thanks
uh so i'm ben i'm pretty excited to be
here
talking today about truck hacking i'm
going to introduce you to commercial
transportation show you why it matters
we're going to be talking about trucking
in particular so trucks and trailers and
distribution centers etc
then we're going to get into the
technical details of the three main
vehicle networks that are found on
trucks today
in the second half of the talk i'm going
to do a review of some of the public
attacks
on trucks and i'll highlight areas where
you could use some more hacking
so there's definitely room for your own
research and i'll give you some ways to
get involved
then we'll wrap up the session by
looking at some concrete examples
of using tools to interact with the
vehicle networks and i'll also give you
a whole
list of tools that you can go and get
and play with yourself
just a very little bit about me i'm a
cyber security research engineer
contractor at the nmf da
i have some previous experience in
embedded systems design and reverse
engineering
i'm also proud to be a cyber truck
challenge instructor
and a volunteer at the uh defcon
hardware hacking villages
and karachi villages
so commercial transportation what is it
a very broad topic
all possible transportation of goods or
people for a business
purpose just about anything it makes up
you know trailers
trains and ships which you can see
pictured here
also card retainers which is called
intermodal is a big part and we'll talk
about that
why does commercial transportation
security matter
uh look around the room you're in right
now
if you bought it it came on a truck uh
truck problems are
big problems for society and
if you need to be convinced i encourage
you to take a look at a week without
truck transport
at iru.org it's amazing just how deep
the supply chain of trucking goes there
are some communities that even need to
get their drinking
water from trucks and then
probably most obviously trucks are the
big lumbering giants on the road
and safety issues with trucks are all of
our issues
if you think about all the modes of
transportation and not
just trucking it matters because we're
all linked by that global supply chain
but also because all the technologies
are shared among the different modes
so a vector of an attack in one mode can
actually be an attack across the board
uh for example the can bus hack research
that demonstrates
engine's disablement via d-rate abuse is
actually applicable across all the modes
because diesel is found in all the modes
and we're going to talk about that a
little more later
so trucks pictured here in this
spaghetti diagram they have a lot of
features
a lot of connectivity and they have a
lot of variations
trucks are actually leave the factory
today sometimes with three different
cellular modems
installed the particular components and
specs of a truck
are built to order by the fleets which
accounts for all the variation
these trucks actually use multiple
different vehicle networks and sometimes
multiple segments of the same network to
accomplish
all the features that are necessary this
diagram you can see is
showing three different types of
networks three connectors
a whole bunch of different components
one of the things we're not picturing
this diagram is components that bridge
multiple segments other than that
gateway
because doing so would make it a bit
more of a spaghetti mess
but those types of components the bridge
segments are also present
and take note of the connectors here the
j560 connector
is the uh is what's used to make the
umbilical connection between the tractor
and the trailer that obd connector is
the uh regulated
onboard diagnostics connector found in
all trucks
and then the rp 1226 is a newer
connector but was put there because
permanently connecting devices such as
telematics or other aftermarket
is not recommended for the obd connector
so the oems place that there to give
fleets a place to put their permanently
or semi-permanently start
installed equipment and of course it
goes without saying
these trucks they exist as money makers
if they're not rolling
then the fleet is losing money so what
about trailers the other things that
roll
they actually outnumber tractors in
north america they have plenty of
features
what you see pictured here is a summary
of the features you'll find in a trailer
based on questionnaires that we put to
our fleets
they all have trailer abs unsurprisingly
because that's regulated
there's also other features and the
other features are usually integrated
with wireless proprietary but there are
other
proprietary type networks that will
enable those features as well
and uh it seems like there's still quite
a bit quite a bit more than just
trailer brakes these features aren't
stopping there though they're growing
every day uh this is a conglomerate
of future looking features that you
might find in a trailer based on a bunch
of webinars
by paul menig and the people that he
invited into
ata tmc task forces combined with some
of the questionnaires that we put to our
members and you can see it's
quite a lot of features quite a lot of
different bus options
note that the adoption of these
technologies has been pretty slow a lot
of these things that you'll see here
have actually been listed as next
generation technologies
in a report that dates to 1998 so take
the marketing with a grain of salt
but these kind of technologies are
coming as are the switch to a different
bus
you'll see here we're listing can j1939
as well as iso 11992-2 which is also
