Car Hacking

The Jeep Hack Demonstration

In July 2015, security researchers Charlie Miller (Twitter) and Chris Valasek (IOActive) made headlines by remotely hacking a 2014 Jeep Cherokee via its Uconnect infotainment system (Delphi CP4). The attack was demonstrated on I-64 in St. Louis while journalist Andy Greenberg drove the vehicle for Wired magazine.

The researchers exploited a vulnerability in the Harman uConnect 8.4A system running on a Sprint cellular connection. They gained shell access to the Linux-based infotainment system, then pivoted through a CAN bus gateway to reach the vehicle's critical CAN networks. From there, they could:

• Infotainment: Control the radio, climate control, and display
• Entertainment CAN (CAN-C): Disable the touchscreen, adjust volume, play music
• Vehicle CAN (CAN-IHS): Disable the transmission (entering park at highway speed), activate/deactivate windshield wipers, flash headlights, disable the engine
• Most critically: The researchers demonstrated disabling the brakes while the vehicle was moving — though they did not actually do this during the live demonstration for safety reasons

The attack required no physical access to the vehicle — it was executed entirely over the cellular network. The researchers published their findings at Black Hat 2015 and DEF CON 23. FCA (Fiat Chrysler Automobiles) recalled 1.4 million vehicles — the first automotive cybersecurity recall in history.

Attack Vectors

Modern vehicles present multiple attack surfaces, each providing a different entry point into the vehicle's internal networks:

• OBD-II Port: Direct access to CAN bus via the 16-pin J1962 connector under the dashboard. Used for diagnostics and ECU firmware flashing. Any device plugged into this port has full access to the vehicle's CAN network — including the powertrain, body, and chassis buses
• Infotainment (IVI): Connected to CAN bus via a gateway ECU. Vulnerable to malware, remote exploits, and USB-based attacks. Often runs Linux or Android with network services (Bluetooth, WiFi, cellular) exposed
• Bluetooth: Hands-free profiles (HFP, A2DP, PBAP) can contain vulnerabilities enabling code execution. The BlueBorne attack (2017) demonstrated remote code execution via Bluetooth on Android and Linux — the same OS used in many IVI systems
• WiFi: Vehicle WiFi hotspots and passive monitoring mode can capture CAN traffic. An attacker within WiFi range can inject malicious frames if the IVI lacks proper filtering
• Cellular (TSP): Telematics units (OnStar, Uconnect, SYNC) provide remote connectivity via 4G/LTE. These units bridge cellular networks to the CAN bus, enabling remote attacks over the internet
• USB: Malicious charging cables (USB Rubber Ducky), infected software updates, or compromised USB media can execute code on IVI systems
• Key fob relay: Extending the LF (125 kHz) signal from a key fob inside a house to the car parked outside, enabling theft without the physical key
• V2X: Compromised V2X messages (BSM, SPaT) could trigger false safety warnings or disrupt cooperative driving algorithms

The CAN Bus Exploit

Once an attacker gains access to the CAN bus, they can spoof any ECU message. The CAN protocol (ISO 11898) has no built-in authentication or encryption — every ECU on the bus is trusted. Brakes, steering, transmission, and engine control are all governed by simple CAN messages that any device can transmit.

The fundamental vulnerability is that CAN was designed for reliability, not security. A brake ECU reads the brake pedal position and transmits a CAN message (e.g., ID 0x123) to the hydraulic control unit. There is no signature, no sequence number, and no replay protection. An attacker simply replays the same CAN message ID with the correct data bytes, and the brake HCU cannot distinguish it from the legitimate message.

Miller and Valasek demonstrated this by sending CAN frames from a Raspberry Pi connected to the OBD-II port. They could:

• Steering: Send CAN frames to the power steering ECU at 500 kbps, causing full left or right steering at highway speed
• Brakes: Inject brake release commands to disable the ABS system and prevent braking
• Transmission: Send gear selector commands to force neutral or reverse while driving
• Engine: Cut fuel injection or disable ignition via the engine control module

CAN Bus Injection

CAN (Controller Area Network) frames follow a rigid structure defined by ISO 11898. A standard CAN 2.0A frame contains an 11-bit identifier, an 8-byte data payload, a cyclic redundancy check (CRC), and an acknowledgment slot. The arbitration ID determines message priority — lower IDs win bus access during contention. Every ECU on the bus receives every frame and filters by ID. The bus operates at 500 kbps on powertrain networks and 125 kbps on body/chassis buses, with differential signaling across CAN-H and CAN-L wires.

