hello everybody
i'm uh don i'm doing a presentation on
gateways uh so uh there's a
a lot of different challenges that we
have
in uh in cyber security uh
a lot of times in fact the very first
time that i worked with car for car
i'll pronounce it that way um the very
first time he showed me
how to fool the vehicle so that
the radio thought it was in park and i
could
watch a video while i'm driving okay so
that was literally my first uh my first
exposure to
uh to faking the car out but
you know a lot of times we have to
change a signal uh
or a pdu a collection of signals uh we
want to block
something we want to override something
we want to change something
in a frame uh maybe you want you want to
add something
but it only it can only go to the target
ecu i don't want it to be sent to any
other ecu
um we need to convert something
to some form to some format some
protocol for instance maybe i have knft
or i have lin but i really have a device
that can only do
can 2.0 or classical can uh or
maybe i'm doing ccp or xcp and i need to
actually convert that out to
some periodic uh can signal because some
device that i have
can't deal with the ccp or xcp data um
sometimes we need to limit the number of
frames that are going to some device
okay so for instance a good example is
you might have 16 ecu's in a battery
pack for instance
um and all those 16 ecu's might be doing
some work
you might want to talk to those but
there's so much traffic already
that if you send that traffic out and
you're also sending it to all the other
ecs connected to it and monitoring those
then you might actually cause the bus to
crash so
being able to either limit the traffic
down to a manageable amount or to
consolidate
specific frames or even
take different signals which i'll
demonstrate at the end
take different signals and consolidate
them into a single frame of
traffic um is something that you want to
do
okay and one thing that uh is
just starting to hit the scene right now
is protected pdus
uh protected pdus are basically when
we're sending a pdu
or a collection of signals and it's sent
with essentially a protection value a
mac
as well as a freshness value
and so changing that data if we were to
say try to tweak it means that the
target ecu is essentially going to
ignore the frame
because the mac is created with the pdu
or
collection of signals as well as the
freshness value
so changing the signal changes what the
match should be
and so uh if we wanted to make a change
in that it's gonna be a lot tougher
but we'll get to that okay uh so the
solution
um i've heard it called many names okay
uh i've heard it called a gateway a
translator a converter a bypass
but essentially all these devices will
ingest
some traffic from some network and then
it will put the traffic out on the other
side in some certain format
sometimes it simply bypasses uh it's a
total uh
pass through both directions it does not
affect the data but you can see what's
coming
in and going out uh just to examine it
and further not do further analysis
um but i will call it a gateway
so essentially gateway is really that
conduit of information going from one
vehicle network to another
um so we've done or i've done uh several
of these i used to do them all manually
programming them
uh in our in the devices that my company
happens to sell
um but you know doing can can or candle
in
uh you know when lan candling you
essentially see that
see that all the time because there's
always a can
ecu that operates as the webmaster
uh can to ethernet or ethernet to
ethernet like switches that you see
inside your vehicles um some uh
many vehicles now have a central gateway
or a common gateway
uh several different names for it but
essentially all the traffic goes to it
and gets routed out uh to minimize
repeating traffic on multiple buses and
to segment the the vehicle out um
that's not really the the the central
gateways or common gateways are not this
the subject of what i'm talking about
today um
that's really kind of for another day to
talk about defeating those that kind of
thing
so how how do you make the gateway
um well when back when i was a little
younger
i used to code it myself so uh
when you do that one of the biggest
problems with it is
uh it's easy for somebody like me to get
confused
you know what's going what's being
received versus what's being transmitted
um you have to keep in mind if i'm going
from one bus to another
one thing that's being received on one
side to be transmitted on the other i
have to be able to
make sure i don't accidentally
retransmit the thing i transmitted on
the other side
back again causing essentially a big
loop right
um so coding it yourself can be can be a
problem because
of the amount of time it takes it can
also be a problem because of the
performance of the device okay uh not
everybody can afford a hill
and uh and be able to send out traffic
really fast and
have super high performance as though
you are
you are in a vehicle network um so
another way to do this is a rapid
development tool uh
and that's what i'm going to show today
uh so that's
but the tools themselves are really a
sidelight okay
uh the idea is to show certain examples
of the things that you might need to
gateway or things that aren't possible
maybe a couple things you haven't
thought of yet uh but uh
