Getting Started with Internet of Vehicles Security - CAN Simulation
Tags: penetration
Published: 2023-04-12 21:53:49

---
title: Getting Started with Internet of Vehicles Security - CAN Simulation
published: true
date: 2023-04-12 10:41:00 UTC
tags: Penetration
canonical_url: https://tutorialboy24.blogspot.com/2023/03/getting-started-with-internet-of.html
---

 

[![](https://blogger.googleusercontent.com/img/a/AVvXsEgG5O6yZ-Ad8feyKT4qqoCGWg5ilhzxaHhPjBxNcMyiIvyJ6ykUEiBIQc8_DDdfzqypO7xlv07afCKSNMfF2JTtMeiF7zByLryaCadlCZqoeJWK0E356sfeKSLPHpy4NW-QHPioycgu8IOL0XcRruRXLbT7mJe-CexMUiwQA2NuqzCmLe-ct2IIm7zFkg=w640-h360)](https://blogger.googleusercontent.com/img/a/AVvXsEgG5O6yZ-Ad8feyKT4qqoCGWg5ilhzxaHhPjBxNcMyiIvyJ6ykUEiBIQc8_DDdfzqypO7xlv07afCKSNMfF2JTtMeiF7zByLryaCadlCZqoeJWK0E356sfeKSLPHpy4NW-QHPioycgu8IOL0XcRruRXLbT7mJe-CexMUiwQA2NuqzCmLe-ct2IIm7zFkg)

## Introduction

Internet of Vehicles security is currently a popular development direction, but most people are stuck here because its entry threshold is too high (no real car). So I summed up the relevant information on the Internet and wrote this article so that students who study the security of the Internet of Vehicles can simulate what it feels like to control a car. This article uses Ubuntu to simulate the sending and receiving packets of the car CAN bus for operation. Learn, and then follow me step by step to open the door to the security of the Internet of Vehicles!

## CAN

CAN bus, also known as Controller Area Network the abbreviation of CAN bus, is a feature-rich vehicle bus standard. It is designed to allow microcontrollers and instruments on the network to communicate with each other without the need for a host. It is based on a messaging protocol and was originally designed to use multiplexed communication cables in vehicles to reduce copper wire usage, and has since been adopted by other industries as well. Simply put, it is a communication protocol used to control vehicle functions, such as door unlocking, turn signals, brakes, accelerators, etc. Why use the CAN protocol? Simply put, it is cheap and easy to use.

## CAN bus characteristics

### Security:

CAN is a low-level protocol that does not support any inherent security features. There is also no encryption in standard CAN, which allows these network data to be intercepted. In most applications, applications need to deploy their own security mechanisms, such as authenticating incoming commands or the presence of certain devices on the network. Someone else could try to insert messages on the bus if proper security measures are not implemented. Although passwords exist for some safety-critical functions such as modifying firmware, programming keys, or controlling anti-lock brakes, these systems are not commonly implemented and the number of key pairs is limited.

### Communication mechanism:

multi-master - that is, each node has the ability to access the bus.

### Addressing mechanism:

Message distinction: No node address is set, and messages are distinguished by message identifiers.

### Frame type:

a data frame, remote frame, error frame, overload frame, frame interval

### Attack method:

- Application packet fuzz testing

- Dos attack test

- Replay attack

Since the data packets on the CAN bus do not have any encryption, these data packets can be intercepted and eavesdropped. Since the vehicle network uses the CAN protocol for communication, we can think that the function of the Internet of Vehicles is also to send and exchange data through the CAN network. For example, if we turn on the left turn signal, the electrical signal will be sent to each device on the network through the CAN bus. Then the left turn signal will interpret the data packet and execute the instructions in the data packet.

## Attack method

The CAN bus attack methods we wrote in the CAN bus characteristics above include application message fuzzy testing, Dos attack testing, replay attacks, etc. Next, let’s practice replay attacks. As the name implies, data packets can be intercepted and then resent cause The vehicle is under our control and not the owner of the vehicle.