Injecting CAN messages requires physical or logical access to the bus. Using a SocketCAN interface (Linux kernel CAN stack), a researcher can craft arbitrary frames with tools like cansend and candump. A typical OBD-II adapter (ELM327, CANtact) connected via USB exposes a SocketCAN device. The command cansend can0 123#DEADBEEF12345678 transmits an 8-byte frame with arbitration ID 0x123 to the bus. Multiple adapters can be daisy-chained to sniff one bus while injecting on another.

An attacker can spoof brake, throttle, and steering commands by reverse-engineering the CAN database (DBC file) for a target vehicle. Researchers at the University of Michigan and UNECE have published DBC files for popular models. Spoofing a brake command requires transmitting the brake pressure message at the correct cycle rate (typically 10–50 ms) with plausible data values. The brake HCU accepts the highest priority message, so an attacker's frame overrides the legitimate ECU if it arrives first. Similarly, throttle spoofing involves injecting acceleration pedal position messages, and steering spoofing targets the EPS (Electric Power Steering) ECU with torque request frames.

Two primary tools dominate CAN bus research. SavvyCAN is an open-source cross-platform CAN reverse engineering tool that captures, filters, decodes, and injects CAN frames. It supports DBC file loading for automatic signal extraction, multi-bus capture via SocketCAN, and scripting for automated fuzzing.CANalyzer (Vector Informatik) is the industry-standard professional tool used by OEM engineers. It provides hardware-timed capture at full bus speed, signal-level decoding, J1939/UDS/OBD-II protocol analysis, and integrated simulation for ECU testing. CANalyzer costs upwards of $5,000 but is the gold standard for automotive security validation.

Key Relay Attacks

Passive keyless entry (PKE) systems operate on a two-frequency protocol. When the driver approaches the vehicle, the car's LF (Low Frequency) antenna — typically at 125 kHz or 134.2 kHz — transmits a wake-up pulse. This LF signal has a range of approximately 1.5–2 meters and activates the key fob's receiver. Once woken, the key fob computes a cryptographic response and transmits it via UHF (Ultra High Frequency) at 315 MHz (North America) or 433 MHz (Europe/Asia). The car's UHF receiver validates the response and unlocks the doors. For push-to-start, a similar challenge-response exchange authenticates the key before enabling the ignition.

Relay amplification attacks defeat this system by extending the effective range of both frequencies. Two attackers coordinate: one stands near the victim (inside a house or building), holding a relay device that captures the car's 125 kHz LF wake-up signal and retransmits it via UHF/Bluetooth to a second device. The second device, held by an accomplice near the car, retransmits the LF signal locally to wake the key fob. The key fob responds, and the second device captures the UHF response and relays it back to the first device, which transmits it to the car. The entire exchange completes in under 200 ms — well within the car's authentication timeout window.

In 2018, researchers at KU Leuven demonstrated a practical attack against Tesla Model S key fobs. The Tesla system used AES-128 encryption with a static challenge — the same challenge was replayed every time. By capturing two consecutive challenge-response pairs (achievable in seconds with a $600 relay device), the researchers computed the next valid response offline using a simple XOR operation on the encrypted stream. The entire attack — from capture to vehicle start — took under two minutes. Tesla subsequently issued an over-the-air firmware update that added rolling codes and accelerated key fob re-keying.

Modern mitigations target the relay window. Accelerometer-based key sleepdetects whether the key fob is stationary (e.g., on a nightstand) and suppresses LF wake-up responses, preventing the initial relay trigger. Apple AirTags and some BMW key fobs implement this approach. Ultra-Wideband (UWB) ranging, adopted by the FiRa Consortium and Car Connectivity Consortium, measures the time-of-flight of radio signals between the key and car with centimeter-level precision. UWB resists relay attacks because the additional propagation delay from relaying is detectable — a 3-meter relay adds ~10 ns of latency, far exceeding UWB's ±1 ns accuracy. BMW, Apple, and Samsung have shipped UWB-enabled key systems since 2021, and UWB is mandated in the CCC Digital Key 3.0 specification.

OBD-II Port Attacks

The OBD-II port (SAE J1962) is a 16-pin D-shaped connector located within 0.6 meters of the steering column on all vehicles sold in the US since 1996 and in the EU since 2001 (EOBD). It was mandated for emissions diagnostics but provides unrestricted access to the vehicle's CAN bus. The port supplies +12V battery power on pin 16, ground on pins 4 and 5, and CAN-H (pin 6) and CAN-L (pin 14) for the powertrain bus. Some vehicles also expose K-Line (pin 7), J1850 (pins 2 and 10), and secondary CAN buses on pins 1 and 9.

