Abusing CAN Bus Spec for DoS in Embedded Systems
Martin Petran explores exploiting edge cases in the CAN bus protocol specification and message metadata fields to induce denial-of-service across embedded ECUs.
Summary
The Absolute Truth of Protocol Specifications
Controller Area Network (CAN) bus implementations strictly adhere to formal ISO standards, leading embedded firmware developers to make dangerous assumptions about message formats.
Violating Specification Assumptions in CAN Frames
Martin Petran evaluates what occurs when an adversary crafts non-compliant CAN messages, manipulating reserved metadata bits and unexpected payload lengths.
Triggering Denial-of-Service in Commercial Driver Stacks
Auditing proprietary and open-source CAN transceivers and microcontroller driver libraries revealed unhandled exceptions and buffer state desynchronizations that freeze embedded controllers.
Defensive Verification for Automotive Software
The author provides test suites and defensive software patterns for embedded developers to validate raw CAN frames safely without relying on hardware-level assumptions.
Related talks
Main Stage·14 min
Archwisp
Explores the evolution of vehicular emissions inspections from physical tailpipe sniffers to OBD-II queries and demonstrates how testing logic can be bypassed.
Car Hacking Village·26 min
collin · oblivion
Reverse engineers a commercial odometer rollback tool, extracting locked STM32 firmware and showing how CAN messages are intercepted and rewritten.
Car Hacking Village·46 min
Ian Tabor · Ken Tindell
Automotive security experts reverse engineer a real-world CAN Injection theft tool disguised as a Bluetooth speaker used to steal a Toyota RAV4.