How They Steal Your Car with CAN Injection

[@scottjohnson8576]

I’ve used the hidden kill switch on my vehicles and motorbikes since the early 90’s. I’ve had 2 failed attempts and caught a third in progress that I beat down with a bo staff.

[@salimrandall]

Kiyah!

[@OhSoddit]

In Australia, if you tackle a criminal, you'll quite likely be charged with CRIMINAL ASSAULT against the offender. (If you don't get hurt, don't report it, and DON'T GET CAUGHT - well, that's a slightly different matter 😀😀😀)

[@nmhazzard]

😃 Loved the example of the mood sensor resulting in playing your favorite song!

[@MikeTheBackyardMechanic]

Thanks! 😃

[@magellanmax]

That feeling when you find your car stolen or had a home burglary and stuff stolen is the worst....can't even begin to describe it.

[@scna4653]

Amazing video, rare to find any content on CAN bus attacks on KZbin, especially this informative. In general i'm surprised as hell you don't have more subs. A lot of people are making videos on new cars appearing on top 10 most stolen car lists, but no one really attributes it to thieves using CAN bus invading devices. Here, in the UK, a lot of thefts happening with Lexus RX450h (2016-2022) and Toyota Rav4's (as shown in the video) because they are very common, and most importantly the headlight's control unit is right in front of the passenger side wheel arch (might be driver side in the states), as soon as you rip open the plastic fenders and pull away at the front bumper they unplug the headlight and do their thing. Worst part is RX450h/rav4 platform is that its so damn widespread, we're talking in addition to the aforementioned; Highlanders, LX, the Subaru equivalent of the rav4 etc... Funny thing is, apparently Lexus's were beginning to be targeted in Japan because information about where the headlight control unit was located was leaked from a Lexus dealership, and apparently that was the reason why CAN bus attacks got popularised. But yeah, rav4 and cars sharing the same platform are something to be weary about. Had to fit an aftermarket immobiliser on the RX; Also quick tip, in addition to steering locks and other visual deterrents, add stickers on the windows saying you have an immobiliser, make sure they aren't the same brand as the actual immobiliser you have though (if you have one), no point telling thieves which countermeasures to have. Godspeed.

[@MikeTheBackyardMechanic]

Thanks for the insight of other countries. And I agree, any kind of deterrent helps.

[@Discretesignals]

Don't quite understand how connecting to the headlamp bulb socket gives you access to a CAN network. Headlamp module that powers a bulb is more likely on a LIN bus or some other low speed CAN bus. The bulb itself doesn't use data packets...lol. Most modern vehicles use encrypted passwords between the immobilizer and the engine ECU that are generated once the ECUs learn each other. Since 2017 Chrysler has been using security gateways to only allow you onto the network as long as your tool is logged into their server. How many vehicles are stolen through hijacking the vehicles' network to enable the vehicle to start in the United States?

[@MikeTheBackyardMechanic]

The bulb socket itself, no. They connect to the actuators that move the headlights and down, or the brights/dim sensor. I shortened a complex topic and skipped the whole gateway discussion that explains how different networks communicate.

[@zacki5663]

Engineer here. GPS, ironically is the easiest thing to defeat, no jammer needed, simple $50 spectral analyzer will detect any radio frequency emitting from the car (bluetooth, GPS, etc). Some anti-car theft stuff even uses longwave and VHF, where a garage might not help, doesn't matter though. Cars are stolen, swept for trackers with spectral analyzer, and go right to the local port where they're sent out to sea and tracking doesn't matter anymore. They just don't want cops raiding the port containers. Can bus attack is also hilariously easy, not new either, they used to use slim jims, and get your canbus behind the dashboard. Only the headlight thing is kinda new as SOME manufacturers starting putting headlights on the same bus the ECU is on - not all of them do this and cars tend to have more than one can bus

[@MikeTheBackyardMechanic]

Great info, thanks!

[@arvindtaylor6871]

What is slim Jim?

