TomerKal7/Attack-on-CANbus

# 车辆 CAN 总线欺骗攻击的研究与实现 [](https://www.python.org/) [](https://in.bgu.ac.il) [](#license) ## 📌 项目概述 现代车辆严重依赖于内部的控制器局域网（CAN bus）协议来实现高速的 ECU 间通信。然而，CAN 协议缺乏原生的身份验证或加密机制，使得车辆容易受到数据包注入和欺骗攻击。第三方的无线 OBD-II 诊断模块进一步放大了这一漏洞，它们作为未经身份验证的入口点接入了车辆的网络。 本学术毕业项目展示了一次端到端的安全审计和概念验证攻击框架，该测试在**内盖夫本-古里安大学**（Ben-Gurion University of the Negev）**CYITES 网络安全实验室**提供的实体 **现代 Kona 2020** 车辆台架上进行。 ### 主要目标与成果： - **物理层逆向工程：** 嗅探并映射了关键功能的专有 CAN ID，包括车门锁解锁（`0x168`、`0x102`）、雾灯（`0x102`）、转向灯（`0x16A`）、雨刷（`0x107`）和变速箱状态（`0x367` / `0x111`）。 - **高频接收与注入引擎：** 开发了一个支持高频突发泛洪（$1000\text{Hz}$）的 Python 注入引擎，并能够自动计算递增的滚动计数器，以覆盖 ECU 仲裁。 - **无线 GATT 与 UDS 网关绕过：** 通过原始 GATT 特征值与通用的售后市场 **Veepeak ELM327 BLE** 模块进行交互，执行 UDS 诊断会话提权（`10 03`）、节点静音（`28 01`），并使用我们集成的 **PwnOBD** 框架对 BCM 执行器进行自动化模糊测试。 - **统一的 Web 审计仪表板：** 将我们的工具集产品化为一个现代的、基于 Web 的图形化渗透测试仪表板，具有通过 Server-Sent Events (SSE) 进行实时 CAN 遥测流传输、自动化 BLE 设备扫描以及一键触发攻击的功能。 ## 📂 仓库目录结构 ``` ├── final_report/ # Official Academic Final Report Files │ ├── final_report_p2026_053.docx # Main Final Word Report (Formatted to BGU Standards) │ ├── final_report_p2026_053.pdf # Final PDF Report Export │ ├── 0_title_and_abstract.md # Chapter Source: Title & Abstracts (English & Hebrew) │ ├── 1_introduction.md # Chapter Source: Introduction & Measurable Objectives │ ├── 2_literature_survey.md # Chapter Source: Literature Survey & Vulnerability Mapping │ ├── 3_system_architecture.md # Chapter Source: High-Level Architecture & Design Rationale │ ├── 4_physical_testing.md # Chapter Source: Physical Layer Connection & Frame Database │ ├── 5_wireless_attempts.md # Chapter Source: Wireless BLE & UDS Gatekeeper Analysis │ ├── 6_web_dashboard.md # Chapter Source: Unified Web Audit Dashboard & SSE Telemetry │ ├── 7_conclusions.md # Chapter Source: Conclusions, SOW Alignment & Future Work │ ├── build_dynamic_heading_docx.py # Script to generate Word docx with dynamic styles │ └── latex/ # LaTeX Source & Compiled Documents │ ├── main.tex # XeLaTeX Document Source │ ├── main.pdf # Compiled XeLaTeX PDF Document │ └── generate_latex_doc.py # Automated LaTeX generator script │ ├── src/ # Core Python Audit & Attack Source Code │ ├── dashboard.py # Flask + SSE Web Application Server │ ├── can_sniffer.py # Real-time CAN frame sniffer & logger │ ├── can_injector.py # Controlled CAN frame injector (Periodic/Burst) │ ├── can_replay.py # CAN traffic record & replay engine │ ├── discover_services.py # GATT characteristic discovery script │ ├── find_dongle.py # BLE device discovery scanner │ ├── interfaces/ # Dual Transport Layer Drivers │ │ ├── base.py # Abstract base transport interface │ │ ├── socketcan.py # Linux SocketCAN / Kvaser hardware driver │ │ └── elm327_ble.py # Low-overhead ELM327 BLE GATT driver │ ├── cgw_bypass/ # UDS Diagnostic Escalation & Fuzzing Scripts │ │ ├── 1_uds_routine_control.py # UDS Service 0x31 / 0x2F routine testing │ │ ├── 2_diagnostic_session.py # UDS Service 0x10 Extended Session escalation │ │ ├── 3_gateway_dos.py # Gateway buffer flooding PoC │ │ ├── 4_uds_silence_and_inject.py # Service 0x28 node silencing + injection │ │ ├── 5_uds_0x2f_door_control.py # Service 0x2F actuator control testing │ │ ├── 6_burst_token_bucket.py # Token-bucket BLE rate limiting PoC │ │ ├── 7_elm327_protocol_b_bypass.py # Low-level protocol header override │ │ ├── ble_terminal.py # Interactive BLE AT command terminal │ │ └── continuous_uds_injection.py # Continuous UDS diagnostic session keep-alive │ ├── pwnobd/ # Integrated PwnOBD Exploitation Framework │ │ └── src/pwnobd/modules/attacks/ │ │ └── hyundai_door_fuzzer.py # Automated 16-bit DID actuator fuzzer │ ├── templates/ # Dashboard HTML Templates (index.html) │ └── static/ # Dashboard CSS & Frontend JS (app.js, style.css) │ ├── report_images/ # Testbed Photographs & Architecture Diagrams │ ├── bgu_bench_setup.jpg # CYITES Lab Hyundai Kona 2020 Testbed Photo │ ├── direct_wire_tap.jpg # Physical B-CAN & C-CAN Wire Tap Photo │ ├── ble_dongle_inserted.jpg # Veepeak BLE Dongle OBD-II Connection Photo │ ├── system_architecture_diagram.png # High-level System Architecture Diagram │ ├── can_injector_flow.png # Injector Logic & Rolling Counter Flowchart │ ├── uds_state_machine.png # UDS Diagnostic Session State Machine │ ├── sse_data_flow.png # Web Dashboard SSE Architecture Diagram │ ├── dashboard_overview.png # Web Audit Dashboard Interface Screenshot │ └── diagram_generators/ # HTML/CSS Diagram Generator Source Files │ ├── סקירת ספרות/ # Literature Review & Project Guidelines │ ├── מחקר_Hyundai_Kona_2020_CAN.md # Hyundai Kona CAN bus research notes │ ├── מידע_נדרש_לפני_קוד.md # Pre-requisite technical checklist │ ├── תוכנית_פרויקט.md # Master project work plan │ └── נוהל פרויקטים 2026.pdf # ECE Department Project Guidelines │ ├── התקדמות/ # Experimental Progress Logs & Test Plans │ ├── התקדמות_2026-05-24.md # Experimental progress report 1 │ ├── Physical_CAN_Injection_Plan.md # Physical layer injection testing plan │ └── CGW_Bypass_Attempts/ # CGW Bypass research guides (1-3) │ ├── הסברי_קוד/ # Code Documentation (Hebrew Explanations) │ ├── הסבר_can_sniffer.md # Sniffer implementation breakdown │ ├── הסבר_can_replay.md # Replay engine implementation breakdown │ ├── הסבר_can_injector.md # Injector engine implementation breakdown │ ├── הסבר_תשתית_BLE.md # BLE infrastructure breakdown │ └── CGW_Bypass/ # CGW bypass script documentation │ ├── .gitignore # Git Exclusion Filters └── README.md # Main Repository Documentation (This File) ``` ## 🛠️ 安装与设置 ### 前置条件 - Python 3.8+ - Linux（用于支持 SocketCAN / `vcan0`）或具有蓝牙 4.0+ BLE 适配器的 Windows 10/11。 - Kvaser Leaf Light v2（或兼容 SocketCAN 的 USB 转 CAN 适配器），用于物理测试。 - Veepeak OBDCheck BLE（或通用的 ELM327 v1.5 BLE）OBD-II 模块。 ### 1. 环境设置 克隆仓库并安装所需的 Python 依赖项： ``` git clone https://github.com/TomerKal7/Attack-on-CANbus.git cd Attack-on-CANbus python3 -m venv .venv source .venv/bin/activate # On Windows: .venv\Scripts\activate pip install -r requirements.txt # Or manually: pip install python-can bleak flask ``` ### 2. 虚拟 CAN 设置（用于本地仿真） 要在没有实体车辆硬件的情况下测试工具，请在 Linux 上启用虚拟 CAN（`vcan0`）接口： ``` sudo modprobe vcan sudo ip link add dev vcan0 type vcan sudo ip link set up vcan0 ``` ## 🚀 运行项目 ### 1. 统一的 Web 审计仪表板 启动 Web 界面服务器： ``` python src/dashboard.py ``` 打开浏览器并访问 `http://localhost:5000`。在仪表板中，你可以： - 扫描并连接到 BLE 诊断模块或 SocketCAN 接口。 - 实时流传输 CAN 总线流量。 - 触发预先配置的一键攻击（例如，车门解锁、雾灯、换挡杆泛洪）。 ### 2. 命令行审计工具 #### 实时 CAN 嗅探器： ``` # 嗅探 virtual bus python src/can_sniffer.py --interface socketcan --channel vcan0 # 通过 BLE dongle 嗅探 python src/can_sniffer.py --interface elm327_ble --mac 8C:DE:52:DF:96:D6 ``` #### 可控数据帧注入器： ``` # 在 vcan0 上 Inject door unlock frame (ID 0x168) python src/can_injector.py --interface socketcan --channel vcan0 --id 0x168 --data 0100000000000000 --rate 50 ``` #### 流量记录与重放： ``` # 录制 10 秒 traffic python src/can_replay.py record --interface socketcan --channel vcan0 --seconds 10 --output logs/capture.jsonl # 重放已录制的 traffic python src/can_replay.py play --interface socketcan --channel vcan0 --input logs/capture.jsonl ``` ## 👥 作者与学术致谢 - **学生：** Tomer Kalati & Nadav Sheffer - **学术指导：** Prof. Michael Segal - **机构：** 内盖夫本-古里安大学 (BGU)，电气与计算机工程系 - **实验室设施：** CYITES 网络安全实验室 - **项目序列号：** `p-2026-053` ## 🔒 安全与使用免责声明 本仓库专为**授权的学术研究和教育目的**而开发。所有测试均在处于静止状态的实验室测试台上的受控环境中进行。未经授权访问或在公共道路上向运行中的机动车辆进行注入是非法的，并会带来严重的安全风险。

标签：Python, XXE攻击, 协议逆向, 无后门, 汽车安全, 物联网安全, 逆向工具