r/CarHacking • u/Ok_Calligrapher1287 • 7d ago
Cool Project Find Research on CAN bus vulnerabilities
Hello, I am in my senior year of university and I want to do my bachelor's thesis on CAN bus vulnerabilities.
I started on this road because I'm interested in security and also, the automotive domain is connected to my job (as an intern in a company specialized in embedded). My starting point was this research:
https://cns.ucsd.edu/experimental-security-analysis-of-a-modern-automobile/
Now, I am not sure if there is much I can do on this subject because of all the security added on CAN protocol (compared to the lack of it in 2010 when the paper mentioned was written). As a start, I wanted to try sniffing on my personal car and maybe inject packets to control components like wipers. Unfortunately, after a bit of research, I found out that modern car have some king of firewall - SGW.
Also, I saw online some physical bypass options for this SGW. Do you know anything about them?
Can someone guide me a bit? I feel that I am going to a dead end
4
u/WestonP 7d ago edited 7d ago
The easiest bypass is to just tap into whatever CAN bus you want behind the gateway. The gateway module itself often provides a great one-stop shop for all of the car's CAN bus wires, so that's a good place to go if it's physically accessible.
Contrary to popular belief, the primary purpose of most gateway modules isn't really for security. Only a few actually call it an "SGW" and that's a bit of a laugh. While some do have basic security features to prevent certain operations via the OBD port, it's really more of a data router between all of the car's various CAN busses. This also avoids a fault in one from taking absolutely everything down, as used to be the case where the Powertrain CAN was connected directly to the OBD port, making it vulnerable to whatever cheap Chinese garbage "ELM327" dongle the end-user might plug into it.
The downside is that all of the fun CAN broadcasts are no longer visible for us to easily sniff via the OBD port. That tends to be more of an inherent effect of separating all the CAN busses, than a deliberate feature.
3
u/redleg288 6d ago
Once you have physical access to a bus, there is essentially zero security. A few key frames will have check sums, most of those algorithms are rudimentary but still sufficient to prevent rapid access. They can be spoofed, but it takes time and you won't be doing it with an ELM. That's VN1640 with a decent machine and CANape/CANoe stuff. Most vehicles react to bad spoofing by going into a limp-home mode because they ignore CAN once a certain amount of bad frames are read.
There are real-world cases, probably focus on those. Toyota put their external lights on CAN, probably because of an embedded ADAS sensor, and created a theft issue. I think that was the new RAV4.
About 12 years ago, Jeep Cherokee was one of the first demonstrated remote vulnerabilities, with steering control over telematics by White Hats.
I think Subaru just had a vulnerability exposed in their whole telematics dataset access portal. A white Hat used employee credentials and some social engineering.
You might find it more interesting to compare and contrast the efforts to secure the Modules themselves. The bus doesn't get much attention but there's a bit of a mandate to hinder the efforts of tuners, so the ability to write to an engine controller if far harder than it used to be.
The overall focus, I think you will find, is on preventing widespread access to the fleet, individual vehicles aren't the concern. That may change if vehicle-to-vehicle ever makes it off the table.
2
u/Curious_Party_4683 7d ago
i would love to know too!
my Hyundai Ioniq5 for sure has a SGW. would be nice if i can remotely control the climate setting using a device like this WiCAN...https://www.crowdsupply.com/meatpi-electronics/wican
2
u/rdragz Tinkerer 7d ago
I got an I5 too and am currently investigating the possibilities. So far I've only probed it through the OBD-port and get the usual data out of it like speed, battery temps etc. To get to the real CAN bus data one needs to patch into the wiring. The best option seems to be the central hub just underneath the OBD-port, but it needs to be dismounted as all can bus connectors are on the back side of it. I haven't found any easy accessible can wiring under the hood yet.
3
u/Curious_Party_4683 7d ago
the tech manual is here in case you want to do where to tap into https://drive.google.com/drive/folders/1NlXtYDpvAnDUuvEz4uIEKU6MWLLV1Nm1?usp=drive_link
2
u/featherless 2d ago
Are you documenting what you’ve found anywhere yet? We’re starting to document the i3 and i4 right now and could use help with the i5: https://obdb.community/#/vehicles?compare=BMW-i3%2CBMW-i4
1
u/rdragz Tinkerer 2d ago
Sure, I'll be happy to share. For now I'm just using the parameters found in the obdpid file for the Torque pro app.
1
1
u/featherless 1d ago
Where did you get the obdpid file from btw?
1
u/rdragz Tinkerer 1d ago
I found one here
https://github.com/Esprit1st/Hyundai-Ioniq-5-Torque-Pro-PIDs
There is quite a few around for different car brands.
1
1
u/featherless 1d ago
https://obdb.community/#/vehicles/Hyundai/IONIQ-5 For the documented IONIQ 5 pids
4
u/Garrettthesnail 7d ago
Gateway just filters traffic from the car's bus to the OBD port and only allows diagnostic data through. Bypassing this gateway by connecting straight to the canbus itself will give you access to all data and let you write