### Required Tools     

- Kali Linux

- ICSim (Dashboard Simulator)

- Socketcand (CAN network)

- Kayak (a CAN bus analysis tool based on SocketCAN)

ICSim is an open-source vehicle instrumentation simulator. The simulator contains two modules, controls and ICSim. The controls are responsible for generating simulated vehicle data, which are sent to the virtual CAN interface in the form of CAN messages, and ICSim reads from the virtual CAN interface. CAN message, and update the status of the corresponding parts on the instrument, such as vehicle speed, door status, etc.

#### Install Dependencies

```
sudo apt install libsdl2-dev libsdl2-image-dev can-utils maven autoconf
```

#### ICSIM 

```
git clone https://github.com/zombieCraig/ICSim.gitcd ICSim/
sudo make
```

 ![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiFVKr607YFTHvaCanDwMkbvqFe6QNEVOJsEAlGSua9fNRD6kX_tGZNgaT_8svU4BYDBonh_VvlXaNVVUeqXbhC2j_QgLlxxFDqvtDt38_Uw8x-vB4FdhAkLlFrVbSPJMjOFsnvmruEutatnnLDepCgSDpVsgaPgNeE4KQmkkwESjn-hCVEo0K87_vjbQ/w640-h380/ic.png)

#### Socketcand

```
git clone https://github.com/linux-can/socketcand.gitwget https://raw.githubusercontent.com/dschanoeh/socketcand/master/config.h.incd socketcand/
autoconf./configure
make cleanmakesudo make install
```

#### 
 ![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhMWR_hqCE0xsEnnbT2URHeS6ZfU-ilGoC5yFSl70ei-x9g79SirAW1jUtp0IlyVD6xpfVlDNPhIPzRicPUMlt-uPa4Olctud2Qmo4CT3QGObhAGHRo6DgUj7MPXYuhbxMkI3EvnlzzC22mImDlOp6QaEq5ryJj1i_H1pDomD8AFS7jYWNfkKX0wt3RQw/w640-h370/sp.png)

 ![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgmpV60E41V-lRona8d4GLEYuQPG0bvJusKYUF9JvGHytffEzZB6vuO2EO3YldmR4CfjbX4Ys4-OyI4SLh3OMjnaXVb7o49ZFvCO6Q8IiBmRRErwsxYmUdk7r1h0HMvpkMgFSdo6WPjNdocw21edQom4NGE4K5BbA3AC0LXjapicFecSEy1wS9WeuA-8w/w640-h354/ed.png)
  

 ![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjyHOnb0D5f3hHbstpDqj2Z0nosGacLG1AzxH6vPQYY1ifVUlEsIA-zM3g79yimM64ps8rxkBxi1r-mueJVEwSC79OhHgqGiT6lf9qc4Ys_VkhJdu5igYAZkrcg0X4Jc5Z7vyohEvR3s4EW3y5uEk4IXL_A5bXVFqdtM5Ot4ZvAP1bRqyl00qw0mVxgQg/w640-h364/e.png)

#### Kayak

`git clone https://github.com/dschanoeh/Kayak.git``cd Kayak/
mvn clean package`

[![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj_GW9vUFQUyr635nyOfMKmux5FWErHOUFT-uIzOD0T2KWOwmLuGtrhu-WRFm5mJXZChxwRsr7qvdIsWUY27FfiEJl2CsUdkNaW3FwRstl9Hczyo3L0Ax0tfMQYvfY4SQzu09Jjfay2naQpm4Q-mkQ9T-85-QCZhlds69qVdYjPZC0SuQfXBqR1xfbBgA/w640-h302/ss.png)](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj_GW9vUFQUyr635nyOfMKmux5FWErHOUFT-uIzOD0T2KWOwmLuGtrhu-WRFm5mJXZChxwRsr7qvdIsWUY27FfiEJl2CsUdkNaW3FwRstl9Hczyo3L0Ax0tfMQYvfY4SQzu09Jjfay2naQpm4Q-mkQ9T-85-QCZhlds69qVdYjPZC0SuQfXBqR1xfbBgA/s645/ss.png)

  

At this point, all installation is complete.

