What would Dick Tracy do?: A review of OpenGarages' "Car Hacker's Handbook"

Dick Tracy, the great comic strip detective, is known for having great gadgets like his 2-way radio/computer wristwatch.  Though a wrist mounted walkie-talkie or smartphone is no longer the height of technology and it's easy to think that law enforcement often lags behind, that's not always the case.

As modern day agencies work with their local High Tech Crime Investigators Associations(HTCIA), Dick Tracy has also kept up to date with criminal uses of tech.  In fact in late 1989-early 1990, detective Tracy had a story arc that covered criminals using attacks on HVAC systems, automotive computer systems, logic bombs and a video game to commit data theft/destruction and real life murder. Dick Tracy went to various subject matter experts(SMEs) to become qualified on the new technology law enforcement faced.

In order to solve a difficult case Dick Tracy approaches subject matter experts on car computer systems. 

In the course of the story Dick Tracy sees a bunch of murders that could only have been committed via the use of computerized systems, a hallmark of one of his villains Memory Banks. Poor Memory had passed away and so he was in the clear. Or one would think. It turned out that Memory had a neural network "clone" of himself and had partnered with his sister Data Banks to take revenge on his enemies. They kill off one criminal colleague by setting off the sprinklers with scalding hot water in his apartment, driving him screaming into an elevator shaft.

Walter "Worm" Wendell tried testifying against his employers. They didn't think that was a good idea.

Memory's widow and her new lover are killed when their car unintentionally accelerates and they drive off a cliff.

Memory's wife Diane Dreeg and lawyer/lover Al Lemoni. 

In the end Dick Tracy faces off in a life and death battle with the AI version of Memory Banks. Most law enforcement and others involved in Information Security do not need to go that far to track down high tech criminals. Faced with newer technology like the Internet of Things or Automotive telematics systems, what would Dick Tracy do? If he needed to get up to speed on the embedded systems that run today's late model cars, a good start would be picking up a copy of the Car Hacker's Handbook.

OpenGarages' Car Hacker's Handbook

The Car Hacker's Handbook by Craig Smith is a short(about 70 page) tome. Hacking on cars is sort of like wizardry and OpenGarage's Car Hacker's Handbook is a spellbook; in the right hands it opens doors, in the wrong or untrained hands it simply raises more questions.

While ostensibly the Car Hacker's Handbook is targeted at novices in information security or embedded systems reverse engineering, much could be missed. It can feel sometime more like a conversation with the author than a full reverse engineering manual. I'm not discounting this method of instruction as I've had numerous such conversations with presenters at security conferences and they can be quite enlightening. Those discussions usually count on both parties having a shared knowledge base. A quick primer on software and firmware reverse engineering and network security would help unlock a good number of the nuggets in this slim volume.

Hacking and modifying an Infotainment system
A short chapter in the first third of the book provides nearly all the information one would need to investigate a Microsoft Auto/Windows Embedded(CE 7?) based interface. Having written a few short pamphlets to train others on reverse engineering embedded systems, I can see all the milestones Smith was aiming for, though the end result is still obscured. In a short four pages he passes over the following procedures

• identifying OS, firmware and executable versions
• locating/identifying update mechanism update files
• analyze/bypass simple file checksums
• extracting/analyzing/modifying firmware
• acquiring manufacturer SDKs

Not every step is explained and not every tool is introduced, yet there is enough for the experienced Reverse Engineer to follow in Smith's footsteps.

Where do I catch the CANBus?
The heart of the handbook introduces the reader to the various communication systems within a modern automobile before settling on discussing the CAN Bus. This is the most common bus over which messages travel between the components(e.g ECU, Radio, Tire Pressure Monitor, other sensors) of one's car.

The various interfaces to the ODB II ports(and thence on to the CAN Bus) one would find are detailed with wiring diagrams. From a hobbyist perspective or at least for a researcher with a limited budget, the book's concentration on open source software and hardware is quite appealing. Commercial rigs are eschewed over building one's own Engine Control Unit(ECU) workbench from recovered units in the junkyard.  The book includes links to a good collection of open source CANBus monitoring software

Other researchers, such as Charlie Miller & Chris Valasek[2], have investigated the effects of sending crafted CAN packets to unlock doors, control the speed displayed and turn the wheel. Building off research like theirs, the Car Hacker's Handbook walks through intercepting packets with a sniffer(as with WireShark on the PC). It also provides a nice methodology, utilizing a binary search to locate the packet of interest. The practical example is covered in a chapter targeting the Tire Pressure Monitoring System(TPMS).

The CAN Bus section eventually concludes with a humorous( likely unintentional) troubleshooting list when one performs their experiments. Pro tip: Know where your car's fuses are located.

Hotwiring - No really, like in the movies
While the handbook is not a criminal guide it does contain historical information on security bypass methods. There are short chapters covering "hotwiring" cars and cracking keypad combinations. Admittedly only ever having seen hotwiring on film or TV, this was a most enjoyable and archaic chapter.

As newer security features have obsoleted the technique, Smith covers how researchers can investigate modern security(keyfobs and immobilizers).  The Handbook covers a number of potential attacks on Immobilizers without going over specific implementations of the attacks. The author assumes you know what an SDR is and what software one needs. Like with a Wizard, if you can't figure out the tools and components for a particular spell, you shouldn't be messing with it.

What's all this about "spells"?
There is a short sequence in the book on "weaponizing" exploits, implemented as the creation of a particular Metasploit module. If that last sentence made no sense to you, then the Car Hacker's Handbook will not turn you into a criminal hacker.

