My Car, My Keys: Obtaining CAN Bus SecOC Signing Keys
summary
Fault injection unlocks the locked bootloader of a 2021 power‑steering ECU, firmware dump leads to reverse engineering that finds AES CMAC implemented in firmware rather than an HSM, and the keys in RAM are readable after uploading a signed, encrypted shellcode payload. Exploit uses a low‑cost Raspberry Pi Pico glitcher (later replicated with ChipWhisperer), yields the vehicle‑unique master ECU key per VIN for that unit only, and the extraction works on the tested model; exploit code is on GitHub.
AI-written summary · about
chapters (12)
- 0:00Intro
- 0:48Overview
- 2:35What got us started
- 4:27Car Hacking 101
- 8:31How Firmware Updates Work
- 10:40Reverse Engineering Automotive Firmware
- 18:01SecOC
- 24:32Attack
- 27:35Verification
- 31:57Bootloader
- 36:00Demo
- 39:50Questions
related talks
37mAutomatic Automotive Hacking
50mAdvanced CAN Injection Techniques for Vehicle Networks
40mD2T1 - Backdooring & Remotely Controlling Cars
27mLock It and Still Lose It —on the (In)Security of Automotive Remote Keyless
42mMobilized Immobilizer - Bypassing Motorcycle Security 1
20mSecurity and Safety in the Modern Vehicles
51mSteering Clear of Danger: Decrypting the Realities of Remote Car Hacking
43mSecuring the Connected Car