Welcome to Logos Red, I go bylogos and:
Want to start hacking cars?
In this post, we’ll simplify the CAN bus system and understand the basics so that you can (get it?) have a solid foundation. I will make it as intuitive as I can with as many analogies as possible.
This knowledge will prepare you for my guides on:
Use this guide as a reference to start your journey into car hacking, as we will now dive into the CAN bus.
Disclaimer: Car hacking can have serious legal and ethical implications. Always ensure you have permission to work on any vehicle and use your skills responsibly.
My Promise
This post will finally end your meaningless search for a valid answer, and you will leave with understanding the CAN bus.
If there are still any questions left, let me know so I can add it to help the next person who will arrive here.
My Goal
To help you improve in less time than it took me and to make sure you leave with what I promised.
I want you to join our community and for this to be a place that you revisit often.
What is the CAN bus?
I want you to imagine the human nervous system.
That’s it.
The body has a nervous system. It connects hands, feet, eyes, and ears all together under one network.
Similarly, a car has a “CAN bus”. It connects all the electronic components together (airbag control, climate control, infotainment system, etc.) under one network.
- The nervous system connects body parts.
- The CAN bus connects ECUs, also known as “nodes”. (a modern car can have more than 100 ECUs.) I will explain them in a moment.
You’re already 90% of the way done with the CAN bus.
I’m joking, but that is the larger picture that I want you to understand. The CAN is an interconnected network, like a nervous system.
This system was released by Bosch in 1986 and is widely used in the automotive world, your car likely has one. But this network protocol can be found in motorcycles, airplanes, ships, robots.
Airplanes?
Yes. You can hack an airplane.
What is an ECU?
ECUs are small computers. They control and track a vehicle’s functions, like the brakes, acceleration, steering, etc.
Simplified, they contain the following:
- Microcontroller: This is the ECU’s “brain.” It decides what to do with the information it gets from sensors and what messages to send out. For example, it can track the vehicle’s speed and adjust the fuel injection rate.
- CAN Controller: This part makes sure all the data sent and received follows the CAN system’s rules. It checks to make sure the data is formatted in the right way, handles errors, etc.
- CAN Transceiver: This acts as a translator between the CAN controller and the actual wires in the car (the CAN bus). It changes digital data into signals that can travel over the wires and vice versa.
This is important. We’ll use those exact parts to integrate our own little ECU to hijack the network. You’ll understand why and how later.
How is the data transmitted?
Human Body Analogy
If we want to send a message to somebody, we could pinch them for a yes and do nothing for a no. We could turn that into a message sent over binary.
That is the same way digital data is transmitted: for example you send 10V for a yes (called a 1) and do not send anything for a no (called a 0).
CAN Bus
The CAN bus also sends 1s and 0s but with a twist:
There are two wires called CAN High (CAN_H) and CAN Low (CAN_L). You might wonder why two wires are needed instead of one.
The CAN system could technically use a single wire, but in a car, there is a lot of magnetic and physical interference that can corrupt the data.
For instance, if a single-wire CAN bus runs behind speakers, magnetic interference could raise the voltage from 0V to 5V. This would change a bit from 0 to 1 and cause errors.
To mitigate this, the automotive world uses ‘Differential Signaling,’ which is where the two-wire concept comes from. The key idea is to use the voltage difference between the two wires to determine the bits.
Here’s how it works:
- A 2V difference means a logic 0 (Dominant State).
- A 0V difference (or close to it) means a logic 1 (Recessive State). Confusing. I understand
To determine if the bit is a 1 or a 0, we look at the voltage difference between them.
- When CAN_H is at 3.5V and CAN_L is at 1.5V:
- 3.5V − 1.5V= 2V This represents a logic 0 (Dominant State).
- When both CAN_H and CAN_L are at approximately 2.5V.
- 2.5V − 2.5V = 0V This represents a logic 1 (Recessive State).
0 means 1. Confusing. I understand.
So now, if we have the same magnetic interference, it will raise the voltage on both of the wires instead of one. Let’s see how that helps:
- Suppose CAN_H is at 3.5V and CAN_L is at 1.5V:
- 3.5V – 1.5V = 2V, which is a 0
- But let’s say the magnetic disturbance raises the voltage by 1.5V: Can High is now at 5V and CAN Low is at 3V.
- 5V – 3V = 2V, which is still a 0, so there is no effect.
See how that helps?
IMPORTANT NOTICE: MESSAGES ARE BROADCASTED
What does that mean?
For example, if the tire pressure sensor sends data, every ECU receives that data. Think of it as somebody shouting in a house; everybody hears it.
That is why we are able to hack the CAN network; what we’ll be doing is hijacking the network to listen and shout our own messages. Want to steer a car off the highway? Shout a message telling the steering wheel to turn.
