Welcome back.
And we've got one more bonus lesson for you that's been really popular with my face to face classes
and our cyber warrior academies each summer.
These last few years, this is reverse engineering, the controller area network.
Now, you've already seen how to do a replay attack where you can capture some packets and send those
back out over the same system with the controls turned off.
But we want to show you how to take it one step further so that you can use a cable like the one we
have here.
This is A can to U.S. B cable that gives us the ability to connect into a real vehicle.
We're going to practice that safely here in this of our virtual machine.
But a device like this costs only about 70, 80 dollars.
To add to your system.
This is the Courland USP to can KLR L-A in USP to control every network converter.
This just plugs into regular USP and then connects into the automobile under the dashboard and the onboard
diagnostic port.
That's pretty handy there.
So let's talk about this can bus and how we can reverse engineer it?
Well, you've mentioned that the canvas is the controller area network.
It's what allows our communication across all the different says sensors and actuators or devices inside
our network to work together so that when you press on the brakes, the brakes fire, the brake lights
turn on.
When you press click the turn signal, your turn signal turns on and off like it's supposed to.
A modern production car can have as many as 70 electronic control units or E.S. use for everything from
the engine airbags, anti-lock brakes, tail lights, entertainment system, you name it.
And the can messages for the control of the canvas is just one of the the communication systems in your
car.
But it's been around since nineteen ninety one and in all vehicles since 1996 sold in the U.S..
This is a pretty common way for devices to talk to each other.
So you can see that we've got between zero and 64 bits of data and we've got a 29 bit.
Can idee or a three byte give or take a little bit there can I.D. identifier.
That's those three hexadecimal digits that we've been seeing in Kansas sniffer.
So we're going to run the newer version of Kant Sniffer and we've got that by run and make install from
inside that can utils folder that we downloaded.
We're going to see how to find exactly the right can I.D. and the exact message to be able to control
our controller and at work our car from the command line.
So let's see what we can do to reverse engineer the controller network.
We're going to be able to send specific messages to the canvas using can send.
So this is a command that we got from the Ken Utils.
We'll tell it what network?
And then we just need to give it a three hexadecimal digit I.D. number like one eight eight or zero
six F or one nine B, then a hash tag or a pound symbol and then a message value.
So this can send V can zero one eight eight and a message should do something.
Two of our virtual controller area network.
So what we're gonna do is see some of those commands fly by so that we can identify some of these messages
that we might want to send.
So can Sniffer, the newer version has tons of really cool commands.
In fact, if you press can snipper and just hit enter, you're gonna see how to interact with cance
near for a while.
It's running.
This is the newer version that we did from GitHub.
And then we did the make and make installs so that we get the new can sniffer.
We we have all of these options that we can run from the command line.
So we could say Dasch see, so that it'll color any of the bytes that are changing.
So our speed as it goes up our blinkers is the turn left or right and the door locks as they change,
we can set the time out so we can have things disappear after a little bit of time.
I'm actually going to use that Dashty option there in my cancer center so that we can see our values
stay on the screen for a little longer.
And then you've got some interactive mode options here.
You can toggle color mode.
You can press space and enter to clear the screen.
You can actually read through each of these and come back to can sniffer and keep working with it.
The great thing about the newer version of cance sniffer that we downloaded and installed was that when
we run can sniffer, I'm actually I'm going to increase the font size so you can see this a little bit
better control.
There we go.
We get can sniff her.
I'm gonna say Dasch.
See, because we want to color those bytes as they change so we can spot things as we reverse engineer
them.
Our we try to figure out what the values are so that we can have the intended effect on the computer.
Then we got Dashty of zero.
I don't ever want to see those values time out.
So once I've got a control running, I want it.
I want to see that I'd be permanently in there.
So Dashty Zero turns off that timeout function so that you may have seen some of the values disappear
on and off.
This is how we get back to that so that they are all they are all the time.
And then we need to tell it which virtual can network.
We can zero.
And right now, we only see a couple of ideas and we see one of them is changing and that happens to
be our speedometer.
So if I run the speedometer up, you can see those last two bytes changing.
So we can see one a.
Now it's two two seven.
So you can see three.
And it seems to top out around three, eight, nine, four.
The way it's written by default, if you don't hack the car hacking software, it will show how to do
that and the next bonus lesson.
But this seems to top out at three eight nine four for those last two bytes.
So my can I.D. two four for my can value would be zero zero zero zero zero zero.
And if I want this pedometer to do almost 100 miles per hour, I put three eight nine four in there.
I want it to go higher.
Make it look like maybe it's 300.
I might try changing those last two values more.
Now, let's see what that one eight eight value is.
Well, if I turn my turn signal on to the right, I see the data value change there to zero to my speedometer
is going down.
So that's also going to be changing on the bottom line.
But that can be one eight eight is clearly my turn signal if I see zero two.
What if I say left turn zero one?
What if I could get both of them to show up at the same time by maybe alternating back and forth on
the left and right turn signals?
Well, if I could get it just right.
I might be able to get both of them to show up.
And see, that's a zero three.
Will that make sense?