### Start Attacking

First set the vcan (virtual CAN) interface

`sudo modprobe can``sudo modprobe vcan``sudo ip link add dev vcan0 type vcan``sudo ip link set up vcan0`

[![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjs8VUL_qk3tTMKdfYXR1UaQAuFvxNJ0Ak24_e4tTVMHhxMVUeM9-xQ1Ul-zApqZaIBZAuWQ3m_dLLCIIyJifAQTKSwqvnBZO0QiVIBflzgTdH-01JF4g7tVQ6j8tMvfBAzC34ly7issEW1fqq3EMT29m4MJ9H5tMC2riguv3weueV4lnlFwL5I1_GumQ/w640-h460/yt.png)](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjs8VUL_qk3tTMKdfYXR1UaQAuFvxNJ0Ak24_e4tTVMHhxMVUeM9-xQ1Ul-zApqZaIBZAuWQ3m_dLLCIIyJifAQTKSwqvnBZO0QiVIBflzgTdH-01JF4g7tVQ6j8tMvfBAzC34ly7issEW1fqq3EMT29m4MJ9H5tMC2riguv3weueV4lnlFwL5I1_GumQ/s639/yt.png)
  

Open the Dashboard Simulator

`./icsim vcan0`

 ![](https://blogger.googleusercontent.com/img/a/AVvXsEjp1r3KAJl_06NGp1vkF_w5AGWKK-exrirBbFxw_sNysyck_NlfsiBe-V3giyy9Mxrcf5YYtL5mYpIEMbNstyN0O4n4lnf-RU8DUR9yeDaPwDbYGd-iBSqSbWjQZ0E9WjWd2jaMRHuZZnYuUqgTrkUnha6NPfmEa1mJqcmCyJPYlSX2lODps94RfQshlw=w640-h332)
  

Open the dashboard controller

`./controls vcan0`

 ![](https://blogger.googleusercontent.com/img/a/AVvXsEgq88zRf_SMb0dsYDkUHl34YQaENa0LFaYry8Z_V5lP6oPpYvg_4KMzSr6ajNrS_NJEF2ZSIHdA4tiSczTqcrh0l5U-_TUXmMe3dmFsts_vd-AiD5eAy6I7sefk7-TLITUK9Xl_-I29g_znXUFjRss32MXUzwKPV0VDNy-D8g9KbEqkqdbGsA2vPfN8wQ=w640-h486)
  

#### Controls

**Function**                  **control button**

turn signal        Keyboard left and right keys

speed                Keyboard up and down keys

open the door        Right SHIFT key + A

close the car doorLeft SHIFT key + A

open all doors        Left SHIFT key + Right SHIFT key

close all doors        Right SHIFT key + Left SHIFT key

[![](https://blogger.googleusercontent.com/img/a/AVvXsEiybm-xi2i8j4o_pL9cxT4hTnayBvRdEOeKj7wTs8tb4M7aI0NGU0a6FUFQctR7un1nuLnyGKklc5BNAFksjfwBLFqIDS2uf50phPdlsKSIzuAmyRBntM9CoMmcGxV874rhhFGSoZRMdWbZgVBe6I4pxC5tFx2BoRRXu-MrrL2MD2ZwnUnrWGubtW8DYw=w640-h290)](https://blogger.googleusercontent.com/img/a/AVvXsEiybm-xi2i8j4o_pL9cxT4hTnayBvRdEOeKj7wTs8tb4M7aI0NGU0a6FUFQctR7un1nuLnyGKklc5BNAFksjfwBLFqIDS2uf50phPdlsKSIzuAmyRBntM9CoMmcGxV874rhhFGSoZRMdWbZgVBe6I4pxC5tFx2BoRRXu-MrrL2MD2ZwnUnrWGubtW8DYw)
  

Use candump to capture packets

`candump vcan0 -l`

  

