level%20(usually%20about%204.5V%20on%20CAN%20H%20and%200.1V%20on%20CAN%20L,%20with%20a%20difference%20of%20about%204.4V).%20But%20the%20CAN%20Injector%20has%20a%20different%20CAN%20transceiver:%20it%20has%20a%20mode%20where%20it%20actively%20drives%20a%20recessive%20state,%20and%20no%20other%20CAN%20device%20can%20drive%20the%20bus%20to%20a%20dominant%20state%20(one%20device%20can%20move%20the%20CAN%20H%20and%20L%20voltages%20a%20little%20bit,%20but%20not%20enough%20to%20change%20the%20state%20to%20logic%200).%0AIan%20has%20built%20a%20benchtop%20CAN%20bus%20for%20the%20CAN%20Injector,%20replicating%20its%20electronics%20and%20adding%20pseudo%20ECUs%20(Ian%20has%20a%20lot%20of%20experience%20of%20this:%20he%20built%20a%20portable%20%E2%80%98car%20in%20a%20case%E2%80%99%20emulator%20that%20is%20used%20to%20demonstrate%20car%20hacking%20techniques).%20A%20logic%20analyzer%20and%20oscilloscope%20can%20measure%20the%20effects%20of%20the%20CAN%20Injector%20on%20a%20real%20CAN%20bus.%20Here%20is%20a%20trace%20of%20an%20%E2%80%98ECU%E2%80%99%20sending%20a%20CAN%20frame%20before%20the%20CAN%20Injector%20enables%20the%20dominant-override%20circuit:%0A%0AThe%20lines%20of%20the%20logic%20analyzer%20trace%20are:%0A%09%E2%80%A2%09INJECT-TX:%20the%20TX%20pin%20into%20the%20CAN%20transceiver%20from%20the%20CAN%20Injector%E2%80%99s%20CAN%20controller%0A%09%E2%80%A2%09INJECT-CS:%20the%20override%20enable%20(enabled%20when%20high)%0A%09%E2%80%A2%09ECU-TX:%20the%20TX%20pin%20into%20the%20ECU%E2%80%99s%20CAN%20transceiver%20from%20the%20ECU%E2%80%99s%20CAN%20controller%0A%09%E2%80%A2%09CAN%20H%20and%20CAN%20L:%20the%20CAN%20high/low%20signals%20on%20the%20twisted-pair%20CAN%20bus%20(these%20are%20analog%20signals)%0A%09%E2%80%A2%09ECU-RX:%20the%20RX%20pin%20from%20the%20ECU%E2%80%99s%20CAN%20transceiver%20into%20the%20ECU%E2%80%99s%20CAN%20controller%0AThis%20is%20all%20normal%20and%20the%20CAN%20bus%20is%20operating%20correctly.%0ASleep%20and%20wake%0AAt%20the%20start%20of%20the%20theft%20process,%20the%20CAN%20Injector%20sends%20a%20CAN%20frame%20to%20wake%20the%20CAN%20bus.%20When%20cars%20are%20switched%20%E2%80%98off%E2%80%99%20they%20aren%E2%80%99t%20really%20off:%20the%20ECUs%20will%20go%20into%20low-power%20sleep%20mode,%20with%20a%20tiny%20power%20consumption.%20They%20are%20%E2%80%98woken%E2%80%99%20by%20a%20frame%20on%20the%20CAN%20bus%20(which%20typically%20comes%20from%20a%20door%20ECU%20or%20a%20wireless%20key%20ECU).%20In%20the%20early%20days%20of%20CAN,%20this%20wake-up%20would%20be%20an%20edge%20on%20the%20CAN%20bus%20that%20is%20the%20start-of-frame%20(SOF)%20field%20of%20a%20CAN%20frame.%20But%20it%20turned%20out%20that%20radio%20interference%20could%20cause%20an%20edge%20on%20the%20CAN%20bus%20and%20cars%20would%20wake%20up%20for%20no%20reason.%20It%20became%20a%20problem%20for%20car%20owners%20who%20parked%20at%20the%20airport%20(where%20the%20powerful%20radar%20sweep%20would%20put%20an%20edge%20on%20the%20CAN%20bus)%20because%20when%20they%20came%20back%20from%20holiday%20they%20would%20discover%20the%20car%20battery%20was%20drained.