Zero one is left, zero two is right.
Then zero three might show both of them.
What I'm going to do is try to get one other value to show up.
You are just fine if you just do the left and right turn signals and the speedometer.
But I'm going to try to get one more control to show up some click on the control panel and I'm going
to press the left shift key and then tap the right shift key.
And this won't work on every keyboard and it won't work through a virtual connection to a remote lab
machine usually.
But I saw all the doors open with nineteen B one nine B as my D.
And then one nine B with zero zero zero zero zero F will lock the doors.
But if I want them to open back up, I just need to feed it six pairs of zeroes so we can see our data
message.
We can see our I.D..
What I want to do is type Q to quit and then press enter.
And what that's gonna do is keep those values on the screen they're forming.
So what I'm going to do is create a little text document control, see.
Nope.
Sorry.
Shift control.
See to copy someone to copy that selection.
And I'm going to start my little notepad editor.
My text editor here.
And really what I want to do is capture.
Some of the values.
Oh, your your machine may be running a little bit slow because of the controller area network traffic
that's going across, we're going to turn that off so that our machine speeds up.
And besides, we actually don't need it anymore.
Now, we got all of those values right there.
So I'm going to say one eight.
So I will actually just control shift control V to pace that two four four.
So what I've got here is a can send message.
Then I should be able to modify and then send right back across this controller area network.
So I just turned off my control panel.
That's important because we don't want something else interfering while we're typing in our Skansen
commands.
But what I'm going to do is change the format of this message so that it is actually can send space.
We can zero and then two for four, we found out, was the speedometer and really what we want to change
is we want to change the format so that this is all one strain has to be all together.
We mentioned that oh three nine four would make it look like it was running a hundred miles per hour,
let's say.
Oh.
Three.
F f.
And so what we have here is zero zero zero zero zero zero or six zeros, followed by zero three.
F f.
Let's copy that.
Control C and come back over here with our control panel.
Disabled.
But our icey simulator still there.
You can run dot slash.
I see Sam Bekins zero.
You need to get it back on the screen.
But I'm going to paste this into my terminal window.
You can send on weekend zero to four for my spirometer right now is zero.
Let's see what happens to the speedometer when I send this command.
Wow.
All right.
Well, AC zero three f f did not move it as much as we wanted it to.
Well, what I'm going to do is can send V can zero.
And I'm going to say zero zero with six zeros and then four FS.
And you notice now my speedometer is pegged all the way over to the right hand side.
It looks like I'm doing two hundred eighty or three hundred miles per hour.
So by sending that one command, we can make the speedometer look like it's doing.
Two hundred eighty miles per hour.
Or if we change it just a little bit more.
Zero zero zero zero.
We can make it look like it's running zero miles per hour and then we can toggle just by typing each
of those commands.
So let's do the same thing with our turn signals so I can copy my turn signal or you can just type this
in.
It's not very long.
I'm going to copy that selection.
I'm going to say can send.
They can zero.
And I want to send one eight eight.
And remember, it was the first two digits that changed.
So one eight eight pound, if I said zero three, you remember, that would turn on both the left and
right turn signals.
And we get rid of the extra spaces.
Copy this command.
Tend to the can stand in my terminal control shift V.
Enter.
And I've turned on both turn signals or what would happen if I changed that three to a zero turns off
both signals, hit the up arrow twice.
I've got both turn signals on.
So you get the idea with just a few commands, we're able to send a command to unlock all of the doors.
In fact, you can give that one to try yourself.
Try the one nine B with six pairs of zeroes after it.
That can send that you see on the screen right here will allow you to run that 100, 300 mile per hour
car with both turn signals on.
So it looks like the brake lights with all four doors open.
Hope you enjoyed this.
Listen, hope everything works well for you.
Come back to this section.
And if you need to reinstall the new version of Cat Sniffer, so you get the nice clean interface,
go back to the lesson on installing Cain utils and Icee SIM.
You'll see how to do that when we've updated everything for 2020 and beyond.
This is one of the most popular lessons with my students.
Once you understand how to do this, then you can plug one of these devices into a real car and actually
see where each one of those individual commands makes a difference in the cancer.
Never change those values or mess with them a little bit like we did.
We turned the speedometer all the way up to F, F, F, F, and that gave us what looks like a three
hundred mile an hour vehicle speeding with both light, both turn signals on and all the doors unlocked.
Reverse engineering is a tough set of skills to pick up, but once you understand it, you can do something
like this for not just a controller area network, but Bluetooth devices in your home.
You can sniff your network using some of the tools built in the Caleigh Linux and open a door lock or
change commands on a camera or a thermostat.
Reverse engineering is a really important set of skills that a lot of companies are looking for.
So if you enjoyed this, listen, there might be a future for you in that.
Look for reverse engineering and some job listings.
When we come back in the next lesson, we will show you how to hack the car hacking software.
That's right.
We're actually going to change this so that you can take your speedometer all the way up to a thousand
miles per hour if you want to.
Hope you're enjoying these bonus lessons.
And I hope it's something interesting and fun for you and that you'll learn a little bit along the way.