Hack.lu 2017 The Bicho: An Advanced Car Backdoor Maker by Sheila Ayelen Berta and Claudio Caracciolo

Sheila Ayelen Berta and Claudio Caracciolo present a hardware backdoor for the CAN bus that can attack connected cars based on telemetry.

The Bicho: An Advanced Car Backdoor Maker by Sheila Ayelen Berta and Claudio Caracciolo Attacks targeting connected cars have already been presented in several conferences, as well as different tools to spy on CAN buses. However, there have been only a few attempts to create something similar to a useful backdoor for the CAN bus. Moreover, some of those proofs of concept were built upon Bluetooth technology, limiting the attack range and therefore tampering its effects. Those things are old! Throughout our research we have successfully developed a hardware backdoor for the CAN bus, called “The Bicho”. Its powerful capabilities render it a very smart backdoor. Have you ever imagined the possibility of your car being automatically attacked based on its GPS coordinates, its current speed or any other set of parameters? The Bicho makes it all possible. All the “magic” is in the assembler-coded firmware we developed for a PIC18F2685 microcontroller. Additionally our hardware backdoor has an intuitive graphical interface, called “Car Backdoor Maker”, which is open-sourced and allows payload customization. The Bicho supports multiple attack payloads and it can be used against any vehicle that supports CAN, without limitations regarding manufacturer or model. Each one of the payloads is associated to a command that can be delivered via SMS, allowing remote execution from any geographical point. Furthermore, as an advanced feature, the attack payload can be configured to be automatically executed once the victim’s vehicle is proximate to a given GPS location. The execution can also be triggered by detecting the transmission of a particular CAN frame, which can be associated with the speed of the vehicle, its fuel level, and some other factors, providing the means to design highly sophisticated attacks and execute them remotely. Bio: Sheila Ayelen Berta - @UnaPibaGeek Sheila A. Berta is an Information Security Specialist and Developer, who has begun at 12 years old by herself. At the age of 15, she wrote hers first book about Web Hacking, published by RedUSERS Editorial at different countries. Over the years, Sheila has discovered several vulnerabilities in popular web applications such as Facebook, LinkedIN, Hotmail, ImageShack and others. Actually, Sheila works at Eleven Paths as Security Researcher which is specialized in web application security, malware analysis and exploit writing. She is also a developer in ASM x86, AutoIT, C/C++, Python and the most popular web application technologies. Additionally, Sheila is Security Researcher at UdeMM University, where she works leading projects about technology and cybersecurity. Sheila is an International Speaker, who has spoken about different researches at important security conferences such as Black Hat USA 2017 & EU 2016 Arsenal, DefCon 25 CHV, Ekoparty Security Conference, OWASP Latam Tour, APPSEC Latam, DragonJARCon and others. Bio: Claudio Caracciolo - @holesec Actual Chief Security Ambassad