CANToolz: mod_stat features

Playing with some dumps of CAN traffic I am trying to implement notsmart traffic-detection features in CANToolz.  Main problem - when you see a lot of CAN frames you can't easily find some interesting data and commands. For that purpose I am trying to improve mod_stat module.

My friend from Moscow (@Saplt)  is  preparing before next HardwareVillage  event  where we have small section dedicated to automotive security ( btw it will happen on May 17-16 in Moscow during PHDays conference). So he have sent me some raw CAN traffic from his vehicle,  (mod_stat can save all frames in some ASCII format and now I can replay this traffic by mod_replay here in Berlin). 

Improvements in 1.2-1

First of all I want to improve ASCII detection. Of course ASCII is not common data format, but for VIN text detection and some other things that are in ASCII this feature could work. I have added ASCII detection before generating output, so now this output should looks better...

Also I have found that some frames have "fragmented" structure (because CAN frames are limited to 8 bytes, and that's why vendors trying to use one of these bytes as control/index byte, so you can transfer more data in one "message" by using few CAN frames). Popular format is ISO-TP so mod_stat can "re-assemble" CAN Frames into ISO-TP messages (if they have been found). ISO-TP used also for UDS, and I have added  detection of UDS services. 

But  ISO-TP is not the only one format. I have found some other  formats with "index" byte in CAN data field. Maybe it is also standardized format, but I do not know, so I tried to build common detection of "index"  and data de-fragmentation by using found "index".  This feature works only for CAN Frames that repeating these frames in the loop.

Detected chain:

Here we can see non ISO-TP message, which was re-built.  I think we can play more with some "smart" analysis of CAN traffic, it is just very first tries... Also, if format is not so easy and "loop-detection" mechanism of mod_stat can't find logic then we can manually setup "index" pointer, "index" size and  value. After that mod_stat will try to re-built chain. 

As an additional feature I  have added COMMENTs, so we can do comments for frames by arbitration ID:

This should help with  marking frames while reverse engineering. Both: comments and manual "index" pointers can be exported/imported via META file. So if you want to share traffic with your colleague, you also can share this meta-data. For me it is important feature, because @Saplt in Moscow and I am in Berlin, but we can share  data and work together! Also I believe that both: meta-section and traffic detection algorithms can be improved a lot, current version is just a prototype, but I like it and want to share...

P.S.
Other fixes:
   - mod_stat print format changed. Now it is really formatted...
   - bugs in UDS detection during scanning
   - now mod_stat have ALL traffic, not only statistics. This is good and bad... good because of real traffic capture available, bad because of MEMORY.. Will think how to improve this.
   - fixed bug where WEB interface does not work without the Internet (dammed d3...)

Yet Another Car Hacking Tool

Few days ago I had a small talk (on our local Defcon group meeting - DC#7812) regarding CAN (Controller Area Network) and ECU analysis with help of CANToolz  framework. Therefore, here I would like to repeat some of the ideas from that talk, give some explanations about "Why I have created Yet Another CAN Hacking Tool" and what are my goals.

Here you can find original slides - 

http://www.slideshare.net/AlexeySintsov/testing-can-network-with-help-of-cantoolz

Intro

  Automotive Security is an extremely hot-topic now, and that is why I am interested in this field and very lucky to be a part of this automotive industry. Actually, this topic is HUGE: many of the technologies, big attack surface and blah blah blah….

However, security of vehicle's local network has been the main topic for last few years. Yes, I am talking about CAN bus and this is a good moment to remind an awesome research done by Charlie Miller and Chris Valasek: http://illmatics.com/car_hacking.pdf. I am not going to talk about CAN security in general since this is well-known thing (but highly important!). 

When I have started my own “actions in this field”, I met one big issue - lack of tools that can help me to do what I want. Actually, in the Internet you can find many different tools for working with CAN bus. These tools are quite good and helpful, but if you want to use them "together", perform a MitM or make something more, then you have to "customize" them. It is good if you have one car... but what is if you have more targets to test?

