book

The Car Hacker's Handbook

Name: The Car Hacker's Handbook
Author: Craig Smith
ISBN: 9781593277031

by Craig Smith

February 2016

Intermediate to advanced

304 pages

7h 40m

English

No Starch Press

Read now

Unlock full access

Cover Page
Praise for "The Car Hacker's Handbook"
Title Page
Copyright Page
About the Author
About the Contributing Author
About the Technical Reviewer
Brief Contents
Contents in Detail
Foreword by Chris Evans

Acknowledgments
Introduction
Why Car Hacking Is Good for All of UsWhat’s in This Book
Chapter 1: Understanding Threat Models
Finding Attack SurfacesThreat ModelingLevel 0: Bird’s-Eye ViewLevel 1: ReceiversLevel 2: Receiver BreakdownThreat IdentificationLevel 0: Bird’s-Eye ViewLevel 1: ReceiversLevel 2: Receiver BreakdownThreat Rating SystemsThe DREAD Rating SystemCVSS: An Alternative to DREADWorking with Threat Model ResultsSummary
Chapter 2: Bus Protocols
The CAN BusThe OBD-II ConnectorFinding CAN ConnectionsCAN Bus Packet LayoutThe ISO-TP ProtocolThe CANopen ProtocolThe GMLAN BusThe SAE J1850 ProtocolThe PWM ProtocolThe VPW ProtocolThe Keyword Protocol and ISO 9141-2The Local Interconnect Network ProtocolThe MOST ProtocolMOST Network LayersMOST Control BlocksHacking MOSTThe FlexRay BusHardwareNetwork TopologyImplementationFlexRay CyclesPacket LayoutSniffing a FlexRay NetworkAutomotive EthernetOBD-II Connector Pinout MapsThe OBD-III StandardSummary
Chapter 3: Vehicle Communication with SocketCAN
Setting Up can-utils to Connect to CAN DevicesInstalling can-utilsConfiguring Built-In ChipsetsConfiguring Serial CAN DevicesSetting Up a Virtual CAN NetworkThe CAN Utilities SuiteInstalling Additional Kernel ModulesThe can-isotp.ko ModuleCoding SocketCAN ApplicationsConnecting to the CAN SocketSetting Up the CAN FrameThe Procfs InterfaceThe Socketcand DaemonKayakSummary
Chapter 4: Diagnostics and Logging
Diagnostic Trouble CodesDTC FormatReading DTCs with Scan ToolsErasing DTCsUnified Diagnostic ServicesSending Data with ISO-TP and CANUnderstanding Modes and PIDsBrute-Forcing Diagnostic ModesKeeping a Vehicle in a Diagnostic StateEvent Data Recorder LoggingReading Data from the EDRThe SAE J1698 StandardOther Data Retrieval PracticesAutomated Crash Notification SystemsMalicious IntentSummary
Chapter 5: Reverse Engineering the CAN Bus
Locating the CAN BusReversing CAN Bus Communications with can-utils and WiresharkUsing WiresharkUsing candumpGrouping Streamed Data from the CAN BusUsing Record and PlaybackCreative Packet AnalysisGetting the Tachometer ReadingCreating Background Noise with the Instrument Cluster SimulatorSetting Up the ICSimReading CAN Bus Traffic on the ICSimChanging the Difficulty of ICSimReversing the CAN Bus with OpenXCTranslating CAN Bus MessagesWriting to the CAN BusHacking OpenXCFuzzing the CAN BusTroubleshooting When Things Go WrongSummary
Chapter 6: ECU Hacking
Front Door AttacksJ2534: The Standardized Vehicle Communication APIUsing J2534 ToolsKWP2000 and Other Earlier ProtocolsCapitalizing on Front Door Approaches: Seed-Key AlgorithmsBackdoor AttacksExploitsReversing Automotive FirmwareSelf-Diagnostic SystemLibrary ProceduresComparing Bytes to Identify ParametersIdentifying ROM Data with WinOLSCode AnalysisA Plain Disassembler at WorkInteractive DisassemblersSummary
Chapter 7: Building and Using ECU Test Benches
The Basic ECU Test BenchFinding an ECUDissecting the ECU WiringWiring Things UpBuilding a More Advanced Test BenchSimulating Sensor SignalsHall Effect SensorsSimulating Vehicle SpeedSummary
Chapter 8: Attacking ECUS and Other Embedded Systems
Analyzing Circuit BoardsIdentifying Model NumbersDissecting and Identifying a ChipDebugging Hardware with JTAG and Serial Wire DebugJTAGSerial Wire DebugThe Advanced User DebuggerNexusSide-Channel Analysis with the ChipWhispererInstalling the SoftwarePrepping the Victim BoardBrute-Forcing Secure Boot Loaders in Power-Analysis AttacksPrepping Your Test with AVRDUDESSSetting Up the ChipWhisperer for Serial CommunicationsSetting a Custom PasswordResetting the AVRSetting Up the ChipWhisperer ADCMonitoring Power Usage on Password EntryScripting the ChipWhisperer with PythonFault InjectionClock GlitchingSetting a Trigger LinePower GlitchingInvasive Fault InjectionSummary
