The Bicho
Reverse engineering and exploitation of vehicle embedded systems and automotive hardware.
Summary
### The Inherent Insecurities of Controller Area Networks At 00:00 and 03:19, Sheila Ayelen Berta and Claudio Caracciolo open with an overview of automotive internal networks. Modern vehicles rely on the Controller Area Network (CAN) bus for inter-ECU communication. However, because CAN was designed without built-in authentication, encryption, or origin validation, any node connected to the physical bus can sniff broadcast traffic and inject malicious control frames with total impunity.
### Introducing The Bicho Hardware Implant At 06:21 and 09:23, the speakers unveil "The Bicho," an open-source, low-cost hardware implant engineered for clandestine automotive backdooring. Designed to be wired covertly behind the OBD-II diagnostic port or tapped directly into internal dashboard wiring harnesses, The Bicho combines a low-power microcontroller, a CAN transceiver, and an integrated GSM/GPS cellular modem, granting remote interactive access to the vehicle from anywhere in the world.
### Dual Modes: Configuration and Autonomous Attack At 15:28 and 18:31, the presenters explain The Bicho's dual operational modes. In programming mode, researchers configure targeted CAN frame IDs, payload masks, and trigger logic via a dedicated GUI or serial console. In autonomous attack mode, the device monitors the bus in real time, executing preprogrammed payload injections whenever specific vehicular conditions—such as exceeding a defined speed or activating turn signals—are satisfied.
### Remote Telematics Control and Live Injection Demos At 21:32 and 26:16, the speakers demonstrate live vehicle manipulation via SMS commands sent across the cellular network. The Bicho intercepts the SMS instruction, formats the corresponding CAN payload, and transmits frames into the vehicle network. Video demonstrations illustrate remote actuation of headlights, manipulation of digital instrument cluster speedometers and fuel gauges, cycling windshield wipers, and suppressing critical dashboard warning lights while the vehicle is driven.
### CAN Reversing Methodologies and Countermeasures Concluding between 27:49 and 30:52, Berta and Caracciolo outline reverse-engineering methodologies for proprietary CAN databases without manufacturer DBC files. They detail differential packet analysis to isolate actuator frames from noisy sensor broadcasts and advocate for hardware-level automotive intrusion detection systems (IDS) and cryptographically authenticated protocols like AUTOSAR SecOC to neutralize physical implants.
(AI summary — Gemini 3.8 Flash)
Related talks
Car Hacking Village·14 min
Eric Evenchick
Practical automotive hacking techniques and CAN bus exploitation methods.
Black Hat·48 min
Presenters detail vulnerability discovery and exploitation in Reverse-Engineering the Supra iBox: Exploitation of a Hardened MSP430-Based Device.
IoT Village·29 min
Maxwell Dulin
"This talk will convey the hacking methodology that took place in order to find the vulnerabilities within the Zyxel NAS 326, including some fun dives into the technical weeds. Note: despite how critical security flaw...