[@scottydesrosiers]

​@@arvindtaylor6871it is a trade name for a tool designed to manipulate the lock linkage inside the door. A more modern and practical iteration uses inflatable wedges to slightly pry the door open at B pillar and roofline so you can actuate the manual or automatic lock function from inside the car vs inside the door. Most modern cars door design precludes the use of slim Jim's. There is much less skill involved with modern tools. Using a slim jim involved some knowledge and technique.

[@1982MCI]

@@arvindtaylor6871a device you slide into the door to manually pop the lock on cars. I have one I keep in case I ever lock my keys in the car but have only ever used it on friends cars and folks who errored in parking lots and I saved them calling a locksmith. It’s just a thin piece of metal about 2” wide, 32” long and it has a little hook cut in one end. It’s also extremely flexible

[@xXYannuschXx]

I remember that in the first cars having immobilizers the key was stored in the ECU, why the heck did they change that? So all it needs now is to send the "key validated" signal across the CAN bus and the ECU accepts that?! Who designed such a horrible security system?! It would be so incredibly easy to prevent this way of theft: 1. Store the key in the ECU 2. Lock the ECU for 1-2h if the key gets reprogrammed 3. Send a push notification to the app of the owner, telling that the key is being reprogrammed.

[@quademasters249]

The government mandated the use of CAN for some reason. It was never clear to me why. Instead of just demanding something like OBD2, they specified the actual bus type which seems odd to me. In my paranoia, I assume they wanted CAN so the cars could be remote controlled and remote killed using the built in cell phones. CAN doesn't benefit the consumer. It just made things more expensive to repair. I was perfectly happy using keys with a built in immobilizer so, stealing the car required both a physical and software interlock. Now apparently it's one step to steal.

[@tectorama]

Later Rav4s are fitted with a Can Bus shield, which can also be fitted to older models.

[@maximuscomfort]

That's nice to know. Thanks. I've found out the key battery shut down procedure recently too. Funny the dealer sales person never said a word that I bought one of the most popular stolen cars on the block.

[@kylecurry6841]

If the engine startup parameter is currently non-exclusive to the individual VIN, and more over relies on the guardian of identity from the key under normal startup conditions, you would wonder if it would be hard for vehicle manufacturers to make the parameter value unique to each VIN. I know like public IP addressing, theirs only so many to go around, thus in the same context a special (unknown) start up parameter in the CAN unique to the ECU of said VIN isn't infinite against the number of unique vehicles on this planet, but just as every padlock should have a unique code, surely theirs a percentage of locks across the globe that share the same factory set combo, and so this could work well enough given the range of potential is vast enough to make it no quick brute force guess to mitigate this sort of low level bypass.

[@jimnazium9508]

Can the next video be about the benefits of comprehensive coverage insurance on automobiles?

[@MikeTheBackyardMechanic]

I can play Mike from State Farm, wearing khakis :)

[@tanzhongyi8784]

🎯 Key Takeaways for quick navigation: 00:00 🚗 *Introduction to CAN Injection* - Understanding the basics of Control Area Network (CAN) and its role in vehicle communication. - Overview of sensors and electronic control units (ECUs) in a car. - Explanation of how devices in a car communicate through the CAN bus. 02:59 🛠️ *How Thieves Exploit CAN Injection* - Explanation of how thieves use CAN Injection to steal cars, primarily targeting smart headlights. - Methods used by thieves to access the CAN bus through the headlight socket. - Overview of the device (JBL Bluetooth speaker) used for CAN Injection. 04:40 🚘 *Which Cars Are Targeted and Manufacturers' Response* - Information about the types of cars targeted for CAN Injection attacks, including older vehicles with smart headlights. - Discussion of auto manufacturers' response and the challenges in addressing this issue. 06:04 🔒 *Preventing CAN Injection and Car Theft* - Tips on preventing CAN Injection attacks and car theft, including the importance of insurance. - Advice on parking, security gadgets, immobilization, and other preventive measures. - Highlighting the role of a well-hidden kill switch, wheel boot, and steering wheel locks as deterrents. 10:09 🤣 *Wrapping Up with a Sense of Humor* - Closing remarks and a touch of humor to engage the audience. - Acknowledgment of additional resources for further information on car security. Made with HARPA AI

[@arvindtaylor6871]

Great Canbus theft insight. Where can I get a tailgate kill switch from?