known as tt can
these can buses and trailers are much
more common in europe
in north america today they're pretty
rare but that may very well
change in the future and then
an important thing to mention is that if
you thought getting testing time on a
truck was hard
imagine getting testing time on a
trailer if these trailers
aren't rolling or docked they're
actually parked holding cargo
so getting time in a trailer is pretty
difficult and the trailers last a really
long time
they stay a service lifetime of about 30
years in north america
so a lot of the trailers you'll run into
are quite old maybe beaten up
and seen better days
so trucking uh you know goes without
saying i think i said it before
it's a money maker the vehicles are
owned for commercial purposes
sometimes they're leased for companies
for example penske
and they uh they protect their
investments with preventative
maintenance so maintenance is a big part
uh tractors actually spend more time in
a service center connected to
diagnostics than any passenger car would
uh the diagnostic software is quite
powerful you know
you can see that paper reference there
that bill haas was on the
diagnostic software for example is
capable of disabling engine cylinders
and cycling abs pressure valves
and a lot of this diagnostic software is
actually just low quality
windows software another big part about
trucking is the distribution centers
so fleets actually make extensive use of
these
for example in ltl less than truckload
where these distribution centers are
called terminals
and moving freight there is much more
like moving passengers and air traffic
um than it is like packets in a network
package in a network is more like truck
load
so you can also think of ltl as how the
postal service operates and these
terminals end up being staging areas for
different groups
of passengers as they get regrouped into
different trailers and sent on to their
next destination
these distribution centers actually have
a lot of technology and a lot of attack
surface themselves
which i'm not prepared to talk about but
it should be unsurprising to you to find
that
handhelds and tablets and iot and all
the other embedded systems
actually pervade the distribution center
today
intermodal briefly a lot of people
recognize intermodal as containers
um a lot of fleets make extensive use of
them transferring them from train to
ship
to trailer as they're designed to do
we've heard that some intermodal
containers actually have their own
networking
interconnects and many of these
containers have their own telematics
modems so just another way that things
are all interconnected
i'm not an expert in the other modes
here but it's important to let you know
what they are and that they all share
technologies
so ships also use jnt-39 and there it's
called nmea
trains also use jit-39 because they have
a diesel engine
although on the trains a lot of times
the diesel engine is set up as a
generator and not as an engine to move
as a motor to move the train and another
thing that all the modes share in common
is they're all
kind of accreting all of this iot stuff
and adding them on to their business
operations
you can see here a picture of a port
that has all kinds of handhelds and
different sensors and integration with
the ships the dock much like the
distribution center
so i hope i've convinced you that
commercial transportation is important
and that the other
all the other modes are interrelated i'd
like to move into discussing
particulars of truck vehicle networks
starting with j1939
i think a lot of people here joining the
car hacking village are going to be
familiar with can networks especially as
they relate to passenger cars
so i'd like to introduce you to j939
which is found in heavy vehicles
as it relates in an analogy to passenger
cars so
in both cases the can buses are encoding
time-varying signals
and packing those time-varying signals
into bit field locations
in passenger cars the bit field
locations are
you know signals that are identified by
these arbitration ids
and both the arbitration ids that
identify the group of signals
the locations of those signals as
they're packed our proprietary
information
in j1939 in contrast pgns that identify
the grouping of signals and the spns
that identify where they're packed
are the standardized parts in fact in
j1939
for the most part in passenger cars uh
diagnostics were standardized this is
mostly for carb
and in contrast in heavy vehicles it's
actually the diagnostics that are
proprietary
some passenger cars you should be
familiar with uds for diagnostics
trucks have more than one type of
diagnostic uds
is available and is gaining a share it
has its own reserve pgn for example
here's a nice little decode of a can
frame
that is encoding aj 1939 seed key
exchange
this was put together using ken
tyndale's can 2 decoder which is great
at looking at extended errors
and does a really nice breakdown and
build up of the parts of the frame
you can see here that j1939 frames use
extended 29-bit arbitration ids
which is the combination of ida and idb
that you see there
they can have a variable data field in
this case three
and then have all the normal can parts
there's also a diagram
below showing you how the pgns are
actually packed
into that arbitration id so there's both
unicast and broadcast pgns when we're
talking about a broadcast pgn it uses
all of the bits from 23 to 8
and for a unicast it actually just uses
the upper bits and encodes the
destination address and
