I've loved cars since I was a kid. I've modified plenty of vehicles and this is by far the coolest thing I've ever done. We know how to change engines, turbos, mufflers, but what about the computer systems? You'll notice nowadays driving assists are everywhere. Things like lane keep assist, line spot detection, and even full self-driving. Question is, how easy is it to manipulate these systems and are there any safety concerns? You remember the scene from the Fast and the Furious with all those self-driving cars? Reality is, that isn't that far off of the truth. We completed this project in spring of 2019 while I was going to school for my information system security to plan. A special thanks to my project partner who I won't name here, but we had a hell of a time working on this project together. So how do you hack a car? One of the first avenues you explore is the CAN bus. Every car has a CAN bus. CAN stands for controller area now. The CAN bus is a vehicle standard designed to allow all the components stuck to each other. Things like your infotainment, your displays, your transmission. Anything that's got a microcontroller, they all communicate over the CAN bus. Originally developed for vehicles, it was adapted for numerous other applications. These are things like aviation equipment, elevators, 3D printers, lighting systems, robotics, and even building automation. Any of these implementations can be manipulated with the right knob. If you take a look at the image on screen, the terminal on the right is actual CAN data. You've you dealt the column, which is the time which the packet was sent, you have the ID column, which is the device or service. This could be lights, buttons, locks, displays, all that kind of stuff. And then you have the data column, which is the actual packet that's being sent to the device. This contains all of the data on off locked unlocked display this display that it's all contained in the data column. So how did we do it back to the day? For our project, we used a DB9 Dolby D cable and a can-tact reader. You're going to need a laptop or device that runs Linux, preferably Callie or Parrot, something that has CAN utils installed on it. Now like I said, things have changed a lot. The CAN-tact reader, you can't find them anywhere. You can actually do all this with a Flip-R-0 in a laptop. The last thing we needed of course was a car. You can use any car you want. All cars have a CAN bus, but we quickly found out not all cars have CAN bus on the OBD port. At the time, I had a 2001 BMW. We come to find out that European cars, there are OBD ports run on the ISO standard. ISO means they've got pin-out differences and voltage differences. My car has a CAN bus and the easiest way to get to that is the harness behind the cluster. I didn't want to take my car apart. So we found two other candidates, my buddy Chevy Colbert and my other friends Mazda3. Both of which have the CAN bus present on the OBD port. Ideally, you do this in a controlled environment in the lab. You can do it virtually as well, but work for what you've got. So we plugged everything in, ran the commands that are on screen, and away we went. This is how you sniff data with the hardware that we used. Now that you're all set up and sniffing data, start taking notes. This is where you're going to spend the majority of your time. We spent hours of trial and error just to get up to this point. Make sure that you take your notes. Only change one variable at a time. If you're going to do our PM, only do our PM. Don't screw around with a bunch of buttons and stuff because then you're trying to figure out what packet goes where and which ID is for what. Only do one thing at a time. As you can see, we've isolated some variables here. Now it's time to start forging data. So in this image here, you can see that we're sending some data over the canvas. We did that with the can send command. It'll be can send ID, hashtag, and then all the data. Start sending your data over and observe any changes. The two F0, that ID is for the traction control light on a cobalt, and then that packet data is to symbolize the light being on. You can even script it out so it continually sends the packet over the bus. First example, we have a live canvas data out of the cobalt. We've got the instrument cluster that's getting nothing on it. And then we're going to send the packet there with the ID 2 F0 to blink that traction control light. This was the first time we actually had any of this work. We absolutely lost it. Hours and hours of hard work. We were so happy to see that we were making some progress. Here's another example from the Mazda 3. You can see the packet is 09A. There's the correlating ID. We managed to get the hazard lights to flash. Okay, that's great. You got some lights to blink. What else do you got? Well, we actually figured out how to toggle the info menu on the Mazda 3. So the packet ID for that one is going to be 274. And you can see here as we forged the packet, we can flip through it without actually having to hit the button. Then we figured out our ultimate goal. We wanted to move a tacometer all the way to red line without car being on. So you notice the call but it's not on currently. Forged the packet with ID 110. Boom, there you go. We were super excited. There was a lot of doubt that we could even pull this off in the time frame that we had. But we figured it out. Here it is. Here's our proof. We're super happy with the result. Learned a lot and had a lot of fun doing it. I have a different car now than I did then. I get a 2019 Alontera. But it's got the lane keep assist and assisted steering. I'd be interested to see if there's any manipulation that I could do with that. If you're interested in cybersecurity, this is a really fun project to get involved with. Something that you can easily do on your own. It'll give you the ins and outs when you're testing and methodologies and notes kind of required for a job like this. It's pretty interesting. It's something cool that you can share with your friends. I've got some links down below for some further reading. If you want to check it out, Reddets got some really good threads that are fairly updated with some new tools and procedures to get you going. Thanks my true time. As always, we'll see you next time.