[@huuffff]

Use a wire and a fuse and a relay attached the relay to the data side of the can then why are the relays closed position to a ACC circuit?

[@TABLESAWTIM]

How do you prevent YOUR things (vehicles) from calling HOME, yet everything continue functioning?

[@Mannard74]

No headlight sensing in my 2001 Rustang! Actually, the simplest headlight design I've ever seen. Two clips and it's out. No tools.

[@GerhardBothaWFF]

CANbus is just a hardware level network with a basic message protocol. There is no standard higher level protocol. Car manufacturers agreed to a few protocols. In industrial applications we use OpenCAN etc which is different from what they have in cars, but still the same underlying CANbus. You can certainly encrypt codes if you just decide to do so- it’s only software. But I think the real issue is not having a separate network for telling the ECU to start from where the key receiver is to where the ECU is located. Its only two wires and a few IC’s … but that will apparently bankrupt the car companies… For people who cry about putting headlights on CAN, the reason is it reduces overall wiring and thus cost. Plus you get options for diagnostics.

[@stevestadnik9206]

The other reason sane people cry about headlights and tailights on CAN bus, is a fault on one can cause a no start. Ever hear of the $2000 F150 tail lamps causing no starts?

[@quademasters249]

CAN was forced on the manufacturers. The US government mandated it's use by 2008. Now they use it to prevent using used parts in your car because parts like the headlight have to be registered with the ECU (Mercedes). It's not a pro-consumer change.

[@1982MCI]

@@stevestadnik9206very interesting, I have not heard of it till now. Thanks for sharing tho cause I will look into it!!

[@daveborchard2019]

Will the IGLA device protect your car from theft? It adds a passcode combination requirement to start the car and disables injection attacks into the system. A Compustar alarm in addition to the IGLA device would be helpful to draw attention to the auto thief and notify you about the auto thief attempt in real time. Adding those devices would probably provide cause the auto thief to steal an unprotected car instead.

[@MikeTheBackyardMechanic]

That's excellent information. I wonder how much it costs... you have to email them for the price.

[@leecampbell9498]

The igla or ghost2 (same things) run about $1200-1500 cad installed. Ghost is distributed by Autowatch uk. And is only available to authorized retail install shops.

[@abdouallahuniverse5689]

Meaning if they want your car they will get it no matter what you do, because those thieves aren't simple people but professionals, because I have seen cars got stollen from outdoor parking garage, they hacked the system from sidewalk and start the car and open the house gate and drive away, and also 4 Harley Davidson motorcycles got stollen from inside locked garage, owners put them inside and locked the door at the winter, and in the begining of the summer they went to get their motorcycle, they found nothing, garage empty.

[@arvindtaylor6871]

What mod is done in JBL speaker to hack Canbus?

[@haczyk84]

Hmm I always though that communication between key receiver and ECM is kind of encrypted.

[@HJKonlineandtyping]

"I can't get enough of that." THAT'S WHAT SHE SAID!!

[@onespeedlite]

Too bad she meant child support. 🤣🤣🤣

Maybe we need aftermarket CAN firewalls to retrofit? It's either that or adding fuel/spark cut switches. An automotive software engineer I knew says that early/current? TPMS runs IP and are another wide-open vulnerability... and they're wireless.

[@plonkster]

Some car's already do this. Multiple Can busses are used in the vehicle and a central gateway module decide what can pass between busses. The obd2 port connects directly to the gateway module. Don't know how common this is, but at least VW and BMW does this.

[@josephhettiger2711]

Will Chrysler secure gateway prevent this?

[@buckdashe2571]

Hidden kill switch that honks the horn when they activate the starter. Idea modified from the original idea from a dude somewhere here in KZbin…good luck, y’all!