arbitration id and in all cases the
arbitration id also encodes a source
address
and a priority as well as one reserve
bit and a page that is starting a page
bit that's starting to be used more
extensively
in the j1939 definitions
j939 has a lot of different features i
told you it has unicast and broadcast
it also has its own transport
fragmentation and reassembly mechanism
address claiming request to pgn data and
then more importantly to truck hacking
there's proprietary messages that flow
over j9039 networks
and they have their own reserved range
of pgns
both cast and broadcast
when you're dealing with trucks a lot of
the fun stuff the dumping and
reconfiguring and reflashing
is all protected by authentication and
authorization challenge response system
called
seed key exchange and the uds is used
for
cp exchange it has a reserved pgn of hex
da double zero
and you saw some of that encoded in the
previous slide
so let's talk about where you might be
able to find j9039 on a truck
first up is that onboard diagnostics
connector
these can be found in either black or
green they're located below
the steering wheel just to the left of
it they're usually this deutsch
9 pin although some oems actually use
the passenger car style
obd2 connector
on the black socket you'll find that
in addition to j1708 there's actually
two j1939
buses the second one is optional and on
the black socket
j939 runs at 250 kilowatt
on the green variety uh the j1708 bus is
actually optional
replaced usually by j939 and the j959
buses on the green socket run at 500
kilowatt
now those oem specific pins that you see
pictured there those are also
probably another j939 bus on many of the
vehicles
fine h9 on the rp 1226 aftermarket
connector it should be present on pins
two and nine and four and 11.
remember this is the aftermarket or
telematics connector that you might find
behind the dash or behind the berth
this was provided by oems to
give fleets a place to connect things
permanently or semi-permanently that
wasn't the obd connector
notice here that there's also two oem
specific pins
those are probably also a j1939 bus
in addition uh many modern vehicles have
lots of different j1939 segments that
are not pinned out
on the onboard diagnostics connector
this architecture diagram you see here
is from a textbook by duffy and wright
and it shows no less than six separate
can segments
only two of which are present on that
diagnostics connector
so you'll probably be able to find more
j939 if you poke around
in the harnesses of the truck
last uh finding j9039 is going to be
possible on db15 connectors
many of the adapter cables that you'll
use on heavy vehicles are
pinned out on db15 connectors so knowing
this pin out is really useful
can is present on 5 and 10 and 12 and
13.
so that was ji 39 let's talk about 1708
and 1587.
these two standards are pretty much
always found together
they pre-date j-1939 by many years
they're sometimes still found
in tractors and they're always still
found in the trailer
as j2497 more on that later you can see
here this analogy diagram that tries to
roughly place where j1587
is relative to where j1939 or say udp
would sit on top of ethernet
just so you can get an idea of the place
in the stack up
of these different standards so j1708
has a very similar bus arbitration to
can the lowest byte
first wins j1780 always runs at 9600
baud
8 bits one stop at no parity so 8n1
at the physical layer it's very much
like rs-485 but it has
hard time constraints for framing and
bus arbitration so
if you want to write j1708 you have to
actually
have um hard real time hold offs for
frame
delimiting if you just want to read j728
and dump it
any rs485 adapter should do
in j1708 that first byte is um called
the mid and it's much more like a source
address
than arbitration ids are on cam and
there's many
sort of noteworthy mids
one one one is factory test and that's
fun
there's also off-board diagnostics
programming there's a vehicle security
reserve number
there's bridges for drivetrain as well
as tractor trailer
and then uh four total j2497 reserves so
there's 10 and 11 which is the lamp on
lamp off that's the whole
razon detroit for j2497
um for 128 through 255
those are actually defined by the j1587
standard
so j1587 signals are identified by a pid
byte which gets
put into the payload of the j1708 frame
this is kind of different than j1939 or
passenger cars
where maybe the pgn implicitly specifies
the bit packing
um these signals are identified by a pid
that's put in the frame
and then how you decode the data that
follows the pid that's where you have to
refer to the j1587 specification
and of course there are tools out there
that can take the saa pdf
um and do a decode like pretty 1587
and we'll talk a bit about that later
j1587 has a lot of features
both broadcasts and unicast frames are
possible there's ways to request data
both requesting broadcast data as well
as component specific
data it includes fragmentation and
reassembly
both a transport protocol that's unicast
and a
special multi-section parameter pid-192
for pids that are broadcast there's also
a free-form
data standardized request that sits on
top of the transport protocol where you
can ask for interesting things like
programmable parameters and calibration
and executable code
there are of course uh since it's
automotive proprietary messages
and the private dairy messages where the
fun stuff happens in 1587 this is called
data link escape
and these are unicast so they're made up
by pid254 and 510.