Finally, I came into a conclusion that I need to have one common framework where I can work with CAN bus and ECU devices together with minimum "code-writings". If you are familiar with such kind of tools like BurpSuite or MetaSploit then you will understand my words. I wanted such kind of tool as it is going to make my work easier in case if I will share results with someone else or work in a team. Thus, my aim was to have module-based framework that can perform MitM (or work with more than one bus), will be hardware independent and have one-standard interface and even GUI. One more important thing I wanted to have is an open-source project – when all people together will have access to more vehicles than bunch of researchers. I think, together we can create more useful modules that can be used by testers, vendors (in an ideal world) and enthusiasts all over the world. 

Head Unit as a target for hackers

Head Unit as a target for hackers.

In recent years the problem of car hacking is raised more and more frequently. It concerns almost everyone: car manufacturers, OEM and information security specialists. Of course,  EU and  USA authorities are also interested in it and fund research in this field. As in information security industry some activities are just attempts to scare and some problems are deliberately overestimated, I would like to look into this subject without unnecessary emotions but keeping in mind that it's always best to err on the side of caution. In my own professional realm I deal with ConnectedCar system security and embedded solutions for vehicle systems. So I would like to talk about new threats in IoT and cars in the near future. This part is about potential attack vectors on Head Unit and its environment.

Zeronights 2014 CFP. Статистика работы Defcon-Russia группы.

Zeronights 2014 CFP. Статистика работы Defcon-Russia группы
Лучше поздно, чем никогда! Думаю, этот девиз не вполне подходит, но, тем не менее...
У меня была подготовлена статистика по работе нашей CFP-комиссии, и по докладам прошлого ZeroNights. Никто ей особо не заинтересовался, но раз она у меня есть, я ей поделюсь.

Итак, в прошлом году состоялась  4-ая ZeroNights. Немного бесполезной статистики, но, тем не менее, забавной, + кое-что о том, какие «злобные» люди сидят в комиссии от Defcon Russia.

SSRF vs AWS Security

Hello everyone...

Just want to mention one attack-vector that is useful against AWS EC2 instances in some configurations. It is not rocket-science, but pretty fun and tell us about AWS Cloud security things and maybe can help us to do hardening. Actually I am talking about boring-sold SSRF vector. So if an attacker can do SSRF in our EC2 with SSRF what he can do?

Sometimes developers like to assign IAM Roles to instances. For example if it is deploy/build server, that needs to create new apps in AWS account or something else, doesn't matter - this just happens 8) And assigning roles to EC2 instances  - easiest way you can do it, because you do not need to think about how to deliver  Access Keys to the instance, how to rotate them and etc. Now back to SSRF...

So we have classic vulnerable App with boring XXE:

And...

PHDays III

Дошли и мои руки, наконец-то, до разбора данного события. Я уже не торт и много печатать не буду, но все же поделюсь впечатлениями.

Stage 0.

Летел я из Берлина, что забавно с рюкзаком PHDays 2012, и что еще более забавно в самолете оказались еще парни, которые так же выдвигались на данный ивент - Йохан, Даниель (создатели SCADA and Computer Security Group - SCADACS)  и Джефф Кац aka aestetix. То есть нас всех засадили в один самолет - это мило. И сидели мы относительно рядом 8) И что примечательно, обратно мы тож летели вместе. Так вот я и познакомился с этими милыми мужиками. 

Интересный случай с SSRF.

В последнее время в Интернетах и в узком кругу ИБ специалистов активно обсуждаются концепты, примеры и техники проведения  “новой” атаки - SSRF. Хотелось бы рассказать об одной такой атаке. Данный случай интересен и тем, что его трудно классифицировать по существующим меркам “угроза-уязвимость”. То есть, есть конкретная атака и есть реализация конкретной угрозы, но если разбирать “уязвимости” отдельно, то угрозы - другие. И этот пример, на мой скромный взгляд, показывает, что “теория ИБ” и классификация в нашей теме - сильно отстает от практики и не всегда применима в том виде, что она есть сейчас.

“Взломай меня полностью”