Hopping on the CAN Bus
summary
Open-source toolkit CANard provides a hardware-abstraction Python API (start/stop/send/receive) and scripts that run over SocketCAN, vcan and USB devices like CANtact or cheap ELM327 clones. Live demos show a dashboard flooded by a repeated ID 0 spam DoS, injection of fake RPM messages to hijack displays, and scanning a Honda to find a diagnostic responder at 0x70. Unified Diagnostic Services lock uses a 16-bit seed/key security access vulnerable to brute force; firmware flashing and memory read/write are demonstrated working.
AI-written summary · about
chapters (20)
- 0:00Intro
- 0:42What is CAN?
- 3:08Why do I care?
- 5:11Easy Attacks - Dos
- 7:21How CAN Works Message Structure
- 8:56Easy Attacks - Injection
- 11:20Getting on the Bus
- 12:15CAN Hardware
- 14:39CAN Software
- 15:10SocketCAN
- 17:30Wireshark
- 18:17CANard A Python Toolkit for CAN
- 19:29Hardware Abstraction
- 21:58Diagnostics Protocols
- 22:31OBD-II
- 24:36Unified Diagnostic Services
- 28:43UDS With CANard
- 33:23UDS Security Access
- 36:44Fuzzing Diagnostics
- 38:49Conclusions
related talks
54mCantact: An Open Tool for Automative Exploitation
41mIt's easier to break than to patch: a stealthy DoS attack on CAN
32mNo cars were harmed for this talk: Automotive Rust, amateur style
50mAdvanced CAN Injection Techniques for Vehicle Networks
42mCanspy: A Platform for Auditing Can Devices
12mDetect Denial of Service on an Open Embedded Automotive Platform
39mCAN Bus in Control, Automotive and Satellites
37mAutomatic Automotive Hacking