uh an example message you might see is
you know
acfe80fo17 down here
which is a 254 pid being sent
from mid hex ac to mid hex 80
and the payload fo 17 is what gets
interpreted
by the destination on the other end
where will you find 1708 you saw this
already on a couple of the deutsche 9
pin connectors j7208 should be present
on fng on that black socket and it'll be
optional on the green socket
if you have an rp 1226 connector you may
very well have access to a 1708
bus on pins 6 and 13.
and of course if you have a db15 cable
adapter you're probably going to find
your 17 8 bus on pins
14 to 50. so we have reviewed the
locations where it's possible to find
1708 or 1587 but the presence of this
bus
is becoming increasingly uncommon on
tractors
the reason why it's relevant why we
cover it here is because
this network does show up on powerline
carrier
form in all tractors since 2001.
let's talk about that form it's known as
j2497
and it's what links tractors and trailer
abs
roughly speaking j2497 is j1708 over
trailer power lines it's also known as
plc for trucks
and you can think of it as an
alternative transport layer for 1587.
um the way it works is
it's almost exclusively implemented by
the intel on ssc p485 chip which
adds uh preamble and sync bits
around the beginning and the end of j178
messages
and this is a bi-directional switch you
can also see a time domain plot at the
bottom of the kind of chirps that it
puts together
j2497 has a lot of features itself the
primary purpose is for those
mid 10 and 11 frames oao and obff
are these the default frames for lamp on
and lamp off that's the whole reason why
they developed it
but because it is j1708
it has all of those features plus they
also had a dynamic address claim to
support
having road trains so multiple different
trailers connected together
because this is the data network the
trailer brake manufacturers
put together trailer brake diagnostics
so all the abs air pressure valve
cycling and ecu reconfiguration
should be present over 24.97 and some of
those brake ecs and trailers actually
have their own scripting languages
that are programmable over j2497
so one of the interesting things about
this network is because of that added
preamble that that chip
adds to the beginning of the message
there's a duplication of the first byte
being an id byte
you can actually create priority
override frames so for example you can
you can send a maximum priority double
zero
and a j1708 inside it as a minimum
double f
and that double zero frame will override
the priority of all the traffic but it's
received as a
mid double f and then finally because
this is a power line character
a carrier technology and it uses very
long conductors
we have been able to receive this using
the
sdr software from six feet away from the
trailer
so where are you going to find j2497
well it's always going to be
on that power bin the center pin aux on
the j560 connector
at the back of the tractor or the front
of the trailer pictured on that green
cable in the top right
which means all the adapters in the
bottom left are your friend
so you might find some adapters that
give you a db15 power right out to the
j560 as picture in the bottom left
there are in-line adapters um next from
the left
that's you have to be careful some of
them actually include an intel on
chip so they will convert from 2497
to 1708 some of them don't you can also
make your own inline adapter by taking
the
shell off a j560 cable and inserting
your own pigtail as you can see pictured
there second from the left
you might also find j2497 on the power
pins of the diagnostic connector that
obd connector the deutsche 9 pin but
you have to be careful some trucks
include filtering
so that the diagnostics connector is
actually
got filtered power relative to what
you'd find on the tractor uh
same for 2497 on the rp-1226 connector
so the
rpe 1226 document says that it should be
there
all the oems that i've ever talked to in
meetings
say that it probably won't work it
probably is filtered so you may or may
not find it on the rp-126 connector
uh 2497 might actually be on the battery
terminals
of the trunk which makes this adapter
useful sometimes but
it may also be filter paired the only
place is guaranteed to be found is on
that tractor
connected to the j560 but i have no fear
you might just be able to set up an
active antenna and some sdr software
and receive the traffic standing next to
the trailer anyways
of course there is going to be other
vehicle networks in intermodal
