Brent Stone - Reverse Engineering 17+ Cars in Less than 10 Minutes
Demonstrates automated CAN bus reverse engineering tooling that maps unknown message IDs to physical vehicle functions in minutes.
Summary
Automated Automotive CAN Bus Reverse Engineering
Brent Stone presents a methodology and toolchain for rapidly reverse engineering CAN bus message formats across 17+ vehicle makes and models, reducing the time from plug-in to functional control mapping to under 10 minutes.
CAN Bus Fundamentals
CAN bus carries thousands of messages per second encoding sensor readings, control commands, and status telemetry from every ECU in the vehicle. Most automotive security research requires weeks of manual fuzzing to identify which message IDs control which functions.
Automated Discovery via Correlation
Stone's approach correlates CAN message timing and value changes with physical vehicle sensor readings (GPS speed, accelerometer, steering angle sensor from OBD-II) to automatically associate unknown message IDs with likely vehicle systems.
Cross-Vehicle Generalization
By building a database of correlated mappings across 17 vehicles, the tool identifies recurring message patterns (e.g., speed reporting formats) that generalize across manufacturers, accelerating subsequent vehicles.
Related talks
Village Interviews·1 min
A tour of the Car Hacking Village at DEF CON 32 featuring CAN bus testing benches, instrument cluster fuzzing, and connected vehicle targets.
Village Interviews·< 1 min
A tour of the Car Hacking Village at DEF CON 31 featuring vehicle test benches, instrument cluster analysis, and automotive security research.
Village Interviews·6 min
CauseEffect
CauseEffect talks with organizers and researchers in the Car Hacking Village at DEF CON 31, examining automotive protocols and ECU test benches.