%20Today,%20the%20state-of-the-art%20in%20wakeup%20is%20to%20use%20a%20System%20Basis%20Chip%20that%20is%20a%20combined%20CAN%20tranceiver,%20power%20regulator%20and%20wake-up%20circuit%20in%20one%20chip:%20the%20wake-up%20circuit%20has%20minimal%20CAN%20logic%20and%20is%20able%20to%20recognize%20a%20proper%20CAN%20frame,%20and%20because%20noise%20from%20a%20radar%20sweep%20is%20never%20going%20to%20look%20like%20a%20proper%20CAN%20frame,%20there%20is%20no%20spurious%20wake-up.%0AThe%20CAN%20Injector%20wakeup%20frame%20is%20sent%20several%20times%20a%20second%20until%20it%20receives%20a%20CAN%20frame%20from%20a%20woken%20ECU%20on%20the%20CAN%20bus.%20The%20CAN%20Injector%20at%20this%20point%20has%20not%20enabled%20the%20dominant-override%20circuit,%20and%20so%20the%20woken%20ECU%20can%20send%20its%20CAN%20frame.%20The%20CAN%20Injector%20then%20engages%20the%20dominant-override%20and%20starts%20periodically%20sending%20its%20impostor%20CAN%20frame%20(called%20a%20spoof)%20pretending%20to%20be%20the%20smart%20key.%0ADominant-override%0AThe%20recessive/dominant%20mechanism%20is%20core%20to%20how%20CAN%20bus%20works:%20it%20uses%20this%20to%20work%20out%20which%20frame%20should%20go%20next%20(called%20arbitration),%20and%20it%20uses%20it%20to%20signal%20errors.%20The%20primary%20purpose%20of%20the%20dominant-override%20in%20the%20CAN%20Injector%20is%20to%20block%20other%20CAN%20devices%20from%20transmitting%20so%20that%20there%20is%20no%20clash%20when%20the%20spoof%20and%20the%20real%20frame%20are%20send%20at%20the%20same%20time.%20This%20clash%20would%20normally%20cause%20a%20long-lasting%20%E2%80%98loop%E2%80%99%20of%20errors%20on%20the%20CAN%20bus,%20and%20is%20actually%20the%20topic%20of%20my%20first%20CAN%20Quiz%20question:%0A%0AWhen%20the%20CAN%20Injector%20actively%20enables%20its%20dominant-override%20then%20it%20effectively%20blocks%20other%20CAN%20devices%20from%20transmitting%20on%20the%20bus%20and%20forces%20its%20own%20spoof%20frames%20to%20be%20the%20only%20ones%20received.%20The%20blocking%20doesn%E2%80%99t%20just%20stop%20other%20frames,%20it%20also%20blocks%20the%20error%20mechanism%20of%20the%20CAN%20protocol,%20so%20that%20other%20ECUs%20cannot%20raise%20an%20error%20to%20stop%20the%20CAN%20Injector%20spoof%20frames.%20This%20is%20the%20secondary%20purpose%20of%20the%20dominant-override%20mechanism:%20it%20is%20able%20to%20defeat%20CAN%20security%20hardware.%20For%20example,%20the%20silicon%20vendor%20NXP%20has%20product%20called%20the%20Stinger%20that%20is%20a%20CAN%20transceiver%20with%20security%20logic%20built-in%20that%20detects%20a%20spoof%20frame%20and%20destroys%20it%20with%20a%20CAN%20error.%20The%20CAN-HG%20system%20from%20Canis%20Labs%20is%20also%20able%20to%20detect%20and%20destroy%20spoof%20frames%20with%20CAN%20errors.%20But%20approaches%20based%20on%20CAN%20errors%20cannot%20defeat%20the%20CAN%20Injector%20with%20its%20modified%20transceiver%20-%20because%20that%20prevents%20any%20single%20CAN%20device%20from%20signalling%20a%20dominant%20state.