[![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjeheeAOJ-_CDEIsw23ndK9k3rfBnkWE7__NEkMgw9u0_mVTQFrOxWozfF7ivPt9gcZOBGFnO6m0nXvaQEI3SGfcBSZ7iNS7tdpZyqoFWDYlrm3lXEbH4HAKZcbgW26YWT0E8UiNOalBgXG7YBjoPTSxWmdFZSuo6BncptaXuem7mGYklHlqu237Y2zSQ/w640-h346/ff.png)](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjeheeAOJ-_CDEIsw23ndK9k3rfBnkWE7__NEkMgw9u0_mVTQFrOxWozfF7ivPt9gcZOBGFnO6m0nXvaQEI3SGfcBSZ7iNS7tdpZyqoFWDYlrm3lXEbH4HAKZcbgW26YWT0E8UiNOalBgXG7YBjoPTSxWmdFZSuo6BncptaXuem7mGYklHlqu237Y2zSQ/s694/ff.png)
  

See the captured package, because the CAN is constantly communicating, the package will be very large.

[![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh3825C1Nvoi_9qMyGl0Li4CjWNTrDWuJePaHNsvDv1WMWcWiIlVwIGo67Rx-pGGZknapgAqiRAJQuWIdRtA48CxLs1ei7XW0JWHEJnmMXdhreE-03w-PSpedgWSvhDS6uAc04no6-Ts9z2wp1oJyqkwFobxbAIwLC0GVsOo-Ch-svr1oOn3e7KtkA8AQ/w640-h458/ii.png)](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh3825C1Nvoi_9qMyGl0Li4CjWNTrDWuJePaHNsvDv1WMWcWiIlVwIGo67Rx-pGGZknapgAqiRAJQuWIdRtA48CxLs1ei7XW0JWHEJnmMXdhreE-03w-PSpedgWSvhDS6uAc04no6-Ts9z2wp1oJyqkwFobxbAIwLC0GVsOo-Ch-svr1oOn3e7KtkA8AQ/s642/ii.png)

  

Next, we find the data packets controlling the vehicle on the CAN network to attack him.

Listen to capture packets, then open and close all car doors.

More than 10,000 packages were caught.

[![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhQj9LddlwQG6GZztM2UCtgYBU0m6cBv07ZizMmCam9DLFth2Z0xiUV2BPsUFnAcBVOoCsppFg_pogGoKFzH7kTohQbVf60sU-vrUUgPvOJcYRxOQ0HzS7_UTzbtu2XUZxSkt1-ICI_s4nYmWj4CjtREm1wsHrURkmPohnzHMKNV6xuizJKU_JhdZR9-g/w640-h454/ij.png)](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhQj9LddlwQG6GZztM2UCtgYBU0m6cBv07ZizMmCam9DLFth2Z0xiUV2BPsUFnAcBVOoCsppFg_pogGoKFzH7kTohQbVf60sU-vrUUgPvOJcYRxOQ0HzS7_UTzbtu2XUZxSkt1-ICI_s4nYmWj4CjtREm1wsHrURkmPohnzHMKNV6xuizJKU_JhdZR9-g/s638/ij.png)
  

Next, we use the dichotomy method to delete half at a time to find the package that closes the car door.

Finally, the package that opens all the doors is found by dichotomy:

`(1668507963.222323) vcan0 19B#000000000000`

[![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgYWc4DjAjIyJPfPtlbpt5Cy0i7-hAsDu44EdOGne6xKo1q01Y1f6ELCSZNMassPo10LufcnZtby0Phbv5IleN_uUaE1Eggpzvx6UswaUMnVh0SbF3lLO-rAo4YffDas81BlgF_KhWzo6BmW2PGtLwH4w2wBVEZf8FDOr-NzGW5uYi1Lw37Y3lIxRNkSw/w640-h168/i.png)](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgYWc4DjAjIyJPfPtlbpt5Cy0i7-hAsDu44EdOGne6xKo1q01Y1f6ELCSZNMassPo10LufcnZtby0Phbv5IleN_uUaE1Eggpzvx6UswaUMnVh0SbF3lLO-rAo4YffDas81BlgF_KhWzo6BmW2PGtLwH4w2wBVEZf8FDOr-NzGW5uYi1Lw37Y3lIxRNkSw/s724/i.png)
  

Among them, 19B is the device identifier, look for 19B in the data packet.