The ELM327 is a microcontroller that translates AT commands into OBD-II protocol frames. It exposes a serial (UART) interface accessible via Bluetooth or WiFi, making it the most widely used OBD-II adapter — sold for $5–$50 on Amazon. While the ELM327 was designed for diagnostic reading (Mode 01–10), its firmware supports raw CAN pass-through mode (AT SP 6 for CAN 500 kbps, AT SP 8for CAN 250 kbps). In this mode, any CAN frame can be read and transmitted, transforming a $10 diagnostic tool into a CAN bus injection device. The ELM327's limitations — 1 CAN frame per UART transaction, no hardware timestamping, and slow baud rate — make it unsuitable for high-speed fuzzing, but sufficient for targeted ECU manipulation.

For more serious research, the CANtact and CANtact Proadapters provide native SocketCAN support via USB. The CANtact uses an MCP2515 CAN controller with an STM32 microcontroller, supporting bit rates up to 1 Mbps and hardware timestamping for precise message timing. The CANtact Pro adds isolated interfaces, dual-channel support, and a higher-speed USB connection for sustained capture. Both devices are open-source hardware, and their firmware integrates directly with Linux SocketCAN, enabling the full Linux CAN toolchain: candump,cansniffer, cangen, and canplayer.

Through the OBD-II port, an attacker can read and modify ECU parameters via Unified Diagnostic Services (UDS, ISO 14229). Diagnostic sessions (DiagnosticSessionControl) allow ECU identification, DTC reading, and I/O control. Security-access sequences (SecurityAccess) use challenge-response authentication — but many aftermarket ECUs implement weak or backdoored security seeds. Once in an elevated session, an attacker can write ECU memory (WriteMemoryByAddress), request ECU reset (ECUReset), or reflash firmware (RequestDownload/TransferData). The security implications are severe: CAN bus access via OBD-II grants full control over powertrain, chassis, and body systems, with no authentication on the CAN layer itself.

Key Cloning and Relay Attacks

Modern keyless entry and push-to-start systems use a challenge-response protocol between the key fob and the vehicle. Relay attacks extend the range:

• Relay attack: Two attackers with radio devices — one near the key fob (inside the victim's house), one near the car. The device near the key captures the LF (125 kHz) wake-up signal and forwards it via UHF/Bluetooth to the device near the car, which retransmits it. The car thinks the key is present and unlocks/starts
• Key cloning: Capturing the LF challenge-response between key and car using a $30 Proxmark device. Some older immobilizer systems (Hitag2, KeeLoq) use weak cryptographic protocols that can be broken with 1–2 captured challenge-response pairs
• RollJam: A device that jams the rolling code from the key fob (preventing the car from receiving it), captures the code, then replays it later. The car owner thinks their key fob stopped working and presses the button again — generating a new code. The attacker now has two valid codes

OBD-II Port Access

The OBD-II port (J1962 connector) is the primary physical attack vector. Located under the driver's dashboard, it provides direct access to the vehicle's CAN bus. While designed for emissions diagnostics (Mode 01–10), it offers unrestricted access to all CAN traffic. Security researchers use devices like:

• CAN bus sniffers: Arduino + CAN shield, CANtact, CANtact Pro — capture and analyze all CAN traffic
• OBD-II adapters: ELM327-based Bluetooth/WiFi adapters (popularized by Torque, OBD Fusion) that provide read access to vehicle parameters
• CAN injection tools: SavvyCAN, CANalyzat0r — tools for injecting arbitrary CAN frames to test ECU responses
• Vehicle Spy, CANalyzer: Professional automotive analysis tools used by OEM engineers and researchers

Industry Response

After the Jeep recall, the automotive industry took cybersecurity seriously:

• ISO/SAE 21434 (2021): Defines cybersecurity engineering requirements for road vehicles across the entire lifecycle — from concept to decommissioning. Mandates threat analysis and risk assessment (TARA) for all ECU development
• UN Regulation 155 (CSMS): Requires manufacturers to implement a Cybersecurity Management System (CSMS) and demonstrate compliance for type approval. Effective July 2024 for all new vehicle types in the EU
• Bug bounty programs: General Motors, Ford, Toyota, BMW, and Tesla now run public or private bug bounty programs through platforms like HackerOne and Bugcrowd
• Secure CAN gateways: Modern vehicles isolate the infotainment network from the powertrain CAN bus using a gateway ECU that filters and authenticates messages. The gateway prevents direct exploitation of IVI vulnerabilities
• Hardware Security Modules (HSM): Secure boot and message authentication for critical ECUs. AUTOSAR SecOC (Secure Onboard Communication) adds MAC (Message Authentication Code) to CAN frames for tamper detection
• Secure boot: ECUs verify firmware signatures before execution, preventing unauthorized code injection via OBD-II or over-the-air updates