um we know that j1939 is going to be
found anywhere there's a diesel engine
and since j1939 historically replaces
j178 and 1587
uh it stands to reason that there may be
installations that also have j1708 on
their diesel engines
in intermodal we've also heard that
j2497 might be
used for power line communications on
some containers but haven't been able to
test this yet
in the future uh of course as
applications for
for high-speed data uh keep increasing
uh the number of buses and types of
buses that will be deployed will go up
some of the ones not listed here you
might find passenger cars like
flex-ray most um in heavy it looks like
can fd
may or may not make it in can hg looks
like a good option
to uh to avoid the incompatibilities
automotive ethernet
seems pretty clear that it'll find
applications on trailers
and of course the proliferation of
different wireless technologies
is inevitable on these vehicles
okay so that was an overview of what
trucking is
how it works with the technicals let's
talk about truck
hacking starting off with the can attack
methods so if you actually have access
to a can bus what can you do
um if you're thinking at the frame level
how you create
the can messages you can flood the bus
that's a pretty obvious one and i think
there's lots of examples of that in the
literature
or you can just send a message that you
want um
and pretend that you were the the
intended source and that's
spoofing but might be known by other
names all of the types of attacks that
we're going to discuss
in this section are all just simple
spoofing attacks so sending data
pretending that you the ecu that you
want to be
but there's more than that
there's a lot of different ways to
attack the protocol
level sort of below the payloads and the
arbitration id you might create using
something like socket can
so both the can hack tool by ken and
dell
and the cant tool by bitbain and n2 at
grim
are capable of doing things like bus off
attacks
spoofing immediately after a frame goes
by so you can be sure that
the receiver buffer will get it as soon
as possible and if the receiver uses
timed
receiving then you can actually replace
the message they're capable of causing
double receive
messages overload frames uh there's a
way to force
transmitters and error passive and then
replace the data or spoof the data
and then this type of an attack that's
janus which
exploits the fact that different
sampling points can be configured on can
receivers
so you can create a waveform that
is received with different data by
different configured sampling points
and then of course things like bus
shorting and knack data replacers so
those last three
actually require analog switches in
hardware
but they are an interesting attack
that's possible with some of the cant
tools all the ones that are in red are
possible attacks to
to employ if you have an soc that has
gpios connected to a can transceiver
so many socs uh have this configuration
where the can controller is embedded
in the chip and then there's an external
can transceiver that does the
differential
pair level shifting and if the
pin box could be reconfigured so that
gpios are connected to that transceiver
instead of the can controller which is
almost all socs and all of these red
attacks are then possible by software
takeover of those nodes
it turns out that analogs to these
attacks
some of them anyways are also possible
with j1708
so bus flooding and simple spoofing yep
that's just by creating the data
um doing bus off and spoofing
immediately is definitely possible with
real time control as would be
an error passive data replacing style
attack
so um let's talk about some of the
public attacks in literature
we'll talk about ten um each result is
true only on a specific model
per year of a particular truck so your
mileage may vary but they're worth
testing if you have access to a truck
first up is vehicle disable or limp
by uh def def additive message
manipulation so the def
is the the additive that's added to
diesel to make it burn
cleaner so urban johnson back in 2015
proposed this
the way the trucks are set up by
regulation uh when there's failures
in the additive control system the death
levels for example
the truck has to actually eventually
enter a limp
mode which where it's going very very
slow almost completely useless
so by manipulating those def levels
if you had access to the segment where
they were being sent you could actually
cause a vehicle disabled
denial of ecu's is possible so subujit
um et al demonstrated this back in 2016.