[@jraposo911]

Need info on that 😊

[@jdrissel]

​@@jraposo911You need two standard Bosch automotive 12 volt single pole double throw relays. These are the most common sort of automotive relays you'll find. Check to make sure that with nothing else connected you have continuity between terminal 30 and terminal 87A. This test will weed out relays that are intended for lighting that are are double pole single throw that won't work for this. These relays have 5 terminals. 85 and 86 are the coil and they are interchangeable in practice. Terminal 30 is called common. Terminal 87 is called normally open which means that it is connected to terminal 30 only when power is supplied across the coil. Terminal 87A is connected to terminal 30 unless power is supplyed across the coil. Cut the wires between the horn button and the horn relay and between the starter switch and the starter motor. We will label the 4 wires as follows: SS - starter switch SM - starter motor HS - horn switch HR - horn relay (this is the factory horn relay that's already in the car) On the first relay: 1. Connect SS and two short pieces of thin wire to terminal 87. 2. Connect one of the thin wires from step 1 to terminal 86. 3. Connect HS and a thin piece of wire to terminal 85. 4. Connect SM to terminal 30. 5. Test what you've done so far. Turn the key on all the way over to start. The engine should not crank but everything else should be on like normal. While holding the key in the start position, press the horn button. The engine should crank but the horn should not honk. Now we have our anti-theft working but we've got to fix the horn... On the second relay: 6. Connect the short wire from step 1 (87) to terminal 86. 7. Connect the short wire from step 3 and another short piece of wire to terminal 85. 8. Connect the short wire from step 7 to terminal 87A. 9. Connect HR to terminal 30. Test your horn. Now turning the key over to start should not start the car but if you hold it in start and press the horn button the engine should crank. Release the horn button to stop cranking. You will undoubtedly learn the procedure because it's kind of self-correcting LoL. You literally blow the horn at yourself if you do it wrong...

[@arvindtaylor6871]

Once they steal the car via Canbus hack, how do they obtain the keys?

[@1982MCI]

Usually a ransom note is mailed to the registered owner a few weeks after the theft asking them to be so kind as to send the keys in the envelope they have provided

[@tedjohnson64]

Really liked the technical details and examples! The only part that I’m puzzled about is how to ensure that a hidden fuel pump kill switch “fails open”. Do you have any examples of switches with that attribute? Thanks in advance.

[@MikeTheBackyardMechanic]

A switch can actively close a circuit (turn it on) or actively close it (turn it off). You would want the latter. No I don't have a part number handy.

[@tedjohnson64]

@@MikeTheBackyardMechanic Sorry, my original question wasn't clearly phrased. I didn't realize that it was possible... to choose which mode a switch fails in (closed vs on). I'm not saying isn't possible, I've just never heard of that as something an engineer (or consumer) could choose. If you know of any brand names, keywords, or other things I could search for to find a switch that fails open (or closed), I'd love to know. Cheers!

[@1982MCI]

@@tedjohnson64simply search for a switch that “fails open” and is 12v. Use those keywords in your search and you’ll find too many examples to read thru so pick a style and price that suit you and proceed to checkout. If your shopping locally, the packaging typically tells which way it fails but if not, the parts guy can look it up for you or you can look up the sku # on your wise phone and the B listed info will tell you exactly what you have. Either way, it’s very simple to find what your looking for. Good luck Ted, be safe out there!!

[@portroyal6886]

I had a holden and the key wouldn't remotely unlock it so I used the key and the alarm went off and that was the last time I ever drive it , apparently it needed a new ecu... 😅 I tried to Google and look how to bypass the anti theft... but I suppose it shouldn't really be well known but it was frustrating 😂...

[@KtothG]

would a CAN attack work on your 2010 GT?

[@MikeTheBackyardMechanic]

No. The CAN isn't exposed to any external parts (like the headlights)

[@KtothG]

nice. I'm guessing because it lacks auto-motion/smart headlights. plus, doesn't your Mustang require a physical key to start (even if the immobilizer were defeated in a CAN attack)?

[@MikeTheBackyardMechanic]

Yes, I have a physical key.

[@szsenyuk8887]

Try adding 2 diodes one on the ground and one on the power to the headlights ?????

