CANSPY: A Platform for Auditing CAN Devices

Presented at Black Hat USA 2016, Aug. 3, 2016, 1:50 p.m. (50 minutes).

In the past few years, several tools have been released allowing hobbyists to connect to CAN buses found in cars. This is welcomed as the CAN protocol is becoming the backbone for embedded computers found in smartcars. Its use is now even spreading outside the car through the OBD-II connector: usage-based policies from insurance companies, air-pollution control from law enforcement or engine diagnostics from smartphones for instance. Nonetheless, these tools will do no more than what professional tools from automobile manufacturers can do. In fact, they will do less as they do not have knowledge of upper-layer protocols. Security auditors are used to dealing with this kind of situation: they reverse-engineer protocols before implementing them on top of their tool of choice. However, to be efficient at this, they need more than just being able to listen to or interact with what they are auditing. Precisely, they need to be able to intercept communications and block them, forward them or modify them on the fly. This is why, for example, a platform such as Burp Suite is popular when it comes to auditing web applications. In this talk, we present CANSPY, a platform giving security auditors such capabilities when auditing CAN devices. Not only can it block, forward or modify CAN frames on the fly, it can do so autonomously with a set of rules or interactively using Ethernet and a packet manipulation framework such as Scapy. It is also worth noting that it was designed to be cheap and easy to build as it is mostly made of inexpensive COTS. Last but not least, we demonstrate its versatility by turning around a security issue usually considered when it comes to cars: instead of auditing an electronic control unit (ECU) through the OBD-II connector, we are going to partially emulate ECUs in order to audit a device that connects to this very connector.

Presenters:

• Jonathan-Christofer Demay - Airbus Defence and Space
  Jonathan-Christofer Demay, PhD, is the current penetration testing team leader at AIRBUS Defence and Space. As a former academic researcher, he has been working on IDS bypassing, intrusion detection, and general network security. Now a consultant for various key industries and government bodies, he is working on incident response, penetration testing, and social engineering.
• Arnaud Lebrun - Airbus Defence and Space
  Arnaud Lebrun is a command and control engineer currently working at AIRBUS Defence and Space. He is focusing on security issues for several projects in the aerospace industry and related areas such as radioactive waste disposal facilities or large telescopes. He also supports the penetration testing team for perimeters that include ICS infrastructures or embedded electronics.

Links:

• https://www.blackhat.com/us-16/briefings.html#canspy-a-platform-for-auditing-can-devices
• https://infocon.org/cons/Black Hat/Black Hat USA/Black Hat USA 2016/Canspy - A Platform for Auditing Can Devices.mp4
• https://www.youtube.com/watch?v=1hPRcdwQioc
• https://www.blackhat.com/docs/us-16/materials/us-16-Demay-CANSPY-A-Platorm-For-Auditing-CAN-Devices.pdf
• https://www.blackhat.com/docs/us-16/materials/us-16-Demay-CANSPY-A-Platorm-For-Auditing-CAN-Devices-wp.pdf

Tags:

• Car Hacking

Similar Presentations:

• DEF CON 24 (2016) / CANSPY: A Framework for Auditing CAN Devices
• 31C3 (2014) / The Invisible Committee Returns with "Fuck Off Google": Cybernetics, Anti-Terrorism, and the ongoing case against the Tarnac 10
• Texas Cyber Summit 2019 / BT-1050 Shining a Light on Shadow IT in the Cloud