With the National Cyber Warrior Academy at the University of Georgia, we're learning a little bit about
car hacking.
So over the weekend, we learned that a car, an automobile, has a controller area network, a Khan
network that runs well throughout your entire car.
But it allows you to utilize network sniffing tools like we've seen Wireshark and a couple of other
sniffers to capture the network information that says what's going on in your car, whether that's your
blinkers, your car stereo, your air conditioning, your accelerator, your brakes, your door locks,
we can see all those things and we can tap into the network with just a USB cord and a cable that you
can buy for 20 to 40 bucks on Amazon called a can to USB and has an onboard diagnostic port that plugs
in under the steering wheel.
So what I'm going to do with five of our mentors today is actually take a little time to show them how
to connect to my car.
This is my actual 2007 Volkswagen Jetta.
And we're going to listen to some of the signals coming out of our onboard diagnostic port through a
simple dashboard program that we've set up.
So you can see things like fuel economy and how well the tachometer, just about everything from the
dashboard.
So know what you want to give the first shot.
All you need to do is first plug this into the laptop and make sure we get a yellow light on there.
And then, Sean, I'll show you where to plug it into the onboard diagnostic port.
Yep.
So what we're doing is first making sure that we're connecting from the computer to the tool, the cable
and make sure we get a yellow light on the underside of the cable there.
Good.
All right, John, you want to step up under here with NOAA and run at the base of the steering wheel?
On the left side, on the left over here, closer to the door here, you should see a purple port on
my car.
Looks like a really big cereal cable.
And that's the onboard diagnostic port.
It's the same thing that a mechanic plugs into when they want to read one of the codes from your car.
And you just work that in and you'll feel like it goes in very far.
But that's perfect.
And then you should see the underside of that light turn green if you can look up under there.
We're good.
All right.
Now that that's happened, we can turn on the vehicle.
I'm actually I'm going to hand this off, Boaz, so I'll let you turn on the car.
So pretty good.
It's it's an automatic.
So it shouldn't take off without you.
The parking brakes on the streets over there and.
Yeah, no, they're good.
So let's remind the folks watching here that this is not intended to be a how to video.
Don't try this at home.
You do need to put on the brakes.
There you go.
All right.
And you can hear you can hear the diesel engine start to purr.
But you can also see on the front screen here, you can see the tachometer is now lit up and we have
the miles per gallon, the fuel economy, how much we're consuming right now.
And if you will, give it just a little bit of gas.
But let's keep it steady a little higher.
We'll see that tank move up just a bit.
Oh, wait, how?
We've got to reconnect.
All right.
So let's see, Isha, you haven't had a chance to run one on here.
We're going to reconnect it.
Lost that connection.
So we're going to do a connection right here.
And if you click the Connect button right there,
good.
And what it's doing now is just running through several different protocols for different types of cars.
European cars are slightly different from Japanese makes and models.
Right.
So it's going through several different.
And it's found one one of the European protocols, it's reading the vehicle information because it's
a little German car, Volkswagen, and it will now.
Yeah, there we go.
We should get a live feed, actually.
No, you want to give it just a little bit of gas.
Just rev it up a little bit.
Thanks, Boasso.
Appreciate it.
And there you see the tachometer move.
Go ahead and take it up to two thousand and keep it up around two thousand for a while.
There we go.
So we can see the readout.
You'll notice that my fuel economy is going way down because we're sitting still and running the engine.
But we're getting information on the load, on the engine.
So if you go back to inital, you see that comes back.
There we go.
And we steady off.
We've got the engine temperature.
Still pretty cool because we just now turned it on, of course.
So we are actually reading from the controller area network of this car into our laptop now and this
laptop.
We have just a very simple dashboard type interface.
But what we learned how to do over the weekend was set up a virtual controller area network, a simulated
car network on the laptop.
Then we can record those signals as we make changes.
So if we turn on the blinker, we can see it flashing on the dashboard indicator.
