Now that we have our can utilities, the controller and network utilities and the ICI simulator working,
we're ready to do a car replay attack.
That means that we're going to see how to use a tool called Can Dump to capture packets on our controller
area network.
We'll also see how to use can player to replay those.
So let's start by running can dump, dash, shell, and then we're going to switch back to our controller
window and use the keyboard to issue a lot of commands will accelerate, lock and unlock doors, turn
on the the turn lights, the turn signals, and then we'll capture all of that.
It'll run to a log file and then we'll be able to replay that on another car network.
So we'll see how this works on a simulated network.
But remember, with just a cable that you can buy at Amazon can to USB or an onboard diagnostic link
OBD link, you may be able to run this on your own vehicle and capture real packets and see what kind
of things can be replayed with a simple replay attack.
This is one of the simplest types of tests that you can run, and it'll give us everything we need to
be able to do some actual car hacking if we wanted to do it on our own vehicle.
And I'll show you a video or link to a video that actually shows my students and myself connecting this
to my car.
I have a little Volkswagen and we connected to it and we're able to see the dashboard in real time using
this actual physical cable.
So let's switch over to Cauli Linux and let's get the replay attack started.
We'll do the first half capturing the data so we still have can sniff running in this back window here.
And we have our controller up and running.
We just did a slash.
So we need a nice system and ran the AC simulator for the instrument cluster or the dashboard indicators.
Then we did something similar.
We did a dot slash controls inside.
I see him on Becan Zero to get this controller.
And remember when we pressed the controller, we're going to be able to see the dashboard spin up.
It would go.
So if I pressed my accelerator after clicking in the control panel, I can accelerate and then want
to let up.
It slows back down.
I'm going to stop the can sniffer back here just by issuing a control, see.
So click on this window control, see, and that will stop it.
And what we're going to do instead of lugging this to the screen, is that we're going to dump this
can traffic using can dump.
And I'll resize my window a little bit so that we get it in the background there.
We're going to use can dump and log this virtual can network traffic.
So we're going to do a can dump.
And this is a controller area network dump, just like we would capture part packets from Wireshark
or from any other packet sniffing application can dump Dash L and that's sure log.
So we're going to do a candombe dash L on our virtual controller area.
Network V can zero.
When we run this, we can click over into our control panel and now we'll press our accelerator.
So I'm hitting the up arrow.
I'm going to go ahead and turn on the right turn signal, then I'm going to turn the left turn signal
on while I'm accelerating.
I might as well shift and A and B then X and Y.
I'm holding down the right shift.
I want to do those.
I can lock everything back with a right shift and left shift together, and then I'm going to turn on
the signals again, left and right.
Cool.
So we're just doing a few things so that we've got some traffic in this candombe file and noticing it's
creating a file with the timestamp so you can see the date and time that I'm recording there.
Just get yourself about a minute's worth of can traffic so we can slow down, we can turn on this turn
signal and speed back up, then we can do our right shift.
And then A, B, X, y.
And we can leave things unlocked if we want to, then we can click back over to the candombe file control,
see and do unless and now when we list, there's a new file this can dump next twenty seventeen 078
team and the time stamp in a log file.
Now we can use the log to a C program to read this on the screen in ASCII characters or readable characters.
What we're going to do next is run a replay attack on this controller area network by taking that log
file and replaying it on the same V can zero.
We will take control of the car and we won't be able to override it over here on our control panel.
Anything we do, it'll still be able to run whatever commands we did before on the icy simulator.
So if you are using this in a real car and you capture packets like this, whatever you did before will
be able to be rebroadcast across that controller area network.
So be careful.
If you're doing this on a car, do it parked and idling in a very safe area, maybe a big field or a
large empty parking lot.
Don't do any of this on an open road.
These are really dangerous tools if they're used incorrectly, but they can be very valuable tools.
If you want to be able to work on your own vehicle, test your own vehicle, get diagnostic codes from
your vehicle, or test the security of your vehicle by capturing and replaying log files.
We'll see how the replay attack works in the next lesson.