i i plan on doing a demonstration of
those all today
so uh and i already talked about this
part but essentially
these are the function blocks that are
inside of intrepid's vehicle spy
software
um and i used to write these you know
step by step
and write all the code that goes around
it to do a gateway
uh generally it would take me hours and
then some time to troubleshoot to get
any gateway right um so uh
so one thing that our customers
often demanded was they did not want to
write anything
which is kind of a tall order uh how do
you make
some type of uh of interface where you
can create
gateways and automatically generate the
code
well after several years of dreaming
um that actually is done inside a
vehicle spine
uh there are other tools out there of
course some that are actually uh
you can actually run embedded c code in
some of these tools actually you can run
embedded c code as well
uh but most of the tools that intrepid
makes can actually
run gateways or uh simulate ecu's for
that matter
and many of them can actually run z-code
as well
as uh as running the function blocks
that i just showed
so um the idea is essentially
uh we have a new view a new relatively
new view inside a vehicle spy called the
gateway builder
and the gateway builder essentially
creates those functional blocks for you
and on occasion will also create
embedded c code
depending on the task that you're doing
so
it's really pretty straightforward uh
i'm not gonna tell you that i love the
interface but it's not bad
um it takes a little bit of getting
getting used to um
but it's really our first attempt uh at
the gui
but it does definitely do a lot of
things so essentially you start out by
loading the databases that you create
or maybe some that you already have um
and you essentially drag and drop the
networks or the messages or the signals
from the input side to the output side
and you can create
multiple layers of these so that you can
do things like
i'm going to pass this one this one
entire frame
as it is every time or
i might also want to pass a single
signal and then
lock down what the other values are
but in any case once you create it then
you can click on a button
that downloads that programming into the
standalone hardware
so to give you an example of what you
can potentially do with this
i'm going to pull up
this little guy here because it actually
is connected up to this right here so
what's happening here is that
on my pc i've got this neoli fire 2
it's connected up to this neo ecu uh the
neo ecu 12 here
which is essentially like a little easy
oecu simulator
it it basically is it's pretty
straightforward it's really very cheap
uh what we're doing here is that we're
sending can out
uh the dual wire can out it goes into
the neo ecu 12. from the neo ecu 12 it's
actually coming out as lin
and that comes out over here
and that connects up to
this guy cluster so
um and i can of course adjust that
cluster because there's actually gateway
going on
see that it gets a little bit dimmer a
little bit dimmer fuel level go up and
down
right there you see it rpms up to like
six grand
vehicle speed let's go to like 260. got
it pegged but if you look up there
you'll see the speeds up there like 248
that's kind of cool
so this is actually gateway that was
programmed
inside of that new ecu 12.
and the fire 2 that i showed is really
just a way of showing it
okay but that's just a quick example of
something you could do you can use it
for like a prototype
uh use it for testing you see it a lot
in
industry uh or in automotive design in
validation
as part of a test bench
but it can be pretty useful on the
hacker realm
because now i can take something and say
well i don't like that it's sending out
the signal here i can change it to
something on the other side
right change it to what i want change it
to something that
might give me a result and give me more
clues as what to do
so um so what i'm going to do here is
essentially uh
give you a quick um view or a rundown of
the gateway builder view
but i'm also going to pull up several
different demos
to show how this can work for you
so essentially on the left side here
you'll see it says
inputs what this means is we've loaded
in databases
and in this case it's loaded up to hs
can this might be
in our future products it's called can
one so the first can
channel and so the database is loaded up
over here
and that would be the input side where
it says input network
on the output network i've got ms can in
this case
and another set of databases here so
essentially you have to have a database
on the input side and on the output side
so that the gateway builder knows the
structure
of the messages the signals pdus
on both sides and then you can you can
then tell it
pull the signal in change its value put
it into this other signal on the other
side
okay so in that case with the exception
of
gatewaying the entire network we have to
have
a full database of some sort even if
that's something you created
and these databases are actually totally
fictitious
uh some i created uh she's over 10 years
ago now i use them for training all the
time
so now i'm going to go through a number
of demos and explain what's going on
uh basically here on my desk
i've got same setup you see there on the
slides
and basically i've got two fires that
