#HITB2018AMS D2T1 - Backdooring & Remotely Controlling Cars

### Overview At HITB2018AMS, Claudio and Sheila from ElevenPaths (the cybersecurity unit of Telefónica in Argentina) presented their research on backdooring and remotely controlling cars that lack native internet or cellular connectivity. While prior prominent car hacking research focused on modern connected vehicles equipped with built-in GPS or Wi-Fi, older or emerging-market vehicles—such as many in Argentina—lack factory connectivity. To address this, the presenters designed a custom hardware implant and software framework to inject CAN bus messages remotely via GSM/SMS.

### Key Topics - **Physical and Safety Challenges**: Hacking vehicle networks carries physical risks. Errant frame injection can trigger engine protections and disable vehicle functionality, requiring diagnostic resets or battery disconnects. - **CAN Bus Fundamentals**: The Controller Area Network (CAN) operates as a broadcast bus using differential signaling (CAN High and CAN Low) and inverted logic (dominant 0, recessive 1). Frame arbitration prioritizes lower IDs (such as engine communications), but frames carry no source or destination addresses or explicit content identifiers. - **Reverse Engineering CAN Frames**: Identifying specific actions (e.g., turning on headlights or accelerating) requires systematically triggering actions and inspecting changing bytes using tools like oscilloscopes or CAN analyzers. - **The "El Vicho" Implant**: To overcome latency and physical range limits of Bluetooth or software-based injectors, the researchers developed custom hardware called "El Vicho" to inject high-frequency frames directly via an OBD-II port connection. - **Open-Source Ecosystem**: The project includes the hardware implant, a desktop configuration interface, and "Open CANdb", a crowdsourced online repository for sharing vehicle-specific CAN frame IDs.

### Technical Details - **Vehicle Interfacing**: Communication relies on OBD-II pins 6 (CAN High) and 14 (CAN Low). - **Hardware Evolution**: - *Version 1*: Built on a Microchip PIC18F (PIC18F2585/PIC18F2685) microcontroller with CAN transceiver and firmware written in assembly to achieve high-frequency injection to beat legitimate node chatter. Paired with a SIM900 GSM module to receive SMS trigger commands, but required hardcoding frame data directly in firmware. - *Version 2*: Added a USB interface, a physical toggle switch between Programming Mode (via PC) and Hacking Mode (vehicle deployment), and expanded firmware supporting configurable triggers and sender phone number whitelisting. - *Version 3*: Mini-USB hardware iteration with refined firmware features. - **Payloads and Attack Scenarios**: - **SMS Control**: Injects preconfigured CAN frames when specific text messages are received (demonstrated by remotely actuating brake lights and accelerator pedal). - **GPS Geofencing**: Automatically executes frame injection payloads when entering specific coordinates. - **CAN Condition Triggers**: Monitors the bus and triggers an attack (such as actuating brakes) when a specific frame (such as turning on the air conditioner) is observed. - **Sheila-Kill (Bus Denial-of-Service)**: Floods the CAN bus with the lowest ID frames (mostly zeros), seizing bus arbitration priority and causing vehicle ECUs to stop functioning.

### Takeaways - CAN bus architectures lack inherent encryption, authentication, or granular logging within ECUs, allowing injected high-rate frames to override legitimate ECUs. - Older and non-connected cars can be transformed into remotely controlled vehicles using low-cost hardware backdoors placed via social engineering, valet services, or car washes.