um they were actually able to exploit a
weakness in the data link layer
protocols of
1939-21 they demonstrated there was
actually a practical denial of service
attack
in these systems they're they're
practical because they were actually
later demonstrated on real vehicles
uh crafting the attacks did require
studying the workflow of the data length
layer
and identifying points that are suitable
for disruption
there were actually three categories of
dos that are identified there was a
request overload
there was false rts's and there was
connection
exhaustion
there's more vehicle disables and lymphs
that are possible
this is some research that was performed
by
um can bus hack sponsored by the nmfta
and they actually identified a whole
family of message types that could
possibly lead to
a d-rate event and hence also a limp
mode
so once more they created a very simple
fuzzing like
attack kind of a search through the
proprietary message space that was
demonstrated to find and cause d-rate
events
with a known investigation or reverse
engineering sorry
no reverse engineering required and they
also demonstrated that the d-rate events
could be caused by reconfiguring the
calibrated limits that are stored in the
engine components
which underscores the importance of
diagnostics security
there's more details on uh this attack
which is pretty recent
at our portal cts rpm fta org
seen there in the link what about
1587 and this is also in the category of
abusing
diagnostics uh haystack and six volts uh
deliberate a talk here at the car
hacking village in defcon 24
and in it they included an example of
how you could actually disable
a truck ecm by misconfiguring it and
they did this
by um doing some protocol and software
reverse engineering
of 1708 traffic and to demonstrate that
there were no access controls
on what needed to be sent from the
diagnostics software to create bad
engine configurations so in addition to
physical access
uh being required they also highlighted
that
compromise of the diagnostic software
would in fact be
sufficient uh remember the diagnostic
software is highly privileged
is usually just windows software running
on a windows pc
in a maintenance bay what else can you
do
it's possible to override the instrument
cluster display i think lots of people
have done this playing with instrument
clusters set up on benches for past cars
the same thing is possible in uh heavy
vehicles as demonstrated by
um liza virakova bill haas leaf milar
etc more by liza
and bill's team you can actually do rpm
control and engine brake
disable not only were they able to
disable the engine braking
but over 1708 they found that they could
disable cylinders
the particular truck they were testing
and this was done via legitimate
diagnostics functionality similar to
what
a stack and six volts presented
previously
they also were able to cycle abs air
release
and they noticed um that they could do
this by replaying diagnostics
diagnostic tool traffic those
unauthenticated uh
and what's interesting is that the same
functionality is also present on j2497
networks which maybe isn't
surprising since that's just j 1708 over
power lines
uh so last up is reading remote traffic
from j2497 we mentioned this in the the
technicals
of j2497 so we we did find that you
could
cycle the abs pressure valves but
um when you're just reading traffic it's
possible to get it from six feet away
and this was published as cisa advisory
last year and also got a cd
so in summary there's plenty of things
you can do both in 1939
1708 and 24.97
but there's more and we would like you
to give it a shot uh so what actually
needs more hacking well
abuse of the legitimate stuff is
probably a good place to start
so no no exploitation needed take some
diagnostic software and and see what can
actually be replayed it's a good place
to start
we have seen several examples of
fruitful abuse so far
but there hasn't been much in terms of
abusing
adas features or mobilizer body control
so some things to think about there's
also definitely research needed into
vehicle network gateways
so gateways being the devices that are
going to bridge multiple
can or j939 segments in the vehicle
sometimes they're being introduced for
performance reasons
um but whether they're being introduced
for performance reasons or not
they're always a security relevant
device since
they connect multiple segments and
pivoting is possible
so those could use some sunlight as well
what other truck and trailer hacking can
you do well just like car hacking you
know truck hacking is really
the olympics of hacking which is a quote
attributable to will
carijuana all the usual iot stuff is
there
game hacking as well telematics is
pretty much iot devices
all the mobile handhelds and head units
and
logistics devices are all android the
diagnostics and maintenance tools are
usually
just you know not very high quality
windows software although that is
getting better
and of course rf there's lots of rf all
over the trucks and
rf is usually you know whatever you got
whatever you want to try
so there's definitely a place for you to
get involved
if you're a professional or a student
that wants to get involved definitely