Exploits are like spells. Spells can be used for good and bad. They also require a lot of research to create.  The Handbook provides a methodology(or actually a modification) for discovering vulnerabilities in automotive control systems.

The handbook is not yet an all in one resource for auto security nor is it a step by step guide. Eventually it may become so, or even better it will become a comprehensive introduction with links to further resources.

In the end the Car Hacker's Handbook definitely sends one in the right direction to hack on one own's car but it is still not an introduction on exploit development. It really is a Wizard's manual; if one already has the capability to "spellcast"(write exploits) on PCs, the Handbook will fill in a number of holes in your knowledge base.

The content of the book is available electronically for free, though one can purchase a physical copy at:

Amazon.com(paperback)
Barnes & Noble(paperback or ebook)
Google Play(ebook)

What would Dick Tracy Do?
Knowing where to look can sometimes be as useful as what to look for; the Handbook and the related OpenGarages wiki provide that direction. Dick Tracy knew it decades ago; when getting up to speed on a newer field, save time by going to the experts.

---

[1] A friend, Security Researcher Julia Wolf, recounted the ransomware or more specifically the logic bomb aspect of the Dick tracy storyline. Unfortunately her original copies of the comic strips were lost over the years. Tracking down copies of the comic strips was truly an adventure and enlightening on user education techniques from decades previous.

[2] Their research is referenced on the OpenGarages wiki. Miller and Valasek have also presented at the Def Con conference.

Mobile Spyware: Finally criminal?

Commercial Mobile Spyware apps have been around for over a decade. They've been on every platform with the best(if one can call it that) support on the most popular Operating Systems. They're usually sold as tools to help one monitor their children or keep track of a spouse or significant other. Tracking the latter groups lean toward a gray or even a black/illegal area.

The FBI has come along to the idea that folks selling spyware(or at least mobile spyware) are committing a crime. Specifically since your phone is a telecommunications device, installing spyware on it is the same as wiretapping.  Also the CEO of Invocode(producers of StealthGenie spyware) and his employees are members of a "criminal conspiracy responsible for StealthGenie".  Fortunately, the FBI arrested the CEO in Los Angeles over the weekend.

StealthGenie is a spyware app that supports iOS, Android and Blackberry OS. Blackberry support only applies to pre Blackberry 10 devices so newer devices would not be vulnerable. The capabilities of the spyware is not breaking any new ground, we've seen all of this before and in software from their competitors.

StealthGenie's hompage - The World's Most Powerful Mobile Phone Spy Software"

Intriguingly from the Government's complaint, Invocode expected that the majority of their sales of the StealthGenie mobile spyware would be to "[s]pousal cheat: Husband/Wife of boyfriend/girlfriend suspecting their other half of cheating or any other suspicious behaviour or if they just want to monitor them.".  So mainly to monitor someone else's phone without their permission.  The FBI agents purchased a copy of StealthGenie and were able to immediately monitor the calls and text messages from another of their phones.  While investigating monitoring software from competitors of Invocode, I've also seen that they perform similarly or perform additional functions.

Speaking of Invocode's competitors, they don't seem to think highly of StealthGenie:

"...simply isn't worth the money!" - advice from other criminals?

This screenshot above is from a competitor that recommends two other mobile spyware packages in addition to itself that they prefer to StealthGenie. This implies that these are three other, possibly more powerful, mobile spyware and "wiretapping"/interception tools that are still available on the app markets. I applaud the US government going after Invocode in the "first-ever criminal case concerning the advertisement and sale of a mobile device spyware app".

Due to the gray-area uses of mobile spyware, Anti-malware and Anti-Spyware companies have had to come up with classifications to keep us from stepping on possibly legal  developers of spyware. This is mainly to avoid being sued for being anti-competitive or harming the business of legitimate monitoring software developers. It would certainly ease matters now that governments are starting to criminally prosecute producers of tools that can be used to intercept users calls and texts.

--------------

If you're curious about the legality of selling mobile spyware, the US Government cites the following sections of law:

Title 18, United States Code,
Section 2512(l)(b) (sale of an interception device)
Section 2512(l)(c)(i) (advertisement of a known interception device)
Section 2512(l)(c)(ii) (advertising a device as an interception device)

One can read the details themselves in the Federal complaint.

"Mobile Crime Doesn’t Pay–in Japan"

From McAfee Blog:

Writing Android malware can be a lucrative business for a criminal. One can create an SMS-sending Trojan horse or a botnet client and sit back to collect the money. It can also be a very brief business, leading one directly to jail. The crooks behind Android/OneClickFraud (malware that extorts users) and Android/DougaLeaker (malware that steals and forwards user data to the attacker) recently ran afoul of Japanese laws against malware and protecting personally identifiable information. 

I already paid, why doesn’t this app work?Android/OneClickFraud is a malware that pretends to be an adult entertainment app. Users fooled into downloading it expect that they’ll be able to view adult content but instead they’re presented with a request for payment. They get a pop-up every five minutes that says essentially that their payment has not yet been received. 

 [...] 

A positive signIt’s good to know that the authorities are going after the villains behind mobile malware. The work of Japanese law enforcement in finding and prosecuting the people behind these mobile threats is commendable. Although this is a good start, it’s unlikely that we’ll see all mobile malware disappear. We still see a majority of new malware coming from unregulated third-party app markets and from servers offering drive-by downloads of malware. As long as criminals can make a profit from mobile botnets and malware that can buy apps without user permission, it may be some time before we see a slowdown in such attacks.