The Internet of Things (IoT) is getting noticed within the security community as an area which needs much improvement. Overall, though, IoT devices are just mini versions of desktops and servers. They run Linux or Windows variants and connect via Bluetooth, Wi-Fi and Ethernet. There is one exception: cars.
Automobiles are built using mostly proprietary protocols, technologies and interfaces. Just look down under your steering wheel and you’ll find an ODB-II port. It’s a 16 pin connector to interface with your car.
After spending the past year trying to figure out how to interact with my vehicle, I picked up Craig Smith’s new book The Car Hacker’s Handbook. A Guide for Penetration Testers.
This is the type of book you read while sitting next to your Linux workstation. In fact, I read at least half of it sitting in my car with my laptop in one hand and the book in the other. Most of the tools and examples are for Linux systems. (Note: I’m sure everything will run just fine on OSX but it was much faster to get running in Linux).
As you get more advanced, you can move beyond just an ODB-II connection into additional hardware such as a JTAGulator. Luckily, there is something in everyone’s price range.
The first 60 pages of the book is less about hacking and more teaching the basics of in-car communications. The author does a great job of giving you the right amount of background so you can properly test a car. Even if you’re not interested in hacking your vehicle, it’s a good foundation in understanding the basics of how a car’s network operates.
After the basics, each section of the book tackles a different part of the car. This includes attacking the in-vehicle infotainment system, tapping the Bluetooth connection and how to hotwire a car. The appendix is also really helpful as it walks through the “Tools of the Trade” – all of the software and hardware described in the book.
One of the biggest challenges in car hacking is avoiding messing up your primary mode of transportation. The book helps you explore and potentially modify your car. The author walks through some of the potential issues that can arise such as your vehicle not turning off anymore (it’s apparently rare.) There is a section on ICSim – the Linux instrument cluster simulator – a great way to start understanding a car’s network by using a virtual simulator.
As a tester, the book covers a number of different entry points to the car including using a software defined radio to attack the door locking system. Whether you’re interested in reverse engineering, changing the performance of your car, or just understanding how vehicles work, there is something for everyone.
My main issue with the book was that I already was playing with my car so, at first read, I struggled to stay and finish one chapter. Once I got up to speed on the basics in one area, I wanted to jump to a more advanced topic in that area. I understand car hacking by the tools I use, not the concepts. This book is written based upon concepts.
I have come to recognize this book is more a battlefield manual that you’ll jump around constantly than a book you read cover-to-cover. As much as the author talks about this book as a guide for penetration testers, it reads more like a guide for hackers, specifically the hobbyist hacker who wants to play with their car.
However, if you have your own car and are interested in understanding the ins and outs of its networking and security, this is the reference book to use