recommend the cyber truck challenge this
is
an event that's put together
specifically to train students it does
get attended both by industry
experts as well as the students and oems
and suppliers
each student that attends pretty much
gets more than ten thousand dollars in
free training
there is a stipend for students that are
eligible
there's going to be stuff to crawl under
and over in the form of trucks and boxes
and i do encourage you to participate
of course and this shouldn't be
surprising when watching the videos you
can definitely get involved through the
car hacking village
this year we're going to have some more
air brakes setups
launching some nerf darts for fun if you
want to join and try
if you want to get involved i highly
recommend doing a bench setup this is
definitely necessary in this field
because getting time on trucks is hard
as we mentioned if the trucks aren't
rolling the fleets aren't making any
money but you can make a truck in a box
looking at haystack and six volts paper
that's available on github
and for all the really gory details you
can check jose's
master's thesis which is available at
the university of tulsa
let's move on to some technical stuff
and talk about tools
for truck hacking or just vehicle
networks in general
so if you're on a j933 network and
you've got some traffic flying by
um you want to know what it is that
you're looking at
in a passenger car you might need to try
to get your hands on a dvc file that
defines all the bit fields and what they
mean and maybe with the arbitration ids
are supposed to be
in the case of j939 uh most of this is
standardized and if you had a copy of
the j1939 digital annex
you could go and decode it yourself
there is a nice tool that we've
developed called pretty j1939 which
takes that digital annex
converts it into a j1939 json file
uh and is able to use that json database
to decode the j959 traffic
the tool is also compatible with lots of
previous versions of the j1939db.json
format that you may find floating around
on the interwebs so if you have one of
those json files you're in luck you can
use it
i remember though that your decode is
only as good as the
db that you use with so um previous
versions didn't actually capture
all the details of j39 accurately so the
best quality will be obtained by
purchasing the digital annex and
converting it
the output that you see here is showing
how you can augment the can dump
format with commented json objects you
can also
omit the can dump stuff on the left and
just
put out a sequence of json objects that
format with just json is very useful for
filtering and beautifying with something
like
jq requiring the json
the can data you see here is from the
colorado state public can data logs
and so is the vin of the truck that they
own there
what about sending j1939 you can do that
using socket can
and you can do socket can on a truck
duck so the truck duck was introduced
here at the karaki village in defcon 24
by six volts and haystack it's the blue
one pictured on the left
since then they've put up together some
more versions like the 1.5 yeet
which is green and that mega board which
is blue next to it
also pictured here on the right is my
truck cape which is a truck duck
remixed by dr daley and it's in my
custom monogrammed laser case which i'm
very proud of
you can also see the sma connectors
sticking out of it which i use
for j2497 research
you can send j939 using socket cam
so here is a snippet of some python you
need to use sock raw
in most cases um
it won't send frames with transport for
longer data so you'll have to do your
transport
breaking up yourself but there are other
tools we'll talk about
um and this does let you put together
programmatically
we're showing a hex up here you have to
use you don't have to use struct pack
but you can see the struct pack example
there's um some patches that are
necessary for using other features of
j939 and we'll talk about that a bit in
a second
if you want to know more about what's
actually happening
in this snippet where address claim
messages are being put together
i recommend you check out the
presentation at our portal by dr daley
and you can see some of the sample code
at dr daley's
github i think there so there's lots of
alternatives to sending j39
since linux 5.4 there actually is a new
socket can type can j1939
which can be used uh since c python 3.9
so as long as you're above that
you can go direct to can j1939 for your
socket type instead of using
can raw like we saw on the snippet that
is how haystack put together
the truck duck for pi hv networks
um but wasn't actually but that was done
in a back port so it wasn't available
mainline until
much more recently there's a lot of
different kind of
semi-dead or semi-active python things
out there
the one that seems to be the most
actively developed is python can g1939
linked here that one uses can raw so
we'll be
workable on more systems than just the
most recent patched linux kernels
the api that it has there is best suited
for developing j939 ecu's but i'm sure
it would still be fine if we're putting
together
messages that you want to send all that
to say that
socket can isn't the only way to send