`grep 19B candump-2023-03-22_052559.log ``(1668507960.512530) vcan0 244#000000019B
(1668507962.233563) vcan0 19B#00000F000000
(1668507963.222323) vcan0 19B#000000000000
(1668507963.517110) vcan0 244#000000019B
(1668507964.208966) vcan0 19B#00000F000000
(1668507965.319056) vcan0 244#000000019B`

[![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh8hziga1fHXWPiEdvvpB1vsPMFB0TkXOcjkDPFLrWogY3DvghKSlgJOjnn4TcO2G6twX4-lMpuRVfOyYrAMfIzO4rjoLQZQWCcXUnirMwUq_pA4dq90fE-WNjo-S1jygVna6l2M9vFgxXNHxB8MiKNifzoq4q5-0uhwtH-oLqMm8Ln3DV_Sm2WAxtyng/w640-h182/u.png)](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh8hziga1fHXWPiEdvvpB1vsPMFB0TkXOcjkDPFLrWogY3DvghKSlgJOjnn4TcO2G6twX4-lMpuRVfOyYrAMfIzO4rjoLQZQWCcXUnirMwUq_pA4dq90fE-WNjo-S1jygVna6l2M9vFgxXNHxB8MiKNifzoq4q5-0uhwtH-oLqMm8Ln3DV_Sm2WAxtyng/s540/u.png)
  

We can see one of them 19B#00000F000000. If we get to 19B#000000000000open all the doors, then we also perform the operation of closing all the doors later. It can be guessed 19B#00000F000000that all the doors are closed.

As can be seen above, this data packet is controlled by the third byte.

`(1668507962.233563) vcan0 19B#00000F000000``(1668507963.222323) vcan0 19B#000000000000`

The packet that locks all doors will represent the nibble as a hex F. Breaking this down into binary yields 16 possible combinations of gates.

binaryhexadecimal

00000

00011

00102

00113

01004

01015

01106

01117

10008

10019

1010a

1011b

1100c

1101d

1110e

1111f

Try different car doors controlled by characters.

charactercar door

8right rear door

4left rear door

2right front door

1left front door

Suppose 1 is the action of locking the door and 0 is the action of unlocking the door. So when we identify our door, the identified door gets the command to lock it and the other doors get the command to unlock it. For example, the binary value of character 8 is 1000, so it means lock the door, open the door, open the door, open the door.

You can try to see if C has closed the two rear doors and opened the front two doors.

[![](https://blogger.googleusercontent.com/img/a/AVvXsEg0knlCkxrfHof7JnuqPd0m94bke_sv4dqY5r0EjDL3zCyrr5HoXZm-Vp2ngL_pjCnnqDLPgUYR-anxaw2JpflWMGpRBXxjtnUWjHwH5QbZyp2cwbw6YjEFo7StyRSYOlb_ioHLCSK7x-8bD_In96icBoCh5aNhMLzbpkXQuhcz9gDq1RvFt3DfCMnbOg=w640-h352)](https://blogger.googleusercontent.com/img/a/AVvXsEg0knlCkxrfHof7JnuqPd0m94bke_sv4dqY5r0EjDL3zCyrr5HoXZm-Vp2ngL_pjCnnqDLPgUYR-anxaw2JpflWMGpRBXxjtnUWjHwH5QbZyp2cwbw6YjEFo7StyRSYOlb_ioHLCSK7x-8bD_In96icBoCh5aNhMLzbpkXQuhcz9gDq1RvFt3DfCMnbOg)
  

At this point, you can control the switch of each door. In the same way, steering and throttle are the same principles.

## References

- [https://ieeexplore.ieee.org/document/9058628](https://ieeexplore.ieee.org/document/9058628)

- [https://www.sciencedirect.com/science/article/abs/pii/S0045790622003561](https://www.sciencedirect.com/science/article/abs/pii/S0045790622003561)

- [https://www.ncbi.nlm.nih.gov/pmc/articles/PMC9460802/](https://www.ncbi.nlm.nih.gov/pmc/articles/PMC9460802/)