Car Hacking Village - Nathan Hoch

### The High Stakes of Heavy Vehicle Accident Reconstruction Commercial vehicle accidents involving Class 7 and Class 8 tractor-trailers carry massive financial, operational, and legal ramifications. At 01:24, the speakers outline the stark economics of commercial crashes: a standard property-damage incident averages roughly $148,000, while collisions involving severe injuries or fatalities regularly escalate into multimillion-dollar litigations against freight carriers. In these courtroom battles, the digital records stored within vehicle electronic control modules (ECMs) serve as the primary source of objective truth regarding vehicle speed, braking, throttle position, and driver behavior prior to impact.

### Event Data Recorders (EDRs) and Engine Control Module Logging Unlike passenger automobiles governed by standardized NHTSA Part 563 EDR regulations, commercial trucks historically lacked unified data logging mandates. Instead, diesel engine manufacturers (such as Cummins, Detroit Diesel, and Caterpillar) implemented proprietary crash-logging parameters directly into engine management firmware. At 04:54, the presentation details how ECMs capture critical incident triggers—such as hard braking events, sudden deceleration, or active diagnostic fault codes. When triggered, the ECM freezes a pre- and post-event snapshot recording parameters like engine RPM, vehicle ground speed, clutch engagement, and cruise control status into non-volatile memory.

### Physical Bench Setup: The Truck in a Box To study these systems safely without purchasing a $100,000 commercial truck or conducting dangerous road tests, the research team constructed a portable hardware testbed dubbed the "Truck in a Box." At 14:38, the speakers describe acquiring decommissioned transit equipment and commercial ECMs, mounting them onto custom test fixtures alongside instrument clusters and power distribution units. At 16:55, they demonstrate the analog interface array: a bank of precision potentiometers and waveform generators wired directly to the ECM's harness pins to emulate dynamic operational inputs like manifold absolute pressure, oil pressure, coolant temperature, and accelerator pedal position.

### CAN Bus Reverse Engineering and Telemetry Injection At 10:18, the presentation examines the transmission of vehicle speed data across the vehicle's SAE J1939 network running over 250 kbps CAN. Commercial trucks broadcast wheel speed, engine speed, and driveline torque continuously. The researchers utilize custom CAN transceivers and microcontrollers to inject synthetic CAN frames into the bus: - **Speed Sensor Mismatch:** By spoofing wheel speed CAN frames while manipulating simulated analog engine sensors, the researchers trigger hard-braking crash records on demand. - **Clock and Timestamp Quirks:** At 12:59, they demonstrate how variations between ECM internal run-time clocks and auxiliary GPS telematics units can lead to conflicting timeline reconstructions during accident forensics.

### Forensic Vulnerabilities and Practical Security Implications At 22:41, the presentation explores physical and cryptographic security limitations of heavy vehicle ECMs. Because ECMs are potted in industrial silicone epoxy to withstand harsh engine bay vibrations and weather, direct physical memory tampering requires labor-intensive chip decapsulation. However, at the protocol level, diagnostic extraction tools (e.g., RP1210 adapters) utilize unauthenticated commands to extract event records. The lack of cryptographic signing or tamper-evident hashing on raw memory dumps means that sophisticated attackers or compromised diagnostic laptops could theoretically alter, falsify, or clear accident records prior to judicial inspection.

(AI summary — Gemini 3.8 Flash)