are tied together with a test board
so um essentially there's a termination
between
somewhere that powers up the whole setup
i'm going to plug that guy in like you
see on the slide
now let's do
some demos
so the first demo i'm going to show you
is essentially a bi-directional gateway
really really simple doesn't get simpler
than this
so um what i can do is actually just rip
this thing apart and put it back
together again real quick
just to show you what it what it's
actually doing and in fact well yeah
this should be fine
let's do this so one thing you can do is
you start out with an input network
and this one i'll choose as hs can
this is one of the few that does not
need the database at all
but i have the databases loaded so
input side where i'm going to start out
hs can
on the output side i change it to mscan
and if i simply just just push the
button that says
gateway entire network click that and
now all the messages that are on that
one network
will be sent across to the other network
okay
now if i want the messages that are on
the other side on
ms can to come across and come back to
the hsk network
i can do that too so i need to select
the ms can
on the input side
and hscan on the output side
and again click on gateway entire
network and that basically
is both sides of the network
so what i'm going to do is actually plug
in a new vi that actually you'll see it
says
hs plus mskn on it that's because it's
actually sending traffic out on both
those networks
and i'll show you that once i fire this
guy
up
and i'll actually show you all the
traffic
so you'll see here it says fc and
there's another one fc
this wheel speeds is actually being
pulled in
on hs can and transmitted back out of ms
can
and if you go through here a little bit
farther you'll find there are some that
are
on ms can like the stat one right here
and it's being retransmitted on hs cam
so that's pretty quick i basically
ripped apart the gateway
rebuilt it again inside the vehicle spy
like that
not bad so what's the use of this
uh besides just showing off well the
thing is
i can tell by this traffic here
oh of course my mouse decided to die
awesome
not awesome wake up hello
there we go sorry about that so i'll
just type in a filter here
so i can tell that this message
is coming out of
the subject or the target ecu the one
that has the simulation inside it's not
plugged into my computer
because i'm receiving it on my test tool
and i'm retransmitting it on the other
side
so if i were to have something like this
that we're actually connected uh between
an
ecu and the rest of the vehicle i could
potentially figure out all the things it
transmits
uh probably a lot quicker though just to
disconnect the ecu see what disappears
you may get some other things that do
appear um but
uh this is something where you can
actually connect up
still keep everything running the timing
is actually very very good
very very good and uh you could then
start to play with it and build a
gateway
take messages away keep all the other
messages coming along now
i'll show you all that here in a moment
so now here's another one these will all
get a little more useful as we go along
promise so
basically
what might be a little bit more useful
is i grab onto a single
frame a single pdu a set of signals
and i want to say transmit that on
another bus
and i might do something else with it
okay
so i'll go online with this one just to
show what's going on here
and you'll see there's only one being
transmitted it's just that ms can
and that actually
is being retransmitted from this data
seven
it's not being changed it's just being
transmitted at the same rate
so in the gateway builder to build this
um
let me go offline for a second
it's really pretty easy i can hit this
delete all button that gets rid of all
the stuff
um and all i've got to really do is go
over here
and say well i want to grab this one
frame
so this uh right here at the top of the
tree
i can just drag it over drop it in
and then off i go it's already going to
forward that message
so you see here on the input for the
message and
it's gonna automatically show up on the
other side i don't have to tell it what
message to put it into
at this point when i say forward it will
take the message as it is and just
forward it across
it's not going to play with it yet it
will
be like that soon so um
if i go online i'll just uh start firing
up again just like you did before
anytime there we go
so now we'll do something a little more
fun
oh
so say that i wanted to do something a
little more exotic
i wanted to choose when and if
i re-transmit based on some
data now this data could be data that's
in another
frame so
i'm going to go online and i'll show you
what's really going on here
may not be clear right away but it will
be once i tell you what to watch for
so just like before we're retransmitting
data seven
but basically we're going to wait until
that target speed goes below
10. once it goes below 10 it will stop
retransmitting
okay so uh to show you how that works
we'll come back to it you can actually
see that happen
essentially instead of just
instead of just forwarding the message
which is what we did in the last example
we put a condition on it over here and
so that condition is
actually built into this uh expression
editor
so target speed is greater than 10.