[@MikeTheBackyardMechanic]

Interesting idea. I don't know if it would work, because I'm not sure if the headlights do need to communicate back.

[@steven.h0629]

Dang, as a former JBL analyst, I have like six of those JBL (Go3) rope speakers lying around here.

[@1982MCI]

Would you care to sell one, lol 😂 (I’m just kidding Steven! But I am surprised nobody has asked before this. That just tells me they must be easy to come across and I shouldn’t have to pay much, lol 😂. Take care Steven, be safe out there!!)

[@Dwigt_Rortugal]

It's a year later, and I'm seeing this just now. (New to your channel) Ye gads, manufacturers could still implement encryption keys sent over CAN, since CAN is, in the most basic sense, conveying binary data. 🤦‍♂️ On the basic lock/unlock fobs, rolling encryption has been the standard for decades, so it's ubiquitous at this point. They could add a key exchange between any module/device communicating with the immobilizer or other devices that could be used to steal the car. As you mentioned, though, that adds cost. Though, in mass production, probably not much once they've baked it in.

[@quademasters249]

CAN packets are very small. 28 bytes I think. They don't have destination addresses. It's all broadcast with all the devices listening in. There's a sender address which is used as the priority so, higher priority packets go out first. network Collisions are impossible because of the design. The government mandated the use of CANbus.

[@mr_deisel6728]

The software need to be change. By the ECM only used the address for the BCM to turn off the anti thief

[@kevinmills5293]

Have a kill switch which shorts out the can bus.

[@arvindtaylor6871]

Would a short not damage the Canbus?

[@Dwigt_Rortugal]

​@arvindtaylor6871 You could have the kill switch put a resistor across the bus wires, which shouldn't damage anything. CAN is very sensitive to having the wrong impedance. When I worked in a lab writing code to send and receive CAN frames, having the wrong impedance was the number one cause of nothing communicating.

[@arvindtaylor6871]

@@Dwigt_Rortugal Thank Q. Where would be easiest place to put to 20R0 resister across the Canbus?

[@jimmydcricket5893]

My car has a none of these, but does have glass and tin headlights.

[@yoohoooo]

First of all, moving headlights is the dumbest thing ever. Second, technology clearly makes cars easier to steal, not the opposite. Stay away from new cars, simple. Technology is turning out to be not so great for us. At least stealing an old car is not just the push of a button on a gadget from amazon.

[@Lovenpain]

I can use my Flipperzero to capture any of the signal that comes out of the car without touching it.

[@craigthepony6259]

New cars have such sensitive circuits for dtc's but meanwhile if a module goes nuts and wakes up the canbus or someones doing can injection, the cars just like "this is fine :)"

[@Lovenpain]

Oh by the way, it’s pointless getting a wireless alarm.

[@crownline5555]

Mike. Why don't vehicle manufacturers just a include a unique vehicle matched "one of a kind" piece of software incorporated into the keyfob that contains a complete CAN BUSS circuit controller key (not the old immobilizer BS) but a totally seperate part of the CAN BUSS in key fob that must be present for communication to occur, kinda like a router with a specific "matched" MAC address. just my opinion

[@MikeTheBackyardMechanic]

I'm just guessing, but it sounds like it would make replacing a lost key much harder and costlier. And it would still need to be transmitted wirelessly.

[@misunchang9860]

I work in this industry vehicle security and I’m sorry, but this is just not a viable solution for that unless it’s for the super wealthy only which I think they could probably afford a garage 🤷🏻‍♂️

[@Dwigt_Rortugal]

Just use industry standard encryption? Rolling your own security by obscurity might work for a while, but once it's leaked or reverse engineered, people have lots of fun with it. Also, MAC IDs are spoofed with trivial effort, though I know this was an analogy.

[@paulerickson1906]

We are so smart we built rolling computers causing all kinds of issues with the what the original purpose of the vehicle was in the first place. To get from one place to another costing you as little as possible. Soon you won't have an operational car anymore for anyone to drive. We are so smart we're stupid.