j939 there are other tools such as the
can cat
and the truck devil which are great
sending j939
we'll talk about those as well so let's
move uh to j1708 and 1587 and 24.97
you can decode all these networks using
the pretty j1587 tool so this is the
tool that will
take the sae pdf of j1587 and j1708
it'll convert them into a database and
then if you feed it
of frames from j1708 or any other two
networks we mentioned here it'll
actually do the decoding
this was presented last year by dan
salam and thomas hayes
uh here at the ceo of the chp
uh the data you see here is actually
from a couple attempts
at launching the nerf darts last year so
this was by u-locks
he gave it a shot spoiler neither of
these worked but it was a good idea
what about sending data so you can do
that using the j7200 send
on a truck duck some hardware
modifications are required and for
details on that
see the see the github as well as the
talk last year
um right and that's not the only tools
we mentioned this earlier
there's non-socket can options such as
truck devil and cancat which are great
tools for putting together your own can
frames or even receiving your own can
frames for 1939
the can matrix tool is great for
converting between different database
formats
it actually has a basic j1939dbc that's
available in it
uh grj2497 developed by chris poor at
ais
it actually does 2497 decoding on sdrs
the pi hv networks library by haystack
and six volts
does j1708 sending as well as g7208
receiving and of course
usb links and dpa4s so first up is the
truck double by hannah
civil silva it actually does decoding
and logging and sending
i works on the machina m2 and there is a
really cool fuzzer that's in development
hannah put together training videos and
these training videos for the truck
devil are also available on our portal
uh ctsrp nmfta org
the cancat which is developed by atlas
uses a custom firmware
for the m2 and it has its own client
which includes j939 support
the uh the cancad is developed much like
a lot of atlas's stuff which is a
interactive python rebel so if you're
into
programming at a ripple this might be
for you
and of course can matrix don't forget
there is a basic j9039 dbc
in the can matrix by edward brooker
2497 receiver by chris port ais
this is freely licensed if you want to
use it it has flowgrass and custom
blocks and
will let you read j2497 traffic if you
have an sdr
pi hv networks um is pretty much the
only way to send j728 and 1587 traffic
using open source software
it works only on the truck duck at this
point anyways
so if you need to send j1708 j587
traffic you're going to want to head to
this
um having open source software and open
source hardware isn't your only option
when you're dealing with trucks you're
going to run into oem diagnostic
software
it's a really good idea to have what are
called vehicle diagnostic adapters
and these are um they let you plug into
the vehicle but they also have a
standardized programming interface
dlls in fact that are specified by rp
1210
so having an rp 1210 vda really lets you
use any of the oem software
the nexa usb link in particular is cheap
and easy to find
there are definitely rip off versions
that you can find on less reputable
sites
we of course recommend you buy the real
one the nexic usb link
original not two not the version two
actually has a dd15 connector
which we highly recommend because
there's a lot of cheap cables and
adapters for db15
as opposed to some of the newer stuff
that move to db25
and other higher density connectors
similar vein
is the dgtech dpa4 also rp1210
compatible
also has a db15 connector which is
really useful
the dpa5 does not have the db15
connector although it's also
a really great adapter the drivers for
both of these dpas include a really
useful data logging feature
they call it debug file when you turn it
on you get a dump of all the traffic
going on all the buses
on the diagnostic adapter
so i hope we covered everything we
wanted to cover
uh in review i hope i convinced you that
commercial transportation is important
to everybody
i showed you that trucks have three main
types of vehicle networks
two of all of these uh two of these
vehicle networks are found on all the
trucks in north america
uh we did a survey of all the public
hacks of trucks by a host of
a bunch of people
there are waste money which is
definitely room for more and i showed
you how you can get involved in a whole
bunch of different ways
so you know virtual transportation is
important
and i hope that this talk has convinced
you
lastly our program the commercial
transportation security and research
program at the nmfta
is always open to collaboration
we fund as well as collaborate directly
on a variety of topics including vehicle
security office
and defense which you saw in this talk
we're also interested in back-end system
security
distribution service center security and
both mainframe and mid
so ibm z and ibm i security
if you are interested in collaborating
on a particular project or idea
please do reach out to us we're always
looking for
great smart people to work with so
thank you very much for your time i'll
be available in discord for questions
and i'll see you around the con bye
you