%0AWhen%20blocked%20from%20setting%20a%20dominant%20state,%20the%20CAN%20controller%20gets%20stuck%20in%20a%20loop%20trying%20to%20send%20a%20CAN%20frame,%20gives%20up,%20and%20then%20may%20try%20again%20later.%20This%20was%20the%20subject%20of%20my%20second%20CAN%20Quiz%20question,%20and%20used%20a%20particular%20CAN%20controller%20(that%20is%20almost%20never%20seen%20in%20production%20vehicles)%20to%20illustrate%20the%20problem%20(a%20real%20ECU%20will%20have%20a%20more%20sophisticated%20network%20management%20approach%20to%20how%20it%20tries%20to%20rejoin%20a%20CAN%20bus%20after%20what%20appears%20to%20be%20a%20hardware%20fault).%0AThe%20logic%20analyzer%20trace%20below%20shows%20how%20an%20%E2%80%98ECU%E2%80%99%20on%20Ian%E2%80%99s%20benchtop%20CAN%20bus%20tries%20to%20send%20its%20own%20CAN%20frame%20but%20fails%20when%20the%20dominant-override%20is%20enabled.%0A%0AIn%20the%20trace,%20INJECT-CS%20is%20high,%20enabling%20the%20override.%20INJECT-TX%20is%20high,%20a%20recessive%20bit.%20Normally%20this%20is%20CAN%20idle,%20and%20other%20CAN%20controllers%20can%20start%20sending%20a%20CAN%20frame%20by%20entering%20arbitration.%20The%20ECU-TX%20line%20shows%20a%20CAN%20frame%20beginning%20with%20start-of-frame%20(which%20in%20CAN%20is%20a%20dominant%20bit)%20but%20it%20cannot%20drive%20the%20bus%20to%20a%20logic%200%20(ECU-RX%20is%20stuck%20at%20logic%201),%20and%20so%20goes%20through%20the%20defined%20CAN%20error%20recovery%20process%20(this%20is%20described%20in%20more%20detail%20in%20the%20second%20CAN%20Quiz%20question).%20The%20voltages%20on%20the%20CAN%20H%20and%20CAN%20L%20wires%20are%20shown,%20and%20the%20%E2%80%98ECU%E2%80%99%20has%20managed%20to%20move%20these%20voltages%20a%20small%20amount,%20but%20not%20enough%20for%20this%20to%20be%20seen%20by%20any%20CAN%20transceivers%20(including%20its%20own%20transceiver)%20as%20a%20dominant%20bit%20(as%20seen%20in%20the%20ECU-RX%20line%20on%20the%20trace%20that%20is%20stuck%20a%20logic%201).%0AThere%20is%20a%20potential%20problem%20with%20blocking%20ECUs%20from%20sending%20dominant%20bits:%20the%20CAN%20ACK%20field.%20The%20ACK%20field%20in%20CAN%20frame%20is%20a%201-bit%20field%20and%20is%20used%20by%20a%20transmitter%20to%20know%20that%20there%20is%20at%20least%20one%20device%20listening%20and%20that%20has%20received%20the%20frame%20OK.%20A%20transmitter%20sends%20a%20logic%201%20for%20the%20ACK%20(i.e.%20a%20recessive%20bit)%20and%20expects%20to%20read%20it%20back%20as%20a%20logic%200%20because%20normally%20all%20receivers%20send%20a%20logic%200%20(i.e.%20a%20dominant%20bit)%20to%20say%20they%20have%20received%20the%20frame%20OK.%20If%20a%20receiver%20tries%20to%20send%20a%20logic%200%20but%20reads%20back%20a%20logic%201%20then%20the%20CAN%20protocol%20treats%20that%20as%20an%20error%20-%20and%20it%20won%E2%80%99t%20accept%20the%20frame.%20And%20that%20would%20mean%20that%20the%20gateway%20ECU%20in%20the%20RAV4%20would%20not%20receive%20the%20spoofed%20smart%20key%20ECU%20frame.