[@kevwox]

wow! what a great video to eat a meatball sub to!

[@Imwright720]

My truck is 22 years old and never thought anybody would want it. It is mint in box but still ……. I have a simple kill switch, 1911. I recommend everybody install a real kill switch.

[@fidelmontollaiii7866]

pull fuel pump relay.

[@hennsbreit]

love your video, keep it up! :)

[@touchofgrey5372]

Just take the dang spark plug wire with you! (keep them clean!😁)

[@Dwigt_Rortugal]

Coil packs have entered the conversation

[@Nordic_Mechanic]

use a physical key and a canbus shunt. Nothing will work in the car

[@barrylee.freedman2203]

Cut steering wheel, slide Club off and leave in place of car. The Phila way about the time I left the state.

[@Mateo-ww5dn]

Rewire the headlights bypass the CAN

[@cameronrich2536]

*help canoflauge it*

[@Brayooyo]

Quit the humor and just give us the knowledge

[@MikeTheBackyardMechanic]

I have joke Tourette's.

[@blueplasma5589]

@@MikeTheBackyardMechanic I've been afflicted with it before. lost some friends for a time. lol

[@StationRussification]

Kill switch to the Engine Controller Fuse

[@MikeTheBackyardMechanic]

You have to hide the switch and wires well, or "they" will find it

[@StationRussification]

I would use a key style switch & hide it in the glove or center console box@MikeTheBackyardMechanic

[@GNXClone]

I had a kill switch on my Grand National which didn’t use a physical switch. You had to touch a hidden screw while also touching anything grounded. That enabled the circuit so the fuel pump would run.

[@onespeedlite]

What do you think of the idea of connecting a dummy push-start button to a taser, simultaneously triggering the release of a swarm of angry Africanized bees, and locking down all doors? Not recommended for those with short-term memory problems. I don't know...it just might work. 🤣🤣🤣

[@MikeTheBackyardMechanic]

It is a clever and simple solution.

[@stevethea5250]

Too much fluff

[@topofthegreen]

This is why we can't have nice things.ill stick to the bicycle, easier to replace.

[@childoftruth1738]

Can we all agree that vehicles without all these sensors and relays are by far and away the most reliable and durable vehicles?

[@Dwigt_Rortugal]

I don't disagree, but when someone says, "Can we all agree," or "I think we can all agree," I feel gross from someone attempting to manipulate me and I want to take a shower.

[@arthurmann578]

2nd best way to never have your car stolen is to own a 27 year old, rusting piece of crap like I have! 1st best way is to just NEVER own a car.....and I am quite close to that endeavour with my piece of $hit vehicle.....any day now! 🙄😂😂

[@stevethea5250]

9:20

[@tombox2759]

Rattle snake works well...

[@lexwells4763]

Just drive an ugly car. That keeps the thieves away like if it was made of fresh cow manure.

[@wkearney99]

not entirely true. I had a clapped-out Jeep XJ, stolen in the dead of winter. Cop's comment was "it beat walking in the cold".

[@Dwigt_Rortugal]

Unless it's an ugly Honda that can be parted out. I do miss my XJ in all its boxy glory with its bulletproof dinosaur AMC straight 6.

[@blueplasma5589]

a little too silly sometimes, almost removed new sub.

[@Callitwhatitis]

solution: don't live in diverse cities

[@garyszewc3339]

You try being entertaining, but it turns out just boring and I can't wait through all the BS before seeing what the video is about.

[@MikeTheBackyardMechanic]

I recommend you play my videos backwards.

[@420rockNinja]

just unplug the battery, easy fix

[@MikeTheBackyardMechanic]

That's a massive inconvenience factor, and also disables the car alarm if you have one. It's also easy to figure out, after they've entered your car with a slim jim. But along those lines, you could pull the fuse to the fuel pump.

[@ambivertical]

@@MikeTheBackyardMechanic Can I do this with my Rav4 Prime 2023?

[@CS-oe8og]

Your third mustang? You must be a slow learner.

[@MikeTheBackyardMechanic]

I like Mustangs.