Automotive CAN Bus Hacking: The Ultimate Security Researcher’s Cheatsheet

Introduction: Understanding the CAN Bus

The Controller Area Network (CAN) bus is a robust vehicle bus standard designed to allow microcontrollers and devices to communicate with each other within a vehicle without a host computer. Developed by Robert Bosch GmbH in 1983 and officially released in 1986, the CAN bus has become the dominant network protocol in automotive applications.

Why CAN Bus Security Matters:

• Modern vehicles contain 70+ Electronic Control Units (ECUs) all connected via CAN
• Security vulnerabilities can lead to safety-critical issues
• Understanding the CAN bus is essential for automotive security research, diagnostics, and custom modifications
• Proper security testing helps manufacturers build more secure vehicles
• Legitimately researching vulnerabilities contributes to safer automotive systems

Core Concepts and Principles

CAN Bus Fundamentals

CAN Message Structure

+----------------+---------------+------+-------------+------+-----+--------+
| Arbitration ID | Remote Frame  | IDE  | Data Length | Data | CRC | ACK    |
| (11 or 29 bits)| Request (1bit)|(1bit)| Code (4bits)|(0-8B)|(15b)|(2bits) |
+----------------+---------------+------+-------------+------+-----+--------+

Common Vehicle Network Types

Hardware and Tools for CAN Bus Analysis

Essential Hardware

Software Tools

Step-by-Step CAN Bus Analysis Process

1. Preparation and Information Gathering

• Research target vehicle’s architecture (online resources, service manuals)
• Identify CAN bus access points (OBD-II port, direct connection points)
• Determine bit rates used in the vehicle (typically 250kbps or 500kbps for standard CAN)
• Understand legal implications and obtain proper authorization
• Document test plan and expected data capture process

2. Initial Connection and Monitoring

• Connect hardware interface to OBD-II port or direct CAN bus
• Configure interface for correct bit rate
• Begin passive monitoring to capture normal message flow
• Record baseline CAN traffic during various vehicle states:
  • Key off
  • Key on, engine off
  • Engine idling
  • Different driving conditions

3. Message Identification and Analysis

• Filter captured data to identify message patterns
• Look for periodic messages vs. event-driven messages
• Group messages by frequency
• Identify messages that change with specific vehicle actions
• Create a preliminary message database mapping IDs to possible functions

4. Signal Decoding

• Identify bit positions for specific vehicle parameters
• Look for counters, checksums, and multi-frame messages
• Create translation rules for physical values
• Validate decoding through controlled tests
• Document signal scaling factors and offsets

5. Advanced Analysis and Vulnerability Testing

• Replay captured messages to test responses
• Perform fuzzing tests on specific message IDs
• Test message injection under various conditions
• Analyze system responses to irregular message timing
• Document any unexpected behaviors or anomalies

CAN Bus Hacking Techniques

Message Sniffing and Logging

# Using can-utils on Linux
# Install prerequisites
sudo apt-get install can-utils

# Set up virtual CAN interface
sudo modprobe vcan
sudo ip link add dev vcan0 type vcan
sudo ip link set up vcan0

# Set up hardware interface (e.g., with SocketCAN)
sudo ip link set can0 type can bitrate 500000
sudo ip link set up can0

# Start logging CAN messages
candump can0 -l

# Monitor specific CAN ID
candump can0,123:7FF

# Display CAN traffic in readable format
cansniffer can0

Message Injection

# Send a single CAN frame with ID 0x123 and data 00 11 22
cansend can0 123#001122

# Send a remote frame
cansend can0 123#R

# Send messages repeatedly
cansequence can0 123 -v

# Replay a previously captured log
canplayer -I candump.log

UDS Diagnostics

# ISO-TP (Transport Protocol) setup for multi-frame messages
sudo modprobe can
sudo modprobe can_raw
sudo modprobe isotp

# Send diagnostic session control (service 0x10) request
isotpsend -s 7DF -d 7E8 can0 10 01

# Send ECU reset (service 0x11) request
isotpsend -s 7DF -d 7E8 can0 11 01

# Read DTC (service 0x19) request
isotpsend -s 7DF -d 7E8 can0 19 02 FF 00

# Security access (service 0x27) seed request
isotpsend -s 7DF -d 7E8 can0 27 01

Python Example: Basic CAN Monitoring

import can

# Create a bus instance
bus = can.interface.Bus(channel='can0', bustype='socketcan')

# Define a message listener
notifier = can.Notifier(bus, [can.Printer()])

# Alternatively, iteratively receive messages
for msg in bus:
    print(f"{msg.arbitration_id:X}: {msg.data.hex()}")
    
    # Filter for specific ID
    if msg.arbitration_id == 0x123:
        print("Found target message!")
        
        # Extract specific bytes or bits
        value = msg.data[2]  # Third byte
        print(f"Value: {value}")

Python Example: Message Injection

import can
import time

# Create a bus instance
bus = can.interface.Bus(channel='can0', bustype='socketcan')

# Create and send a message
msg = can.Message(
    arbitration_id=0x123,
    data=[0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77],
    is_extended_id=False
)
bus.send(msg)