then a little bit of time time passes
and oh it uh yeah it went way up again i
should have let it run
but basically that's another alternative
that you could do that
uh you can do things where you're not
using the data
from the thing that you're
retransmitting so this could be based on
another message something from another
network
you really could do whatever you want
okay
eventually you'll see that guy go down
i'll let that guy run for a while while
you go up the next one
and eventually you'll see this guy's
gonna stop transmitting
because that guy right there will
actually start to
uh fade away you'll see that that
highlighting will fade away
in the meantime i'm going to pull up
another one
because this is probably something that
i see requested a lot
okay this guy's just about over here is
just about to go away
but uh basically i might want to grab
something
and then just change the arbitration id
okay
change the id and by the way this one
just finally went away
that's why it stopped at 292. it's no
longer transmitting so
it just jumped up up again and now it's
transmitting again
so in this one set up in a similar
way however if we're going to remap it
then what we need to do is to choose
something a bit different down here for
the action we cannot just forward it
we're actually going to what we call map
it to another uh another uh
message so over here i've got
in this case it's data seven it was
pulled over here
i will end up deleting the second one
here in a second i'm just going to
rebuild
that first one get rid of the second one
and then run this
demonstration but essentially if i want
to map it
now it starts looking for a message
saying select a message
so over here i have to find a message
that i'm going to map it to
and in this case we've actually made a
transmit message
that i can grab and since i'm grabbing
the entire frame
data 7 here so it's got all the signals
in it right
i'm going to grab this entire frame and
drag it down and drop it right in
here okay
and that's how i created that first one
so i'm going to go online and then
you'll see that uh this is actually
duplicated
so i've got uh let's see i believe it's
oh
yeah there we go it's 123
7 11 i believe let's see if i got them
right
yeah looks like they're uh yep they're
right next to each other there
so that's another tweak i can do so now
i'm getting a little more sophisticated
a little more realistic to things that
you might want to do
okay this is something that i've had
people ask me
many times to do just in testing
validation
also on you know for cyber security uh
they want to change something hook it up
to some other device
record it etc
all right next one is
i have it in canon and it needs to go to
can fd
so again the same idea you're dragging
over
from your message uh your input
and then on the output you're picking
another frame for it to go to
in this case it's simply a classical can
frame this data seven
and we created a can fd frame on the
other side
just a second here i'm trying to see
because my
eyes are terrible so essentially you'll
see that it's got
three separate signals in here you can
ignore those other things those are
actually just
properties of that can data seven
and you'll also see that they have the
same exact names over here as well
so those will automatically get mapped
over uh
but the size of this frame is different
you'll see that here in just a moment
uh the warning it's talking about is the
length of bytes is 20.
the warning on this little warning
flashing light
but this one's eight so this is actually
20 bytes just to show its cam d
it'll still go online though
so i know i'm throwing these up really
quick but the fact is
i haven't used this uh probably in a
year and a half
and i actually went through all these
and did this all within the last two
hours and troubleshot
everything and got it running so uh even
if if you were
totally new to vehicle spy in the
gateway builder then you could
get this done like start at 10 o'clock
in the morning and be done by lunch
probably have everything trouble shot
and ready to go easily
most likely you'll have it done in a few
minutes if it's a simpler one
so you can see this one right here is
actually standard can
you can tell that
because in this view you'll see there's
fdf and the
vrs esi those are different switches for
can fd they are not present in all the
other data because that's all standard
can
or classical can but you do see that
those values are in
this frame and of course it's 20 bytes
so that's kind of a dead giveaway
all right
all right now we're getting
to more and more fun so in this next
demonstration
i'm basically grabbing uh a certain
signal and tweaking that signal
okay so let me show you what this is
doing this time
in this case what we've done is not
grabbed the whole message or frame
i've actually grabbed one signal so in
this case it says lf wheel speed
so left front wheel speed we just drag
that in and now we've got a signal
so if we do a single signal then it will
be interesting to see what really
happens
when we do this as a gateway because of
course
it's not like you can get one signal and
just forget all the rest of the data
bytes in your cam frame right
so uh in this case what we're doing is
we're actually
still forwarding it just like we had
been forwarding entire can frames
but we are taking this one signal
and we are changing it by using this
expression checkbox
and in that expression we're making it
255. so we're gonna make it ff
essentially because this is going to be
one bite so
let's fire this up and see what happens
and time gas there we go here i'll just
go ahead and get rid of that filter
you can see that everything else is
still working but you only have this one
ms scan coming across here
and this data five is what we actually
we're grabbing one signal from
so let's filter this out and see exactly
what's really going on
and so in this case this lf wheel speed