Chapter 9: In-Vehicle Infotainment Systems
Attack SurfacesAttacking Through the Update SystemIdentifying Your SystemDetermining the Update File TypeModifying the SystemApps and PluginsIdentifying VulnerabilitiesAttacking the IVI HardwareDissecting the IVI Unit’s ConnectionsDisassembling the IVI UnitInfotainment Test BenchesGENIVI Meta-IVIAutomotive Grade LinuxAcquiring an OEM IVI for TestingSummary
Chapter 10: Vehicle-to-Vehicle Communication
Methods of V2V CommunicationThe DSRC ProtocolFeatures and UsesRoadside DSRC SystemsWAVE StandardTracking Vehicles with DSRCSecurity ConcernsPKI-Based Security MeasuresVehicle CertificatesAnonymous CertificatesCertificate ProvisioningUpdating the Certificate Revocation ListMisbehavior ReportsSummary
Chapter 11: Weaponizing CAN Findings
Writing the Exploit in CConverting to Assembly CodeConverting Assembly to ShellcodeRemoving NULLsCreating a Metasploit PayloadDetermining Your Target MakeInteractive ProbingPassive CAN Bus FingerprintingResponsible ExploitationSummary
Chapter 12: Attacking Wireless Systems with SDR
Wireless Systems and SDRSignal ModulationHacking with TPMSEavesdropping with a Radio ReceiverTPMS PacketsActivating a SignalTracking a VehicleEvent TriggeringSending Forged PacketsAttacking Key Fobs and ImmobilizersKey Fob HacksAttacking a PKES SystemImmobilizer CryptographyPhysical Attacks on the Immobilizer SystemFlashback: HotwiringSummary
Chapter 13: Performance Tuning
Performance Tuning Trade-OffsECU TuningChip TuningFlash TuningStand-Alone Engine ManagementSummary
Appendix A: Tools of the Trade
HardwareLower-End CAN DevicesHigher-End CAN DevicesSoftwareWiresharkPyOBD ModuleLinux ToolsCANiBUS ServerKayakSavvyCANO2OO Data LoggerCaring Caribouc0f Fingerprinting ToolUDSim ECU SimulatorOctane CAN Bus SnifferAVRDUDESS GUIRomRaider ECU TunerKomodo CAN Bus SnifferVehicle Spy
Appendix B: Diagnostic Code Modes and PIDs
Modes Above 0x10Useful PIDs
Appendix C: Creating Your Own Open Garage
Filling Out the Character SheetWhen to MeetAffiliations and Private MembershipsDefining Your Meeting SpaceContact InformationInitial Managing OfficersEquipment
Abbreviations
Index
Footnotes

Content preview from The Car Hacker's Handbook

13PERFORMANCE TUNING

by Dave Blundell

Performance tuning, frequently referred to simply as tuning, involves altering an engine’s operating parameters to improve vehicle performance. In today’s vehicles, this usually means modifying an engine computer, even for mechanical modifications.

Performance tuning is necessary for most automotive racing. This huge industry—worth around $19 billion annually worldwide, according to the Performance Racing Industry—draws almost half a million people yearly to compete in auto races in the United States alone. And these figures don’t even include the many modified vehicles that compete in amateur racing around ...

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.

Read now

Unlock full access

More than 5,000 organizations count on O’Reilly

O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.

Julian F.

Head of Cybersecurity

I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.

Addison B.

Field Engineer

I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.

Amir M.

Data Platform Tech Lead

I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.

Mark W.

Embedded Software Engineer

Publisher Resources

ISBN: 9781457198847Errata Page

Cloud Computing

Data Engineering

Data Science

AI & ML

Programming Languages

Software Architecture

IT/Ops

Security

Design

Business

Soft Skills

The Car Hacker's Handbook

by Craig Smith

13PERFORMANCE TUNING

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.