The document contains details on security measures for automotive Electronic Control Units (ECUs) and their communication protocols via CAN bus, focusing on various data packets and security access methods. Key security techniques and ECU identifiers are discussed, along with examples of data transmission for input and output control. The document emphasizes the importance of protecting sensitive automotive information to prevent malicious attacks.

1.
Dr.
Charlie
Miller
(@0xcharlie)
Chris
Valasek
(@nudehaberdasher)

3.
• Charlie
Miller
[Security
Engineer]
|Twi,er|
• Chris
Valasek
[Director
of
Security
Intelligence]
|
IOAc4ve|

4.
•
• CAN
• CAN
•

6. 1:
•
Bluetooth

7. 1:
( )
•

8. 2:
CAN
ECU
ABS
ECU
ECU
ECU…

9.
•
– :
Bluetooth
•
•
– OEM

10. (ECU)

11.
•
•
•
• ECU
– Linux Windows
ECU

12. ECU

13. PCM

14. PCM
ECU

15. CAN

16. CAN
• CAN
ID 11 29
• 0
8
• CAN
ID
– CAN
ID
00
CAN
ID
01
•
•

17. CAN
•
– ID: 03, ID: B1, : 08, : 80 00 00 00 00
00 00 00
•
– ID: 00, ID: B6, : 04, : 33 A8 00 95
• ID
– 95
*
API

18.
• ABS
ECU
– ID:07, ID: 60, : 08, : 03 14 FF 00 00 00 00 00
ID:07, ID: 68, : 08, : 03 7F 14 78 00 00 00 00
ID:07, ID: 68, : 08, : 03 54 FF 00 00 00 00 00
• ECU ID
– ABS ID 0760
• ID 8 ID
•

20.
• ISO
15765-­‐2
(ISO-­‐TP)
– CAN
• ISO
14229/14230
– ECU
–
–

21. :
SecurityAccess
• SecurityAccess
(ECU )
– IDH: 07, IDL: 26, Len: 08, Data: 02 27 01 00 00 00 00 00
IDH: 07, IDL: 2E, Len: 08, Data: 05 67 01 54 61 B6 00 00
IDH: 07, IDL: 26, Len: 08, Data: 05 27 02 D0 B6 F1 00 00
IDH: 07, IDL: 2E, Len: 08, Data: 02 67 02 00 00 00 00 00
• 0726
(SJB)
– 27
01
=>
• ECU OK
•
• ECU OK
– 67
02
=>
02

22. :
InputOuputControl
• ECU
(i.e.
do
stuff)
– IDH: 07, IDL: E0, Len: 08, Data: 06 2F 03 07 03 00 00 00
IDH: 07, IDL: E8, Len: 08, Data: 06 6F 03 07 03 36 90 00
• 07E0
inputOutputControl
– 2F
=>
ISO-­‐14229 inputOutputControl
– 03
07
=>
– 03
00
00
=>

23.
• ECUReset
• ReadMemoryByAddress
• RoueneControl
• RequestDownload
• RequestUpload
• TransferData
• TesterPresent
• WriteMemoryByAddress

24.
• CAN
• CAN
•
•

26.
• CAN
–
•
vs.
– ECU
•
–

27. :
•
• CAN
ID:
0201
• :
08
• :
AA
BB
00
00
CC
DD
00
00
•
=>
0.0065
*
(CC
DD)
–
67
• RPM
=>
0.25
*
(AA
BB)
–
24
•
(20.1mph
|
2233
rpm):
ID:02, ID:01, :08, : 23 45 00 00 34 56 00 00

28. :
II

29. *

30. :
II

31. :
II

32. :
II

33. CAN

34. SecurityAccess
• ECU SecurityAccess
• ECU
• ECU

35. SecurityAccess:
• PAM
• IDH: 07, IDL: 36, Len: 08, Data: 02 27 01 00 00 00 00 00
• IDH: 07, IDL: 3E, Len: 08, Data: 05 67 01 11 22 33 00 00
• IDH: 07, IDL: 36, Len: 08, Data: 05 27 02 CB BF 91 00 00
• IDH: 07, IDL: 3E, Len: 08, Data: 02 67 02 00 00 00 00 00
• ECU

37.
secret_keys = {
0x727: "50 C8 6A 49 F1",
0x733: "AA BB CC DD EE",
0x736: "08 30 61 55 AA",
0x737: "52 6F 77 61 6E",
0x760: "5B 41 74 65 7D",
0x765: "96 A2 3B 83 9B",
0x7a6: "50 C8 6A 49 F1",
0x7e0: "08 30 61 A4 C5",}
secret_keys2 = {
0x7e0: "44 49 4F 44 45",
0x737: "5A 89 E4 41 72”}

38.
• securityAccess
DeviceControl
ECU

39. :

40. :

41. :

42. :

43. :

44. / :

45. :

46. :

48.
BDM Freescale
USB
S08/HCS12
BDM
/

49.
Motorola
HCS12X

52.
•
•
• CAN ECU
• /

53.
-­‐
John
Hanson
|
Toyota
Motor
Sales
U.S.A

54.
•
–
– PC
– PC
–
– ECU
–

55. /
•
–
– :
–
• ECU
– ECU
–

56.
• 悪意ある攻撃から車両を保護するのに業界が成功している
理由の１つは、各メーカーがセキュリティ上重要な情報の保
護に成功しているからである CEO
Mitch
Bainwol Mike
Stanton
•

57.
• ECU CAN
–
• :
•
–
–
– CAN

58.
•
•
• IDS/
IPS

59.
•
• CAN
•
•

60. CAN
• 15 CAN
• 1 CAN
ID
• 1 CAN
ID
• CAN
ID

61. CAN
• ID
•
Hit
Counts:
Primary[03A9]
=>
9
|
Secondary[03A9]
=>
5
Hit
Counts:
Primary[0255]
=>
166
|
Secondary[0255]
=>
119
Hit
Counts:
Primary[0230]
=>
991
|
Secondary[0230]
=>
1011
Hit
Counts:
Primary[0250]
=>
168
|
Secondary[0250]
=>
209
Hit
Counts:
Primary[03C4]
=>
41
|
Secondary[03C4]
=>
46
Hit
Counts:
Primary[0340]
=>
80
|
Secondary[0340]
=>
82
Hit
Counts:
Primary[0422]
=>
83
|
Secondary[0422]
=>
36
Hit
Counts:
Primary[0423]
=>
17
|
Secondary[0423]
=>
6
Hit
Counts:
Primary[0420]
=>
83
|
Secondary[0420]
=>
47
Hit
Counts:
Primary[0200]
=>
496
|
Secondary[0200]
=>
630

62. :
•
–
• :
( )
• 1
( 20 )
0
10
20
30
40
50
60
70
80
90
100
Frequency distribution of 0201 CAN id

63. :
•
–
( )
•
• “Experimental
Security
Analysis
of
a
Modern
Automobile”

64.
•
• CAN
( CAN CAN )
•
•

65.
• CAN IPS
ECU
• ECU
• OBD-­‐II

67.
•
• CAN
• CAN
•
•
•

68.
• Dr.
Charlie
Miller
(@0xcharlie)
– Twimer
Guy
– cmiller@openrce.org
• Chris
Valasek
(@nudehaberdasher)
– Director
of
Security
Intelligence
@
IOAceve
– cvalasek@gmail.com