%20And%20in%20turn%20that%20would%20mean%20the%20spoofed%20frame%20would%20not%20be%20forwarded%20to%20the%20powertrain%20CAN%20bus%20for%20the%20engine%20management%20system%20to%20see.%20However,%20it%20turns%20out%20not%20to%20be%20an%20actual%20problem:%20because%20multiple%20CAN%20receivers%20are%20sending%20a%20logic%200%20at%20the%20same%20time,%20and%20when%20they%20all%20do%20this%20together,%20the%20combined%20transceivers%20are%20able%20to%20overpower%20the%20dominant-override%20circuit%20and%20drive%20a%20dominant%20state%20on%20to%20the%20bus.%20This%20can%20be%20seen%20in%20the%20following%20trace:%20there%20are%20a%20total%20of%20four%20%E2%80%98ECUs%E2%80%99%20on%20the%20benchtop%20CAN%20bus%20here,%20and%20together%20they%20are%20able%20to%20move%20the%20voltages%20to%20the%20level%20required%20for%20a%20dominant%20state%20on%20the%20bus%20and%20a%20logic%200%20in%20the%20ACK%20field%20of%20the%20spoof%20frame%20sent%20from%20the%20CAN%20Injector.%20And%20so%20all%20ECUs%20receive%20the%20CAN%20Injector%20spoof%20frame%20OK.%0A%0ADefeating%20the%20CAN%20Injector%0AFirst,%20the%20good%20news.%20A%20CAN%20Injector%20can%20be%20defeated,%20and%20it%20can%20be%20defeated%20with%20a%20pure%20software%20fix,%20so%20existing%20cars%20can%20be%20updated%20and%20once%20again%20we%20can%20avoid%20fitting%20a%20mechanical%20steering%20wheel%20lock%20at%20the%20end%20of%20each%20journey.%20There%20are%20two%20levels%20of%20fix:%0A%09%E2%80%A2%09Quick%20and%20dirty.%20This%20relies%20on%20knowledge%20of%20how%20the%20CAN%20Injector%20currently%20works%20and%20can%20make%20a%20small%20change%20that%20stops%20it%20working.%20It%20won%E2%80%99t%20be%20a%20permanent%20fix:%20the%20criminal%20who%20designed%20the%20CAN%20Injector%20can%20then%20respond%20with%20changes,%20and%20it%20will%20likely%20start%20working%20again.%20But%20this%20can%20buy%20time%20for%20the%20next%20fix.%0A%09%E2%80%A2%09Cryptographic%20messaging.%20This%20uses%20encryption%20and%20authentication%20codes%20to%20protect%20CAN%20frames%20so%20that%20the%20CAN%20Injector%20cannot%20create%20valid%20spoof%20frames.%20If%20implemented%20properly,%20this%20is%20a%20permanent%20fix.%20But%20it%20requires%20some%20effort%20(more%20on%20that%20shortly).%0AThese%20fixes%20apply%20to%20all%20makes%20and%20models%20of%20car%20vulnerable%20to%20a%20CAN%20Injection%20attack%20(this%20is%20an%20industry-wide%20issue,%20not%20limited%20to%20any%20manufacturer%20or%20model).%0AQuick%20and%20dirty%20fix%0AThe%20CAN%20Injector%20at%20present%20causes%20mayhem%20on%20the%20control%20CAN%20bus:%20by%20driving%20the%20bus%20recessive,%20it%20causes%20ECU%20CAN%20controllers%20to%20fail%20to%20transmit,%20and%20to%20fail%20with%20a%20particular%20type%20of%20CAN%20error:%20a%20dominant-to-recessive%20bit%20error.%20This%20is%20very%20rare,%20and%20usually%20indicates%20a%20hardware%20fault%20(you%20can%20see%20this%20from%20the%20DTCs%20dropped).