Top all-time · #4204
Ken Tindell
Personal blog · kentindell.github.iosystemshardwaresecurity
Ken Tindell's personal blog at kentindell.github.io covers systems, hardware and security. Since 2020, 18 different Hacker News readers have linked it 20 times, most often “Can Injection: keyless car theft (2023)”. The last post was in 2023, but the archive is still widely read.
Dr. Ken Tindell is the CTO of Canis Automotive Labs and this is his blog site, focusing on CAN bus and CAN security.
Most-linked posts?
- Can Injection: keyless car theft (2023)12 people · 13 mentions · first linked 2023-04-05
- Raspberry Pi Pico Priority Inversion2 people · 2 mentions · first linked 2022-01-17
- Priority inversion in the automotive CAN protocol2 people · 2 mentions · first linked 2020-06-30
What Hacker News says?
Start by not allowing thieves connect thru wheel well https://kentindell.github.io/2023/04/03/can-injection/
Comment linking /2023/04/03/can-injection/
on “Insecure vehicles should be banned, not security tools like the Flipper Zero”Submitted Can Injection: keyless car theft (2023) as a story · 71 points
HN discussionInfinite Infinity car hack, came with two, left with three Q50s. They do crouch an awful lot near front wheel well. Reminds me of this Toyota hack where thieves plug into headlight canbus wiring thru wheel arch https://kentindell.github.io/2023/04/03/can-injection/
Comment linking /2023/04/03/can-injection/
on “Insecure vehicles should be banned, not security tools like the Flipper Zero”Submitted A CAN protocol decoder for Sigrok as a story · 4 points
HN discussionThe threat is not exactly zero. In some cases, thieves can get physical access to the bus from outside the car, and then inject messages to unlock it, start the engine, and drive away: https://kentindell.github.io/2023/04/03/can-injection/ Sure someone in that situation could also "just cut brakes or put in a pipe bomb" but car theft is a lot more common than assassination, at least where I live.
Comment linking /2023/04/03/can-injection/
on “Car companies are in a billion-dollar software war”Submitted Teardown: Keyless car theft tool hidden inside a JBL Bluetooth speaker case as a story · 3 points
HN discussionquite the opposite: CAN Injection: keyless car theft https://kentindell.github.io/2023/04/03/can-injection/
Comment linking /2023/04/03/can-injection/
on “So you think you understand IP fragmentation?”Submitted Priority inversion in the automotive CAN protocol as a story · 3 points
HN discussionBe careful messing with your (modern) car like this. It may work at first glance. In some time in the future you may not be able to unlock your car. As mentioned in the article as part of the introduction, there were problems with those car regarding security. Especially with the Rav4 where a colleague, Ken Tindell, showed a very serious flaw: https://kentindell.github.io/2023/04/03/can-injection/ Because of this OE…
Comment linking /2023/04/03/can-injection/
on “Removing the Modem and GPS from My 2024 RAV4 Hybrid”Submitted Raspberry Pi Pico Priority Inversion as a story · 2 points
HN discussionCAN is a protocol, but the messages on the bus are implementation specific. Yes, you can use it on any CAN bus, but there's no guarantee that you will be able to decode the traffic. Some modern CAN networks are encrypted, too, because it's trivial to view the traffic. https://kentindell.github.io/2021/01/02/can2-wireshark/ has a great guide on decoding traffic with sigrok.
Comment linking /2021/01/02/can2-wireshark/
on “Removing the Modem and GPS from My 2024 RAV4 Hybrid”Submitted Get Your App to Mars as a story · 1 points
HN discussionIn fairness, many of these will end up in consumers hands shortly after a bit of additional value-add. On the bare-bones side, that's things like JLC PCB stocking them for pro-hobbyists to get custom low-volume PCB's made with them. A bit higher up the food chain, mere tinkerers could expect to find more form factors of fully ready-to-use boards available at microcenter/ailexpess/amazon/sparkfun/etc. For mere hobbyi…
Comment linking /2021/03/05/pico-priority-inversion/
on “Raspberry Pi Direct: buy RP2040 in bulk from just $0.70”Submitted Can Injection: keyless car theft as a story · 1 points
HN discussionone example is CAN injection https://kentindell.github.io/2023/04/03/can-injection/ Here they hook into the CAN bus directly from the outside.
Comment linking /2023/04/03/can-injection/
on “Gangs are using increasingly sophisticated kit to steal cars”Submitted Can Priority Inversion as a story · 1 points
HN discussionI'm pretty sure they are all dumb enough for this. This is why people can steal (modern) cars by ripping a headlight out and accessing the CAN bus through the gap. https://kentindell.github.io/2023/04/03/can-injection/ AIUI the military uses "CAN bus firewalls" to prevent this. There is also some sort of encrypted/authenticated CAN bus protocol in the works. Neither are common in production cars as of 2022 or so, th…
Comment linking /2023/04/03/can-injection/
on “Rivian software update bricks infotainment system, fix not obvious”I think hardware hacking is becoming increasingly sophisticated. The way car thieves managed to unlock luxury cars using a custom device built out of a JBL speaker also blew my mind. https://kentindell.github.io/2023/04/03/can-injection/
Comment linking /2023/04/03/can-injection/
on “Kaspersky: Case study: fake hardware cryptowallet (Trezor)”https://kentindell.github.io/2023/04/03/can-injection/ >Ian’s sleuthing found that mostly these cars are destined for export, sent via shipping container to places in Africa "These cars" might specifically mean things like the RAV4 and that other cars more reliant on good roads have less of a market in "places in Africa". There must be a noticible flow of parts (eg headlights) to patch up damage caused by the theft.…
Comment linking /2023/04/03/can-injection/
on “Car Thieves Using Tech Disguised Inside Old Nokia Phones and Bluetooth Speakers”https://archive.ph/wip/KRWzE But the acutal post with technical analysis is https://kentindell.github.io/2023/04/03/can-injection/ Discussed 16 days ago https://news.ycombinator.com/item?id=35452963
Comment linking /2023/04/03/can-injection/
on “Car Thieves Using Tech Disguised Inside Old Nokia Phones and Bluetooth Speakers”
