Welcome back to the second half of our car replay attack demo, so we're going to run a real car hack.
We have just recorded some packets from our controller area network using can dump it, save them into
a log file with a long timestamp name.
But it starts with can dump.
And that's the important part.
We'll be able to use our tab key to capture that filename and use it.
Now we're going to learn how to use the can player the controller area network player.
So our last cool utility from Can Utils can dump will.
Now let us use the coolest tool can player to replay and we just give it a dashi for an input file and
we're going to input that log file over our virtual controller area network.
So let's switch back over to Calli Linux and see this work.
All right.
I still need my icey simulator up and running.
And you notice it's got some traffic on it right now because my controller is still running.
We will show the controller going away in just a second.
But I'm going to replay by using can players one more quick time.
Let's do else.
And we see that we do have a log file that was created automatically for us when we did can dump space,
dash L for logging on V can zero.
That was our previous command.
So you can see that command right there by hitting you up arrow a couple of times now we are going to
use can player and use the input file Daksh capital.
I can and just stop with candy and hit tab and you notice it picks up that log file and then it VCA
in zero line wrapped around a little bit there.
Oh, and we got an error here.
If you specify the network you have to say can zero equals V can zero.
In this case we want to replay over the same network.
So I will modify that in the PDF that I give you.
We're just going to run completed.
I can add up and it will rerun on can zero on weekend zero.
Or we could say Vikan zero equals Biggin zero.
I'm just going to say can play Ardeche, I can go up and now what can player is going to do is replay
on this controller area network.
Well I still have this other controller over here, so if I kill it, notice no one's in control of
my vehicle right now.
It's being replayed from a file.
So my doors are unlocking.
You can see him running almost 100 miles per hour as my doors just locked again.
My turn signals are coming on.
And no one is touching the steering wheel, no one's touching the controls for this car I'm actually
replaying I can player file.
Wow, very cool.
We're turning left and right, you'll see a slow down a little bit here.
Let's go back and do just a little bit of review.
Wow.
So you remember we slowed down.
We turn on the signal, we accelerated again.
We can lock and unlock those doors.
You see that all happening handsfree.
I'm not touching the keyboard.
Everything is happening from that log file.
So we just can play dash.
I can go up twenty seventeen to seven actually.
Team.
Well we just had to say can the tab.
So can be tab gave us that can dump file and notice my car is stuck going that speed.
I can rerun it again and it'll take it back down to zero, raise it back up and we'll lock and unlock
all the doors, turn on the blinkers any time.
I want to affect my virtual car in the same way I did before.
All I have to do is replay this.
Well, you would probably want to use this in a an actual attack in your own car if you wanted to test
your car security just by doing one thing at a time.
So turn on, stand up and turn on the right blinker and then turn off, stand up and then turn off your
blinker, your turn signal, then run cardplayer and see if your turn signal turns on.
And then the same thing for the accelerator and steering left and right and everything else that we
can do in a car, unlocking and locking doors, turning on the stereo, the air conditioning, and then
listen back by replaying that attack and see if it actually has the same effect.
There are lots of ways you could use this can player routine with the can dump and can player the can
play the car or controller area network replay attack to test the security of your own car or to actually
inject packets into a car if you needed to do so.
So if your car is having trouble so you can't unlock your doors anymore, something's wrong with the
door lock.
You can actually use the cam player to find out what the packet is that you would send to unlock your
doors or go to somebody else with the same vehicle and replay that anytime you want to be able to lock
it and lock your doors.
I've actually seen people lose the ability to use their power windows, but if you can use the can network
and it is it allows you to inject it back in, you can roll your windows down using your computer.
That may not be the most practical, but it's very cool to be able to do so when you need to.
It's also great to be able to just read messages from your car so you can tell when something's wrong.
So what we've seen how to do here is take a can dump or a pack, a picture, a log file of our controller
area network traffic and then replay it using can player
to replay all of those controller area network messages on a real simulated car here, a virtual controller
area network.
If you've got a control cable, you can run this and try it with your own vehicle, but do so only if
it is your vehicle and if you're OK fixing something if you break it, remember, it is relatively safe
to play with things on your controller network, but you don't ever want to do this.
If your only transportation is that one vehicle and and you don't have some money saved up for repairs
in case anything goes wrong, I have some money saved up for repairs.
So I actually used my car in our National Cyber Warrior Academy camp here on the University of Georgia's
Dahlonega campus.
And I'm going to provide a quick look at the link to the Facebook video as a little bonus after our
review.
So we'll do a quick review next with a couple of the changes that we picked up here, like removing
the V can zero four can player.
We can either say V can zero equals we can zero because we're replaying over the same port that we recorded
or we can just say can't play or dashi and the can dump file has all of the information about what network
it was played on.
So we're able to replay that.
We'll look at that in the review and then we'll see a little bonus section for fun.