%20The%20gateway%20ECU%20(or%20engine%20immobilizer%20ECU%20in%20a%20different%20model)%20could%20monitor%20its%20CAN%20controller%20to%20see%20if%20these%20errors%20occurred,%20and%20follow%20Ian%20Fleming%E2%80%99s%20maxim:%20%E2%80%9COnce%20is%20happenstance,%20twice%20is%20coincidence,%20and%20three%20times%20is%20enemy%20action%E2%80%9D.%20So%20the%20gateway%20could%20be%20re-programmed%20to%20only%20forward%20a%20smart%20key%20CAN%20frame%20if%20it%20has%20recently%20transmitted%20a%20CAN%20frame%20without%20problems,%20and%20in%20the%20recent%20past%20there%20have%20been%20no%20bit%20errors%20of%20this%20type%20on%20the%20CAN%20bus.%20The%20definition%20of%20%E2%80%98recent%E2%80%99%20could%20be%20a%20few%20seconds,%20which%20would%20solve%20the%20problem%20of%20false%20positives%20(where%20there%20actually%20was%20a%20rare%20but%20real%20fault):%20the%20driver%20can%20simply%20wait%20a%20short%20time%20and%20try%20again.%0AThis%20quick%20and%20dirty%20fix%20can%20be%20defeated%20by%20changing%20the%20CAN%20Injector%20(we%20won%E2%80%99t%20be%20disclosing%20how).%20But%20the%20brutally%20crude%20way%20this%20CAN%20Injector%20works%20today%20suggests%20that%20would%20take%20a%20while.%20This%20should%20buy%20car%20makers%20some%20time%20to%20apply%20a%20proper%20fix.%0ACryptographic%20messaging%20fix%0AThe%20proper%20solution%20to%20a%20CAN%20Injection%20attack%20is%20to%20adopt%20a%20Zero%20Trust%20approach%20to%20CAN%20-%20or%20at%20least%20to%20specific%20messages%20on%20specific%20CAN%20buses.%20A%20Zero%20Trust%20approach%20means%20that%20an%20ECU%20does%20not%20automatically%20trust%20messages%20from%20other%20ECUs%20but%20requires%20some%20proof%20that%20they%20are%20genuine.%20A%20good%20approach%20to%20this%20is%20to%20use%20a%20Hardware%20Security%20Module%20(HSM),%20and%20the%20automotive%20industry%20have%20defined%20a%20standard%20for%20one%20(called%20Secure%20Hardware%20Extensions,%20or%20SHE).%20Normally,%20this%20would%20mean%20using%20chips%20that%20include%20the%20hardware,%20making%20a%20retrofit%20impossible.%20Fortunately,%20a%20software%20emulation%20of%20an%20HSM%20is%20possible,%20and%20Canis%20Labs%20have%20done%20that%20for%20the%20SHE%20HSM:%20it%20requires%20about%203Kbyte%20of%20code%20and%20200%20bytes%20of%20RAM.%20And%20using%20the%20software%20to%20encode%20or%20decode%20a%20protected%20CAN%20message%20takes%20about%2040%20microseconds%20of%20CPU%20time.%20ECU%20firmware%20typically%20will%20have%20some%20spare%20memory,%20and%20would%20likely%20need%20about%200.05%25%20of%20the%20total%20CPU%20time.%20In%20other%20words,%20it%20ought%20to%20be%20straightforward%20to%20fit%20this%20into%20new%20firmware%20(in%20fact,%20Canis%20Labs%20have%20been%20successfully%20working%20with%20the%20US%20Army%20under%20an%20R%26D%20contract%20to%20retrofit%20an%20encryption%20scheme%20for%20CAN%20to%20military%20vehicle%20ECUs).%0AThis%20approach%20of%20using%20encryption%20does%20mean%20more%20significant%20changes%20than%20the%20quick%20and%20dirty%20fix:%0A%09%E2%80%A2%09Cryptographic%20messages%20use%20extra%20CAN%20bandwidth%20to%20carry%20authentication%20codes%20(the%20CryptoCAN%20scheme%20devised%20by%20Canis%20Labs%20uses%20a%20pair%20of%20encrypted%20CAN%20frames%20to%20send%20one%20plaintext%20CAN%20frame;%20other%20schemes%20use%20half%20the%20payload%20of%20a%20CAN%20frame).