Refine
Year of publication
- 2019 (3)
Document Type
- conference proceeding (presentation, abstract) (3) (remove)
Language
- English (3)
Has Fulltext
- no (3)
Is part of the Bibliography
- no (3)
Institute
- Labor Informationssicherheit und Complience (ISC) (3) (remove)
IOT Backdoors in Cars
(2019)
Connecting cheap IoT devices to the safety-critical network of a car can be an extremely bad idea, but at least it allows us to hack together our own automotive gadget. This talk explains the complete procedure involved in transforming a cheap OBD GSM dongle designed for fleet management into a open source automotive hacking tool. First, the hardware reverse engineering is demonstrated, showing how each component is interconnected and working together. With this knowledge, it was possible to capture the communication of the GSM module and understand the OTA protocol used by this dongle, which can be used to extract the firmware. A quick reverse engineering of the software will show that no cryptographic authentication is used for the OTA updates, and therefore a pirate GSM BTS can be used to obtain remote code execution. After that, a new open source firmware is written for the device, which can easily be extended and controlled remotely with the LUA scripting language. Examples on how hacking this dongle remotely can affect the safety of the driver will be also given.
SIM SIMulator
(2019)
Der Vortrag präsentierte ein Tool, das die Simulation einer SIM-Karte durch einen Standard-Mikrocontroller ermöglicht. Mit diesem Täuschungsmanöver kann die Authentifizierung des 3G-Mobilfunkstandards seitens der SIM-Karte umgangen werden. Tritt zusätzliche Hardware hinzu, die eine 3G-Basisstation vortäuscht, lässt sich eine Man-in-the-Middle-Attacke im 3G-Netz durchführen.
In diesem Szenario ist es möglich, die sensiblen Kommunikationsdaten, also den gesamten Datenverkehr beispielsweise zwischen einem Pkw und den Backend-Servern des Herstellers, auszulesen und zu untersuchen. Zudem eignet sich das Tool zum Pentesten von Modems oder SIM- beziehungsweise Smartcard-Applikationen. Der komplette Aufbau des sogenannten SIMulators ist als Open-Source-Software frei verfügbar und auf GitHub abrufbar.
This talk will provide a general overview on how Scapy can be used for automotive penetration testing. All present features of Scapy for automotive penetration will be introduced and explained. Also an overview of higher level automotive protocols will be given.
As automotive penetration testing becomes more important, the lack of free tools for automotive network penetration testing led us to integrate new features in Scapy. Scapy is a well established framework for packet manipulation. The flexibility of Scapy allowed us to implement automotive interfaces (CAN) and automotive protocols (ISOTP, GMLAN, UDS, DoIP, OBD-II).
This talk explains the basics of these automotive protocols, the workflow with Scapy for automotive network penetration testing. A live demonstration with some embedded hardware will be given.