So, You Want to Be a Car Hacker?

In garages, parking lots, and maker spaces, a quiet revolution has been taking place. As electronics gradually take over the mechanics of vehicles, car hacking is gaining a growing number of enthusiasts, all wanting to understand what their car can do and could do with modifications to its hardware and/or code.

Craig Smith's Car Hacker's Handbook offers a compelling range of reasons why car hacking should be an integral part of car ownership, as it contributes to:

• Better modifications, like improved fuel consumption and use of third-party replacement parts.
• Bypassing the barriers caused by auto manufacturers outsourcing parts and requiring proprietary tools to diagnose problems.
• The ability to discover undocumented features.
• The ability to you’ll know where your vehicle is vulnerable regarding security so that you can take precautions and be a better advocate for higher safety standards.

According to Craig Smith, "Engineers at Toyota joke that the only reason they put wheels on a vehicle is to keep the computer from scraping the ground. As computer systems become more integral to vehicles, performing security reviews becomes more important and complex." This means that the more we understand our cars, the more we are able to ensure that they are safe.

It's a Great Time to Be a Car Hacker

People have been tinkering with automobiles and engines since the first automobile and whilst there are obvious caveats in regard to safety and warranty, it’s a good time to be a car hacking enthusiast. In October 2016, a new exemption to the Digital Millennium Copyright Act appeared, ensuring that Americans can hack their own device without fear that the DMCA’s ban on circumventing protections on copyrighted systems would allow manufacturers to sue them. Importantly, this extends to new forms of security research and the digital repair of vehicles, creating scope for a need breed of hacking. The exemptions are limited to a two-year trial period.

Car Hacking Is Becoming More Open

Last month Charlie Miller and Chris Valasek released all their research including (but not limited to) how they hacked a Jeep Cherokee after the newest firmware updates which were rolled out in response to their Hacking of a Cherokee in 2015 where they were able to wirelessly take control of a Jeep using a wifi connected laptop, enabling them to cut the breaks and transmission. (Yes, they were able to hack it twice).

The original hack resulted in a massive recall of the affected cars – which included much of Fiat Chrysler’s range. It also exposed serious problems with how the car companies planned to handle such software flaws. Although the car hack could be executed remotely, it could only be fixed with physical access to the car, forcing Fiat Chrysler to post USB keys to affected owners or ask them to bring their cars in for maintenance. Posting USB keys brought its own problems: plugging an untrusted USB key into anything, whether car or computer, carries serious risks. It’s also hard for anyone to easily verify that a drive received in the post is malware-free.

I spoke to Robert Leale, founder of CanBusHack Inc, a security research firm focused on vehicle networks and embedded control systems and The Car Hacking Village (CHV), which made its debut at Defcon in 2016 and also featured in this year's CES. Car Hacking Village is a group of professional and hobbyist car hackers who work together to provide hands-on, interactive car hacking tutorials, talks, hardware, and interactive contests.

Leale explained that his first "hack" was putting a computer in his car and making it talk to the car. In Leale's words: "Not very hacky, but it was how I started." With owners wanting to understand more about their cars through hacking, he noted that the only information made accessible outside of their company is "that which helps their maintenance workers do their jobs. So wiring diagrams and scan tools. Everything else is proprietary."

I was curious to know if his involvement in car hacking resulted in any action or response from car manufacturers and he said "Typically I don't get any.  I've received one take-down notice.  For the most part, they're too busy or too big to worry about us."

So You're Keen, But You've Never Done Any Car Hacking?

Don't worry there's a huge range of resources (both for hardware novices and experts) to get people started on their car hacking journey including kits and tools.

This year Macchina successfully crowdfunded more than $140,000 on Kickstarter in sales with its M2 device. M2 is an open source automotive interface that you can use to unlock the control center of your car. Once you are in, you can do anything from simple projects like stopping that annoying ding to more complex upgrades like unlocking more horsepower or improving fuel economy. It arrives as a blank key—you have to cut it yourself. Learning how to cut that key (reverse engineering, writing code, and plain-old tinkering) is the fun and challenging part. The makers stress that "their product is by car nerds for car nerds because a community of car nerds already exists."

Carloop is a 100% open source kit that lets you connect your car to the cloud via 3G, WiFi, or Bluetooth. They provide easy to use libraries so you can track your car with GPS, log mileage on an SD Card, or check your engine codes. It’s Plug and Play, no cables required, and built to work with Particle's Photon and Electron boards. You can see what others are building on the community forum and check out the GitHub page for more tutorials. 

I asked Leale about his recommendations any advice for people wanting to try something with their own car. I told him that DZone is a community made up of more coders than hardware people, and here are some suggestions he had for us in particular:

• Learn Hexidecimal numbering. "It's key."
• Always have a goal.
• Start a group (OpenGarages is a good organization to start with).
• Get the Car Hackers Manual.

Resources Wrap Up

The internet is literally a car hackers paradise for resources, tutorials, and like-minded people. Below, I'll list a few of my favorites:

The Car Hackers Handbook and Open Garages

Mentioned earlier, The Car Hackers Handbook is an open source Handbook by Open Garages on how to reverse engineer, exploit, and modify any kind of embedded system in a car. Open Garages is a central repository that provides extensive resources about car hacking including an international directory of Vehicle Tuning Shops that provide training in car hacking.

Def Con

If you have a few hours free to fall into rabbit warrens of fascinating content, you can also check out DefCon archives and resources for all things hacking, including, of course, car hacking.

Others

• Hackaday.io is a good research for car hacking tutorials
• YouTube also offers a range of videos on car hacking, including demos and tutorials by Macchina that are great for beginners.
• Check out Reddit for forums and a great AMA with Craig Smith (author of Car Hacker's Handbook mentioned earlier).
• Ben Ferris has also compiled a detailed list of resources on peerlyst.

What Next As We Prepare for Autonomous Vehicles?

I asked Leale how car hacking enthusiasts might prepare themselves for autonomous cars, and it seems that the best way to get started is simply to get in there and experiment...

"Get a car that has adaptive cruise and lane keep assist. Then figure out how the systems works. Then figure out how to control it. Then create a system to autonomously control it. Then sell your company for 1 billion dollars!"

However long we wait for autonomous cars to become a reality, rest assured that car hackers are ready and waiting to get their hands on them.

Car Hacking Village's upcoming events include a hands-on training program at Black Hat USA in July and Hack in the Box, Singapore.  To follow updates, Twitter: @CarHackVillage