%0A%09%E2%80%A2%09ECUs%20have%20to%20be%20provisioned%20with%20secret%20keys%20(typically%20at%20the%20factory)%20so%20that%20each%20vehicle%20uses%20different%20keys%20(otherwise%20the%20creator%20of%20a%20CAN%20Injector%20just%20needs%20to%20buy%20one%20vehicle%20and%20use%20sophisticated%20benchtop%20tools%20to%20extract%20the%20keys%20once%20and%20then%20they%20can%20break%20into%20any%20car).%20ECUs%20may%20also%20need%20to%20have%20their%20keys%20re-provisioned:%20if%20an%20ECU%20needs%20to%20be%20replaced%20or%20moved%20to%20a%20different%20vehicle,%20it%20needs%20to%20have%20new%20keys%20that%20match%20the%20ones%20stored%20in%20the%20other%20ECUs.%0AThe%20first%20change%20is%20not%20too%20bad%20to%20undertake,%20since%20only%20one%20or%20two%20CAN%20frames%20need%20to%20be%20protected%20(and%20so%20only%20very%20little%20CAN%20bus%20bandwidth%20overall%20is%20needed).%20But%20the%20second%20one%20requires%20that%20key%20management%20and%20distribution%20infrastructure%20be%20built%20(which%20at%20least%20must%20include%20tools%20to%20inject%20keys,%20and%20a%20database%20that%20stores%20the%20keys).%20Adopting%20the%20SHE%20HSM%20standard%20does%20at%20least%20mean%20that%20these%20tools%20are%20standardized%20and%20off-the-shelf%20solutions%20are%20possible.%20However,%20car%20makers%20have%20learned%20over%20the%20years%20to%20act%20carefully%20when%20making%20changes%20to%20vehicle%20systems:%20what%20appears%20to%20be%20quick%20and%20simple%20often%20turns%20out%20to%20not%20be,%20and%20even%20a%20simple%20fix%20requires%20extensive%20testing%20to%20make%20sure%20there%20are%20no%20unintended%20consequences.%20So%20it%20will%20take%20some%20time%20to%20implement%20this.%0ANext%20steps%0AIan%20has%20tried%20to%20get%20in%20touch%20with%20Toyota%20to%20discuss%20the%20CAN%20Injection%20attack,%20and%20to%20offer%20help,%20but%20hasn%E2%80%99t%20had%20much%20success.%20Part%20of%20the%20problem%20is%20that%20any%20large%20corporation%20finds%20it%20difficult%20to%20respond%20to%20security%20issues.%20And%20part%20of%20the%20problem%20is%20that%20this%20isn%E2%80%99t%20a%20vulnerability%20disclosure%20and%20so%20the%20processes%20that%20Toyota%20does%20have%20in%20place%20are%20not%20appropriate.%20The%20normal%20vulnerability%20disclosure%20process%20is%20that%20an%20ethical%20hacker%20finds%20a%20vulnerability%20that%20criminals%20potentially%20could%20exploit,%20gets%20in%20touch%20with%20the%20vendor,%20who%20gets%20time%20to%20fix%20it.%20This%20is%20known%20as%20a%20Zero%20Day%20(because%20the%20manufacturer%20has%20to%20act%20quickly,%20having%20potentially%20just%20zero%20days%20to%20find%20a%20fix%20before%20a%20criminal%20exploits%20it).%20The%20CAN%20Injection%20attack%20is%20not%20a%20Zero%20Day:%20it%E2%80%99s%20more%20like%20a%20Minus%20365%20Day%20because%20criminals%20have%20already%20been%20exploiting%20it%20to%20steal%20cars%20(and%20extensively:%20there%20has%20been%20a%20spike%20in%20keyless%20car%20thefts,%20with%20law%20enforcement%20just%20assuming%20that%20these%20are%20relay%20attacks).