If we rev up the engine, in fact, I think we hacked it and we could go at.
Two hundred and sixty or two hundred eighty miles per hour, our engine, our virtual car, then we
can unlock the doors, locked the doors while it's moving, then you record that you capture those network
packets and you can actually replay it on the same network.
So what we saw a video of was a couple of guys doing exactly this, except they were controlling the
car, turning the steering wheel, turning on the audio, turning on the stereo.
I think they turned on an air conditioner blaster to a couple of other things.
They were doing well, unfortunately, they ran out off the road and into a ditch.
I believe we did not do that here locally.
We just watched a couple of videos, but the same principles apply.
Once you can capture the network signal, you can use what we call a replay attack, where you take
that same network signal that was triggered when you turn on the blinker, turn on the stereo, hit
the brakes and replay it on a car network, you can have the same effect.
I'm sorry, Doctor, can we have someone who's watching right now?
Here's the question.
What's your software use on the computer?
We were using some open source software from open garages.
Doug, you can go to open garages, Doug, and has a link to the I see SIM, I see Capital I Capital
C SIM or the I see simulator.
And it allows you to simulate that controller area network to record things, use a package called Can
Snipper.
So it sniffs that controller area network and it allows you to record that network traffic and then
can player allows you to play it back.
They can utilize on most new Linux distributions, Debian, Linux, like the Caleigh Linux that we're
using.
You can download everything for free, install it on your own computer and buy one of these cables on
Amazon or any place that sells a can to USB connector and you're able to connect into your real car
and listen to the same signals.
And what would be the advantage for someone wanting to do this on their own vehicle?
Oh, absolutely.
There are two things, really.
First of all, you can just work on your own vehicle.
And I used to be in the old days, we would buy a car and we could maintain it ourselves.
Nowadays, we usually have to take it into a garage to even figure out what the problem with it is.
We just get a dashboard indicator.
The cool thing about these onboard diagnostic tools that we can plug into a regular laptop using open
source software and read the code ourselves.
And we still may need some help figuring out what to do with it after that.
The second thing that you can do is check your car for security.
In fact, in one of the videos we saw this weekend, they were able to hack in to the controller area
network through the onboard entertainment system.
So they were connecting in through a cell phone call and hacking a Jeep Grand Cherokee.
You may have seen on the news a few years ago.
What we're hoping to do is get these tools and more people's hands so they can check the security of
their own vehicles.
Plus, of course, we have a number of students who go on to work for the car companies.
We have Giammetti just a few miles south of campus here down in Roswell, in Alpharetta.
So we produce students who have at least seen a little bit of this and have a chance to take it into
the work world.
Thanks for the question.
Sure.
What what kind of skills are the students who are here at the Cyber Warriors Academy?
What kind of skills do they learn from being able to do this or can learn more about car hack?
OK, well, let's see.
First of all, we learned a lot about Kelly Linux, right, guys?
So we learned a lot of command line tools, a lot of open source software tools that people can download
and install on their own computers.
We learned how to use some particular tools for penetration testing or testing the security of a system
like misplayed their attacks that you can use to break into a Windows machine, you can break into a
Samsung television, anything with a computer in it.
These days, there are exploits for cell phones included.
So the students are getting a chance to see how to do that.
We even worked with drones a little bit.
They got a chance to go down to Fort Gordon yesterday to see some live hacking and coding sessions right
there at the Army Cyber Center of Excellence and also exposure to this class that absolutely Rose Proctor
came over and gave us a good dose of ethics before we started the ethical hacking course.
So that was a great way to kick things off.
We learned about how to do these things with permission on the systems that you own or for companies
that are interested in increasing their security.
We never use hacking tools without permission.
That makes us a bad hacker.
But you need to know what tactics correct hackers are using so that you can defeat the bad hackers.
Exactly.
And we're learning how to hack into things like web applications.
And then we show how to strengthen Web applications so no one can hack into your site where your business
inside.