Unleashing Vehicle Security: Mastering Car Hacking with Kayak

Hey everyone! As a content creator at obd2reader.store and a dedicated auto repair expert, I’m excited to delve into another fascinating, yet often misunderstood topic: car hacking. While this article highlights a specific attack vector, it’s important to remember that vehicle security is complex and multifaceted. My goal here is to offer a fresh perspective on how vehicle systems can be analyzed, controls understood, and potential vulnerabilities identified – skills valuable for both ethical hackers and automotive professionals.

Often, “hacking” is perceived negatively, but in the automotive world, ethical hacking offers significant benefits. It can lead to unlocking hidden vehicle features, overcoming artificial limitations, and fostering innovation in safety and performance technology. Think about the devices insurance companies use to reward safe drivers – that’s a positive outcome of understanding vehicle data. While we’ll touch on these broader implications, our primary focus will be on a specific car hacking technique using readily available tools.

Before we proceed, a crucial disclaimer: neither I nor obd2reader.store can be held responsible for any adverse outcomes resulting from attempts to replicate the concepts discussed here. Car hacking, even in virtual environments, requires caution. If you choose to experiment with physical vehicles, you do so entirely at your own risk. Fortunately, this guide emphasizes a virtual approach, providing a safe space to learn and gain hands-on experience without risking real-world consequences.

So, let’s get started by understanding the backbone of modern vehicle communication: the CAN bus.

Decoding the CAN Bus: The Language of Your Car

The Controller Area Network (CAN) bus is essentially the central nervous system of your vehicle. It’s a network that allows various components to communicate with each other. Consider the multitude of functions in your car that rely on electrical signals: door locks, speedometer readings, fuel gauge levels, braking controls, acceleration – the list goes on. Many, if not most, of these systems communicate through the CAN bus network.

OBD-II Port: Your Gateway to Vehicle Diagnostics

The On-Board Diagnostics II (OBD-II) connector is a standardized port in your vehicle designed for easy access to diagnostic information. When you take your car to a mechanic, they often plug a diagnostic tool into this port to read error codes, helping them quickly identify and resolve issues, even those not triggering the check-engine light.

OBD-II ports are generally easily accessible, typically located under the dashboard near the pedals, behind the steering column, or on the passenger side under the dash. Here’s a look at an OBD-II port:

OBD-II Port

To physically interface with this port, you might use a device like the CANtact. While physical connections are possible, this guide focuses on virtual car hacking, which replicates the communication process through the OBD-II port without requiring physical hardware. Whether virtual or physical, the OBD-II port serves as the primary access point to the CAN bus network for communication.

CAN Bus Communication: Hub-like Simplicity

Within the CAN bus network, data packets are transmitted and received in a manner similar to a network hub. For those familiar with networking, a hub broadcasts data packets to all connected devices. Unlike a switch, which directs packets to specific destinations, a hub makes data visible to every device on the network. This “broadcast” nature of the CAN bus makes it inherently “noisy” and, from a security perspective, potentially vulnerable to eavesdropping.

Let’s illustrate this with door locks – our focus for this hacking exercise. When you press the lock button, an electrical signal travels through the CAN bus, reaching every device on the network. The door lock system, upon receiving this packet, interprets the data. Within the packet is a command – “lock” or “unlock.” The doors, recognizing their designated command, then execute the instruction.

Many vehicle functions operate similarly. Pressing the accelerator pedal sends data packets across the network, instructing the fuel system to increase fuel flow, thus accelerating the car. This, in turn, might cause the speedometer to update, reflecting the change in speed based on network instructions and accelerator pedal position.

CAN bus packets consist of two main parts: the identifier and the data. The identifier acts as an address, representing a specific device within the vehicle. The data field contains the instruction or value intended for that device. Consider this example:

120#F289632003200320

Here, “120” is the identifier, indicating the target device. The portion after “#”, “F289632003200320”, is the data field, containing the command or information.

It’s crucial to understand that identifiers are not universally standardized across all vehicles. An identifier like “120” might represent the accelerator pedal in a 2019 Honda Civic but could control the windows in a 2022 Toyota Sienna. Therefore, identifier mappings are generally vehicle-specific, usually consistent only within the same year, make, and model.

Finally, the CAN bus network is constantly active as long as the vehicle has power, even if the engine is off. This continuous communication is essential for monitoring and controlling various vehicle systems in real-time.

Explore Ethical Hacking Courses

The Replay Attack: Hijacking Car Commands with Kayak

The car hacking technique we’ll explore is a replay attack on the CAN bus. This involves intercepting and recording CAN bus packets during normal operation, then “replaying” these packets back onto the network to trigger the same actions later, regardless of whether the original command was initiated.

In our case, we’ll focus on door locks. We’ll listen to CAN bus traffic while manually locking and unlocking the doors. Then, we’ll use the captured packets to replay the lock/unlock commands, effectively “hacking” the door control system.