%20There%20is%20no%20risk%20that%20describing%20a%20CAN%20Injection%20attack%20will%20lead%20to%20criminals%20exploiting%20it:%20they%20are%20already%20exploiting%20it%20widely,%20and%20their%20exploitation%20of%20it%20with%20Ian%E2%80%99s%20car%20was%20what%20caused%20Ian%20to%20become%20a%20digital%20forensic%20detective.%0AVehicle%20access%0ASo%20far,%20Ian%20has%20tried%20to%20get%20access%20to%20a%20RAV4%20to%20test%20that%20his%20benchtop%20CAN%20bus%20accurately%20captures%20the%20full%20behavior%20of%20the%20CAN%20Injector.%20Access%20would%20also%20allow%20the%20real%20CAN%20Injector%20to%20be%20tested%20in%20situ%20with%20tools%20(including%20an%20oscilloscope%20and%20logic%20analyzer).%20This%20can%E2%80%99t%20be%20done%20without%20access%20to%20a%20dealer%20workshop%20and%20a%20car,%20because%20the%20attack%20causes%20a%20rash%20of%20DTCs%20that%20have%20to%20be%20reset%20with%20the%20proper%20authorized%20tools.%20Getting%20access%20has%20not%20been%20possible%20so%20far.%20Any%20car%20maker%20or%20industry%20body%20that%20wishes%20to%20engage%20with%20CAN%20Injection%20attacks%20should%20feel%20free%20to%20get%20in%20touch.%0AFirmware%20reverse%20engineering%0AA%20full%20analysis%20of%20how%20the%20CAN%20Injector%20works%20should%20include%20reverse%20engineering%20its%20firmware.%20The%20PIC18F%20used%20in%20the%20CAN%20Injector%20has%20been%20locked%20to%20prevent%20its%20firmware%20from%20being%20read%20out,%20but%20there%20are%20at%20least%20two%20techniques%20to%20break%20that%20lock.%20However,%20neither%20can%20be%20done%20without%20risking%20destruction%20of%20the%20device%20and%20one%20of%20the%20techniques%20requires%20access%20to%20expensive%20specialist%20equipment.%20This%20goes%20beyond%20amateur%20sleuthing%20and%20requires%20proper%20resources.%20Ideally,%20an%20industry%20body%20dedicated%20to%20car%20security%20would%20take%20over%20the%20project%20and%20become%20a%20focal%20point%20for%20car%20makers%20who%20want%20to%20understand%20how%20thieves%20are%20using%20CAN%20Injection%20and%20adopt%20the%20most%20practical%20ways%20to%20defeat%20them.%0A03%20Apr%202023%0A%09%E2%80%A2%09CAN%0A%09%E2%80%A2%09%0A%C2%AB%20CAN%20Quiz%20Question%20%232:%20Answer%0AGet%20your%20app%20to%20Mars!%20%C2%BB%0A%0A%0Acomments%20powered%20by%20Disqus%0AExplore%0ACAN%20(16)%20CANHack%20(9)%20CAN%20security%20(8)%20CAN%20decoder%20(5)%20MicroPython%20(7)%20Python%20(3)%20Silicon%20design%20(1)%20CANPico%20(11)%20CANProbe%20(1)%20Raspberry%20Pi%20Pico%20(1)%20Raspberry%20Pi%204%20(1)%20Wireshark%20(1)%20MIN%20(1)%20CryptoCAN%20(2)%20HSM%20(1)%20Security%20gateway%20(1)%20CAN-HG%20(1)%20MQTT%20(1)%20MQTT-SN%20(1)%20MQTT-SN/CAN%20(1)%20firmware%20(1)%20can2%20(1)%20CVE-2023-29389%20(1)%0ACopyright%20%C2%A9%202023%20Canis%20Automotive%20Labs%20Ltd.%0AMediumish%20Jekyll%20Theme%20by%20WowThemes.net%0A%0A%3C/text%3E