# Send messages in a loop
try:
    while True:
        msg.data[0] += 1  # Increment first byte
        bus.send(msg)
        time.sleep(0.1)
except KeyboardInterrupt:
    print("Stopped by user")

Common Challenges and Solutions

Challenge: Unknown Bit Rate

Solutions:

• Try standard bit rates: 125kbps, 250kbps, 500kbps, 1Mbps
• Use an oscilloscope to measure CAN signal transitions
• Multi-protocol adapters may auto-detect bit rates
• Check service manuals for manufacturer specifications
• Use dedicated bit rate detection tools (CANHack)

Challenge: Message Authentication

Solutions:

• Analyze counter and checksum mechanisms
• Look for seed-key exchange patterns in authentication messages
• Capture full authentication sequences for analysis
• Verify if ECUs validate message timing or sequence
• Test if messages can be replayed or if they require fresh values

Challenge: Multiple CAN Buses

Solutions:

• Use vehicle documentation to identify gateway architecture
• Check pin mapping on OBD-II port (pins 6, 14 for CAN High/Low)
• Monitor activity on different suspected CAN lines
• Use a gateway analysis tool to map inter-network routing
• Label networks by function (powertrain, body, infotainment)

Challenge: Proprietary Extensions

Solutions:

• Document all deviations from standard CAN protocol
• Analyze timing and frame structure for patterns
• Compare against known manufacturer-specific protocols
• Use pattern recognition to identify encoding schemes
• Build a custom decoder for non-standard messages

Best Practices and Ethical Guidelines

Safety Considerations

• Never test on moving vehicles or on public roads
• Disconnect systems under test from safety-critical components when possible
• Have a plan to quickly restore normal operation
• Document all changes made during testing
• Maintain a separate test environment for potentially dangerous operations
• Always have a method to disable injected messages immediately

Ethical Testing Guidelines

• Always obtain proper authorization before testing
• Follow responsible disclosure processes for vulnerabilities
• Do not share security bypass methods publicly without manufacturer notification
• Consider safety implications of all research
• Prioritize driver and passenger safety over research goals
• Document findings thoroughly for educational and improvement purposes
• Stay updated on legal considerations in your jurisdiction

Documentation Best Practices

• Maintain detailed logs of all testing activities
• Document message IDs and their functions
• Record signal decoding information (bit position, scaling, offsets)
• Create visual representations of message timings
• Map the relationships between ECUs and message flows
• Include screenshots and capture files
• Document both successful and failed approaches

Advanced Topics and Techniques

Reverse Engineering CAN Signals

1. Differential Analysis

   • Record baseline data
   • Change one parameter at a time (e.g., press brake pedal)
   • Compare data to identify changing messages
   • Repeat for each vehicle function of interest

2. Bit-Flip Analysis

   • Identify target message
   • Generate variations with individual bits flipped
   • Inject variations and observe system response
   • Map which bits control which functions

3. Correlation Analysis

   • Log CAN data alongside physical measurements
   • Use statistical methods to correlate signals with physical values
   • Derive scaling formulas for sensor data

Security Testing Methodologies

Defensive Measures

• Message Authentication: How to identify and analyze authentication mechanisms
• Secure Gateway Implementation: Understanding gateway filtering and validation
• Intrusion Detection Systems: Recognizing anomaly detection on the CAN bus
• Segmentation: Best practices for network isolation in vehicle architecture
• Security by Design: Principles for designing secure automotive networks

Resources for Further Learning

Books and Publications

• “The Car Hacker’s Handbook” by Craig Smith
• “Controller Area Network Prototyping with Arduino” by Wilfried Voss
• “Embedded Security in Cars” by K. Lemke, C. Paar, and M. Wolf
• SAE J1939 Standards Documentation
• SAE J2534 Pass-Thru Interface Documentation

Online Resources

• OpenGarages.org
• DEFCON Car Hacking Village
• CANBus Triple Wiki
• Hackaday CAN Bus Projects
• PASTA – Portable Automotive Security Testbed

Communities and Forums

• Car Hacker’s Village Discord
• OpenGarages Forums
• Reddit r/CarHacking
• Stack Exchange Electrical Engineering (CAN bus tag)
• CAN in Automation (CiA) Organization

Tools and Software Repositories

• CANToolz
• c0f – CAN bus fingerprinting tool
• UDSim – UDS server simulator
• CANard – Python CAN analysis tool
• ICSim – Instrument Cluster Simulator

Security Research References

• “Comprehensive Experimental Analyses of Automotive Attack Surfaces” (USENIX Security)
• “Adventures in Automotive Networks and Control Units” (DEF CON 21)
• “A Survey of Remote Automotive Attack Surfaces” (Black Hat USA)
• “Hopping on the CAN Bus” (BlackHat Asia)
• “CAN Message Injection” (DEFCON 24)