The security level for adopting that threat model will be directly proportional on how hard it is to get physical access to the CAN bus, and/or how difficult it is to exploit vulnerabilities on external connections to pivot into the CAN bus. The gateways provide logical separation by forwarding CAN messages in one way direction only. Gateways are common when CAN and external networks do need to be connected (e.g.

The separation can be physical (air gaps) or logical (CAN gateways/firewalls). In general, car manufacturers adopt a threat model based on reducing the attack surface on the vehicle by creating a separation between the CAN bus and external networks.

I plan to also extend the AWS service with POST endpoints which will allow CAN commands to be submitted to the vehicle by creating a reverse HTTP session via cellular network. The GUI with live data will also display current vehicle information (speed, RPM, etc) from the decoded CAN messages. Part 3 - Vehicle RCE: I plan to extend the ChupaCarBrah application to display all data being exfiltrated on the fly in a more user friendly format such as GPS data plotted on a map. For safety reasons I plan to cover only harmless commands, such as unlock doors, open power windows, etc I will focus on reverse engineering the CAN messages to send crafted commands to the ECU. Part 2 - ECU CAN messages: Will show how to tamper CAN buses that connect directly to an ECU (since the OBDII usually provides only diagnosis data). In your terminal window (you do still have that open, right?!), type '0100' and hit 'enter'.As a follow-up to this write-up, I plan to publish two more articles to extend the current ChupaCarBrah capability:

This works on any vehicle that supports OBD and gives a list of other PIDs which the car supports. Again, the is another good resource to check out.Possibly the most important PID is 00.

Some vehicle manufacturers also use their own proprietary parameters, so keep in mind that these may not be a comprehensive list for your car. You will want to check your particular vehicle's protocols to see what OBD modes and parameter IDs are supported.Mode NumberMode Description01Current Data02Freeze Frame Data03Diagnostic Trouble Codes04Clear Trouble Code05Test Results/Oxygen Sensors06Test Results/Non-Continuous Testing07Show Pending Trouble Codes08Special Control Mode09Request Vehicle Information0ARequest Permanent Trouble CodesYou can read up more on the OBD PIDs functionality on. There are 10 OBD modes, but keep in mind that not all vehicles will use all 10 modes.

Obd2 terminal commands