you can see unfortunately these are all
the same value and they stay that way
but this lf wheel speed is actually
byte4
and that's why it says ff here but
it doesn't show any values for the other
ones so
one question why would it not
transfer the other ones well you did not
tell it to do it
you only transferred that one signal so
if you want to you can transfer the
other ones
and you can change those if you want or
just transfer the existing value
so that way you can tweak right down to
the bite you know whatever signal you
make even if it's a single
just a single bit you can actually tweak
it in this manner
okay
all right i've got two more demos and
then a few more slides and then we're
ready to roll
okay so now we're going to get to
something a little
more elaborate so essentially what we're
going to do is take a couple a couple
data bytes
and we're going to uh
send those across let me go online with
this one
you might have actually found a bug in
our existing software in this one
something tells me that this one was not
working
quite the way i wanted it to
so basically in this one
i think this is one that actually is not
working quite the way it should
because it's not actually wrong
this one is actually supposed to have a
different calibration in this
engineering rpm
uh let me try something different
i'm going to try to reload this in
essentially what i would do is grab this
engineering rpm pull it up and then
choose map
down here and then the mapping would
actually be to
when i map it to the other signal so
that i can pull this guy
in drop them in here yeah there it's
it's not now it's saying it's a warning
but it looks like we've got some error
somewhere i found some bug in this tip
just a couple hours ago but you can see
that the scalene
originally there is no scaling but in
this case
i'm actually sending it to a signal that
has a different scaling
and in this case i could actually change
the scaling on the fly
as part of the gateway so let me go
online with this and we'll see if it
works i have a feeling it's not going to
work
so uh oh yeah yeah we got a problem with
that one there's definitely a bug in
there sorry guys
it happens
oh now we got real problems give me a
second here i'll try to find that one
see if i can actually make this other
one run because we are almost done
actually you know what i'm good that is
actually the last
one let me oh no no
this one i want to do definitely this
last one is actually combining
the signals from different uh different
uh
from different frames so essentially
i've taken one signal
from this data 6 frame a couple from
data 7 and 1 from steering wheel angle
and i put them all together in a
separate database over here
so essentially those are now all
combined and all four of these run at
the same time let's see if we can get
away with running this i don't know if
i'm going to with the other
other instance crashed on me so i might
get away with it i might not
ah worked so basically what you see here
is that we are actually taking the
values
from each of these that i've mapped like
in this case i think it's fuel alcohol
percent
so you can see that guy's the same
target speed is mapped
i think the only thing is i should have
forced this to a certain uh
data rate that's why it's jumping around
so much it's pulling in
it's it's transmitting every single time
any one of them changes and they're all
on the scene
so let me jump out of this
we can kill all these instances we've
got enough i've done enough vehicle spy
for today
get rid of all those holy shmoley
how many copies i have running about 15
so um so essentially last couple
slides here this won't take long like
eight more slides were done
so message injection uh so or signal
injection
um sometimes you want to just
change the data in a certain cam frame
and in
the old school way is to simply just
transmit
twice as fast as the existing
frame on the bus and when you do that
essentially what happens is the ecu's
that are monitoring that
will essentially always see your value
let's see your frame because yours is
coming out twice as fast
unless it's exactly on the money then
you're going to
uh that ecu will always see your values
not
the actual ecu's values so that's really
pretty easy
and that's the way we've done it for
many years ever since canon's been out
there
anytime somebody wants to play with
something for something in a certain ecu
that's great
however the problem is
uh we have protected pdus so the
protected pdus are essentially
uh you know they're part of autozar's
secure onboard communication
uh it it makes the uh the vehicle
or the ecu immune to replay attacks
and you cannot override a can frame
because
the mac value that's being transmitted
and the freshness value along with it
is part uh well it's part the signals in
the freshness value are part of the mac
so therefore if you change the freshness
value if you change
the uh the pdu or the signals
then you have to have a new mac and if
that mac doesn't
uh jive on the other side then no go
the ecu that receives it will ignore it
so
you essentially have to have a man in
the middle okay
and that's just the beginning okay
so if you
uh if if you are going to do this that
means you'd actually have to put
security
into the neo5 okay or into your box
and the fact is we actually have already
already implemented this for some oems
uh because they have to use it to test
there is no way to do this
injection testing to force a certain
signal
unless you can change the signal
recompute the mac up keep the freshness
value
and send that on and do it quick enough
like a hill
in order to be accepted by the ecu and
i'd love to
demonstrate it but i can't
not that i can't do it just that i'm not
allowed to show you
uh but it can be done so uh
any questions feel free to contact me uh
i'll be in the village
and i'll be in the q a here i'm sure
when the video stops playing
thanks a lot
you