Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Dash Labs - Assembling Sensor Networks: OBD-II + CAN Bus Hacks

driveai
July 18, 2013

Dash Labs - Assembling Sensor Networks: OBD-II + CAN Bus Hacks

Brian Langel discusses how Dash Labs builds their OBD-II reader and access data from the cars' OBD-II port. Additionally, he ventures out and talks about the CAN Bus standard as well as ways of exploiting it based on recent work from security researchers.

driveai

July 18, 2013
Tweet

More Decks by driveai

Other Decks in Technology

Transcript

  1. @dashmobile @dashmobile WINNER - ‘APPS FOR VEHICLES’ CHALLENGE WINNER -

    BMW ‘FUTURE MOBILITY’ CONTEST CES 2013 - ‘START UPS TO WATCH’
  2. @dashmobile OBD-II Background 70‘s-80‘s Vehicle manufactures begin using electronics to

    control engine functions 1970 Congress passes the Clean Air Act, starting a series of graduated emission standards 1988 SAE releases a standard connector port and diagnostic test signals, paving the way for OBD-II 1996 All US vehicles sold must support OBD-II 2008 All vehicles must support CAN protocol (ISO-15765- 4) Today / Tomorrow Proliferation of smart-phone integration & Self-driving vehicles (!)
  3. OBD-II (simplification) ECU Chassis Electronics Steer-by-wire Brake-by-wire Dashboard etc BUS

    Protocols CAN (ISO- 15765), J1850 PWM, J1850 VPW, ISO 9141- 2, ISO 14230 OBD-II Readers J1962 TX Protocols USB, Bluetooth, WiFi Software Data Definition/Interpreta tion J1979 J2012 OEM Proprietary Information @dashmobile
  4. @dashmobile OBD-II Protocols J1850 PWM (pin 2+, 10-) J1850 VPW

    (pin 2) ISO-9141-2 (pin 7+, 15-) ISO-14230 KWP2000 (pin 7+, 15-) CAN ISO-15765 (pin 6+, 14-)
  5. @dashmobile OBD-II Data EVERYTHING! (electronically controllable) J1979 OEM Proprietary VIN

    DTC Speed Fuel Level Air Bag Status LOTS MORE... Clear MIL Lock/Unlock Vehicle Control Radio Start/Stop Vehicle MANY MORE... Read Write
  6. Cost of OBD-II Data J1979 One Time $68 J2012 $68/$422

    Annual ETI $5-10K GM $50K BMW $17.5K $1K / update Chrysler $5-15K and so on... @dashmobile
  7. Cheaper Ways... @dashmobile Reverse Engineer! (the hacker’s way) Existing Papers

    http://www.autosec.org/pubs/cars-oakland2010.pdf Locks Horn Windshield Wipers Ignition Trunk Lights Brakes Power Steering Monitor BUS Fairly easy, especially on CAN. Existing chipsets (ELM32x / STN11xx) allow monitoring of traffic
  8. What Exists Currently? @dashmobile Hardware Software OpenXC ELM 329 STN1170

    Open Source CAN Solely Ford Ford codes encrypted SW-CAN MW-CAN raw CAN Closed Source Closed Source SW-CAN raw CAN Others (Xirgo, etc) Closed Source OpenXC Open Source Android only Limited Codes Others (on github) Poorly tested Small # users Limited code support Open Source
  9. What’s Needed @dashmobile OS Hardware Project Open Source SW-CAN MW-CAN

    raw CAN Open Source Platform agnostic Full CAN parsing support Codes reverse engineered OS Software Project Fork of OpenXC Open sourcing of Dash Fork of OpenXC