Granted, don’t do that. But imagine the most James Bond-like ways of hijacking the CAN network, and it might be possible.
Yes You can steer a car off the highway through the tire pressure monitoring system.
No It is not as simple as you’d think, there are security implementations nowadays.
Structure of a CAN Message
Now that we know how the binary data is sent, this is the structure for the message. You have to understand that this is a network, so we’re sending data packets.
If you’re familiar with basic networking protocols such as UDP and TCP, this isn’t any different. If you aren’t, you can understand just as well.
- SOF (Start of Frame): This is the signal that marks the beginning of a CAN message. It tells all the devices on the network that a new message is starting.
- ID (Identifier): The ID in a CAN message is like a label that tells what the message is about, such as “engine speed” or “temperature.” The lower the ID, the more priority it has on the CAN bus.
- RTR (Remote Transmission Request): This bit shows if the message carries data (0) or requests it from another ECU (1).
- Control:
- IDE (Identifier Extension Bit): Indicates whether the ID is standard (11 bits, dominant ‘0’) or extended (29 bits, recessive ‘1’).
- DLC (Data Length Code): Specifies how many bytes of data are being sent, ranging from 0 to 8 bytes.
- Data: This part contains the actual data being transmitted. This is where the information, such as the car RPM or speed, is held.
- CRC (Cyclic Redundancy Check): A method used to check the data for errors. It helps ensure that the data is received correctly and hasn’t been corrupted.
- ACK (Acknowledgment): It’s a small data slot for devices to confirm they received a message. If a device finds an error, it won’t confirm. This signals to the sender that something went wrong.
- EOF (End of Frame): This marks the end of the message. It tells the devices on the network that the message has been fully transmitted.
What we are interested in as hackers is the ID and the data; everything else isn’t that important.
Explaining “Control”
I do want to come back to “Control” and explain what IDE is. The CAN protocol has changed over the years; as cars became more complex, we needed more IDs, so we did just that.
We have Standard CAN (2.0 A) and Extended CAN (2.0 B)
- Standard CAN has an 11-bit ID, which gives us 2048 unique identifiers.
- Extended CAN has a 29-bit ID, which gives us over 500 million identifiers.
If the IDE bit is 0 we use Standard CAN else we use Extended CAN.
CAN FD
To make things more complicated we also have CAN FD (Flexible Data) which is an advancement of the Standard CAN. If your car was released before 2018 you’ll most likely see Standard CAN but I want you to know that it does exist.
These are the main differences but CAN FD is more complex than this
- Increased length: CAN FD supports up to 64 data bytes per data frame vs. 8 data bytes for Classical CAN.
- Increased speed: CAN FD can achieve up to 5 Mbit/s while Standard CAN is limited to 1 Mbit/s
Additional Points:
- Flexible Data Rate: CAN FD introduces a flexible data rate, allowing for different bit rates.
- Backward Compatibility: CAN FD is designed to be backward compatible with Classical CAN.
Clock Timing is ASYNCHRONOUS
What does that mean?
Imagine two people talking, but neither lets the other speak. They end up talking over each other, one fast and the other slow.
Nobody would understand anything.
The sole reason we have communication is because we have a predefined time when we talk and don’t talk. It’s the same for digital data; each ECU and even your own laptop that will communicate will have to agree on a “baud rate” before talking.
“Baud rate” simply means bits per second, so a speed of 9600 baud is 9600 bits per second. Both devices agree on a predefined rate of talk so they can understand each other.
Keep this in mind as we will use this later.
Security measures
CAN wasn’t designed with security in mind, if you couldn’t tell. Nobody realized the technological advancements that would take place over the years.
If you have an older car, it likely doesn’t have many security measures put in place.
The one you are most likely to face is having a gateway between your OBD2 port and the CAN network.
What is a gateway?
You can think of it as a bouncer in a nightclub: it lets some people in and keeps others out. It filters who can access the CAN network.
Some systems use encryption. That codes messages to prevent unauthorized access. However, encryption takes time. You wouldn’t want your car to stop accelerating because it’s busy decrypting messages.
Other security measures do exist. They include intrusion detection systems (IDS) that monitor for suspicious activity. Also, secure boot processes ensure only trusted software runs on the car’s ECUs. All these measures work together to protect the CAN bus.
Conclusion
Now you know the basics of the CAN bus and how it’s basically a car’s nervous system. You’ve learned about ECUs, how data is transmitted, and the security measures in place. With this knowledge, you’re ready to dive into car hacking. Next, we will build a virtual car hacking environment and a real-life wireless car hacking tool. I’m excited for you to go on this journey with me, and I thank you for reading.
More Resources
If you didn’t understand something or you need some help, we have our own Discord community and I currently offer free coaching.
You can also leave us some feedback with what you did not understand and we will make sure to correct it.