Before diving into the practical exercise, let’s set up the necessary tools within a virtual environment. This is where Kayak, a powerful CAN bus analysis tool, will play a crucial role, along with other utilities.

Setting Up Your Virtual Car Hacking Lab: Tools of the Trade

These steps are designed for a fresh installation of Kali Linux 2022.2 running in VirtualBox. Instructions for installing VirtualBox and Kali Linux are beyond the scope of this article. We’ll be installing three key tools:

ICSim (Instrument Cluster Simulator): A virtual vehicle simulator to test our hacks in a safe environment.
Socketcand: A socket CAN daemon to bridge CAN bus interfaces with network sockets.
Kayak (or Kajak): Our primary CAN bus analysis and manipulation tool.

First, update your system and install prerequisite packages:

sudo apt update && sudo apt install libsdl2-dev libsdl2-image-dev can-utils maven autoconf

Create a directory to organize our car hacking tools and navigate into it:

mkdir Documents/Car_Hacking && cd Documents/Car_Hacking

Clone the ICSim Git repository:

git clone https://github.com/zombieCraig/ICSim.git

Enter the ICSim directory and compile the code:

cd ICSim && sudo make

Move back to the Car_Hacking directory and clone the socketcand repository:

cd .. && git clone https://github.com/linux-can/socketcand.git

Navigate into the socketcand directory. A missing header file needs to be added, so download it:

cd socketcand && wget https://raw.githubusercontent.com/dschanoeh/socketcand/master/config.h.in

Configure, compile, and install socketcand:

autoconf && ./configure && make clean && make && sudo make install

Return to the Car_Hacking directory and clone the Kayak Git repository:

cd .. && git clone https://github.com/dschanoeh/Kayak.git

Finally, navigate to the Kayak directory and install it using Maven:

cd Kayak && mvn clean package

With Kayak and all other tools installed, our virtual car hacking environment is ready. Let’s move on to executing the hack.

Executing the CAN Bus Replay Attack with Kayak

For this practical demonstration, we’ll use multiple terminal tabs. Each tab will manage a specific function:

Simulator: Running the virtual vehicle environment.
Controls: Interacting with the virtual vehicle controls.
Capture & Replay: Using candump and canplayer, and importantly, Kayak for deeper analysis.

In the first terminal tab, start the simulator. First, set up the virtual CAN (vcan) interface:

cd ../ICSim && ./setup_vcan.sh

Start the ICSim simulator, using the newly created vcan0 interface:

./icsim vcan0

Open a second terminal tab and launch the controls interface:

./controls vcan0

You should now see the ICSim application window.

Image of Locked Doors in ICSim

While you can use a joystick controller, we’ll use keyboard controls for this guide. Experiment with the controls in the “CANbus Control Panel” window. The LEFT arrow key activates left turn signals, UP arrow increases speed, and Right SHIFT + A|B|X|Y unlocks individual doors. Left SHIFT with any door button relocks doors. Left SHIFT then Right SHIFT unlocks all doors.

Let’s focus on locking and unlocking all doors. Start with all doors locked. Press Left SHIFT then Right SHIFT to unlock all doors. Then, press Right SHIFT then Left SHIFT to lock them again.

Image of Unlocked Doors in ICSim

Repeat Image of Locked Doors in ICSim

Now, open a third terminal tab for capturing and replaying CAN bus data. Create a Demo directory to keep things organized:

mkdir ../Demo && cd ../Demo

In the Demo directory, start the candump utility to capture CAN bus traffic on the vcan0 interface, logging the output to a file:

candump vcan0 -l

Let it run for about 5 seconds without any actions, then press CTRL+C to stop. This demonstrates the baseline “noise” of the CAN bus. Check the number of packets captured:

wc -l candump-*.log

You’ll see a large number of packets even without any user interaction, highlighting the constant communication on the CAN bus.

Now, for the actual capture of door lock/unlock commands. Delete the previous log file and prepare for a new capture:

rm candump-*.log

Follow these steps quickly:

Start candump with logging: candump vcan0 -l
Activate the “CANbus Control Panel” window.
Unlock all doors (Left SHIFT then Right SHIFT).
Lock all doors (Right SHIFT then Left SHIFT).
Click back in the candump terminal.
Press CTRL+C to stop the capture.

This rapid sequence minimizes the log file size, making analysis easier. Check the line count of the new log file.

Now, the exciting part: replay the captured log file using canplayer and observe the ICSim window.

canplayer -I candump-*.log

If successful, you should see the virtual car doors unlock and lock again, demonstrating a successful replay attack.

To pinpoint the specific packets responsible for door control, we can use a binary search-like approach, guided by Kayak’s analysis capabilities. However, for a simpler approach, we can manually narrow down the log file.

Divide the log file in half and replay the first half. If the doors unlock and lock, the relevant packets are in that half. If not, they are in the second half. Continue this process of halving and replaying, using head and tail commands in Linux, until you isolate a small set of packets that control the doors.

Through iterative halving (as demonstrated in the original article’s terminal output), we can isolate the CAN packet responsible for unlocking the doors.

Let’s say we’ve narrowed it down to a single packet. Examine its contents using cat:

cat split10 # Or your final split file

And replay it to confirm it unlocks the doors:

canplayer -I split10

Once confirmed, isolate the unlock packet into its own file, “doorsUnlock”:

echo '(1654550641.304018) vcan0 19B#000000000000' > doorsUnlock

Replay this single packet:

canplayer -I doorsUnlock

Image of Doors Unlocked by File Replay

The doors should unlock, confirming we’ve isolated the unlock command. Now, let’s analyze this packet and use Kayak for a more visual and in-depth understanding.

Deep Dive with Kayak: Analyzing CAN Bus Data

While candump and canplayer are useful, Kayak provides a more powerful and visual way to analyze CAN bus data.

Launch Kayak. You’ll likely need to navigate to the Kayak directory and run the executable:

cd ../Kayak
./run.sh # Or however you execute Kayak (check Kayak documentation)

In Kayak, you can import your candump log file. Kayak allows you to filter, analyze, and replay CAN bus traffic with a graphical interface.

Import your candump-*.log file into Kayak. Use Kayak’s filtering capabilities to isolate packets with the identifier “19B” (our door control identifier). You can observe the different data values associated with locking and unlocking.

By comparing packets in Kayak, you can visually identify the data byte that changes between lock and unlock commands. This visual analysis, facilitated by Kayak, significantly simplifies the reverse engineering process compared to manual log file parsing.

[Screenshot of Kayak interface showing CAN bus data and filtering, highlighting the “19B” identifier and data changes for lock/unlock]

Analyzing the Door Control Packets:

Let’s revisit our isolated door control packets:

Unlock: (1654550641.304018) vcan0 19B#000000000000
Lock: (1654550642.133853) vcan0 19B#00000F000000

The identifier 19B is the same, confirming it’s the door control device. The data field differs in the second nibble of the third byte. Breaking down this nibble:

8	4	2	1	Hex
0	0	0	0	0
1	1	1	1	F

By experimenting with different data values, as shown in the original article (creating doors8, doors4, doors2, doors1 files), we can determine which bits control individual doors. Kayak can be invaluable here for quickly crafting and replaying modified packets to test different door combinations.

Through this process, we can map the bits to specific doors:

Bit (Binary)	Hex	Door
1000	8	Rear Passenger
0100	4	Rear Driver’s
0010	2	Front Passenger
0001	1	Front Driver’s

A ‘1’ in a bit position locks the corresponding door, ‘0’ unlocks it. We can now construct packets to control individual doors or combinations. For example, to lock rear doors and unlock front doors, we combine the bits for rear doors (8 + 4 = 12, or hex ‘C’):

Packet for locking rear, unlocking front: (1654550641.304018) vcan0 19B#00000C000000

Create a “unlockFront” file with this packet and test it:

echo '(1654550641.304018) vcan0 19B#00000C000000' > unlockFront
canplayer -I unlockFront

Image of Front Doors Unlocked, Rear Doors Locked in ICSim

Success! We’ve achieved granular control over door locks, demonstrating the power of CAN bus replay attacks and the utility of tools like Kayak for analysis and manipulation.

Further Exploration: Expanding Your Car Hacking Skills

This article provides a foundational understanding of car hacking using a replay attack and virtual tools. To deepen your knowledge, I highly recommend Craig Smith’s “The Car Hacker’s Handbook,” an excellent resource for comprehensive car hacking information. The Car Hacking Village community is another fantastic place to connect with fellow enthusiasts and learn from real-world experiences. Additionally, CSS Electronics and Illmatics offer valuable online resources for CAN bus and car hacking education.

Conclusion: Ethical Exploration of Vehicle Systems

In this guide, we’ve demystified the CAN bus, explored its role in vehicle communication, and set up a virtual environment for safe car hacking experimentation. Using tools like Kayak, we successfully executed a replay attack to control virtual car doors, demonstrating the principles of CAN bus manipulation.

Car hacking, while fascinating, carries risks. Always prioritize ethical considerations and exercise caution. Virtual simulations, like the one we used, are invaluable for learning without real-world consequences. While tempting to experiment on personal vehicles, be aware of potential unintended consequences. My own (slightly stressful) experience with real-world car hacking serves as a reminder of the importance of careful planning and risk assessment.

Thank you for joining me on this exploration of car hacking. I hope this article has sparked your curiosity and provided valuable insights into the fascinating world of vehicle security analysis. Remember to use this knowledge responsibly and ethically.

References

Smith, Craig. The Car Hacker’s Handbook: A Guide for the Penetration Tester. No Starch Press, 2016.
Car Hacking Village: https://www.carhackingvillage.com/
CSS Electronics CAN Bus Tutorials: https://www.csselectronics.com/pages/can-bus-intros-tutorials
Illmatics Car Hacking Resources: https://illmatics.com/carhacking.html