Meshtastic has gained a lot of popularity over the last few years thanks to its low barrier of entry. No licenses are needed and the hardware is dirt cheap, at least when compared to a lot of ham radio gear. But while that physical barrier is low, there is a bit of a learning curve. Part of that comes from the fact that there are a lot of channels and modes that people could be communicating on, and unless the user knows that information up front it can be hard to find where the conversations are happening. [cemaxecuter] noticed this problem and built a Meshtastic sniffer into his radio-forward Linux distribution, DragonOS.
The sniffing software is built in C and comes as a complete standalone binary and does not rely on GNU Radio. With DragonOS up and running and the software loaded, it can look at the entire bandwidth that Meshtastic operates on and detect any traffic and decode it (as long as the key is known). [cemaxecuter] is using a HackRF as a software-defined radio for this project, which he notes doesn’t quite have enough bandwidth to cover every Meshtastic operating frequency, but it can get most of them. After firing up his own node, the software quickly detects it and shows its details in the terminal.
Software like this opens up a lot of opportunities for things that would be tedious, difficult, or impossible to do with with a standard Meshtastic node. Besides finding places where conversations are happening more easily, [cemaxecuter] also suggests that it could be used for wardriving and for locating or finding other networks much more easily. For those who still haven’t tried it out, take a look at this 2023 treatise on the protocol and hardware and then dive right in.
Earlier, we wrote an article on the issues that cars have. These issues are still common and car ransomware might soon emerge, hitting not just individual cars but entire fleets as vehicles get more autonomous and packed with different features.
In light of that, we want to show you a tool that makes car hacking more approachable. It’s GearGoat. The tool was built to simulate a car’s internal network so you can play with it.
GearGoat
GearGoat is a car simulator developed by INE Labs. It lets you work with the internal communication network used by most modern vehicles (CAN bus). Every action generates CAN packets on a virtual interface. You can use cansniffer, candump and UDS scanners with GearGoat, just like with any vehicle.
In a real car, you’d connect a CAN adapter (CANable or Macchina M2) into the OBD-II port, located under the dashboard. This port is basically a gateway into the vehicle’s internal network. Your system will treat the adapter as a network interface (can0) and you can start capturing and sending CAN messages. When someone presses the brake or turns on the indicators, it generates messages that travel across the network.
Setting Up
GearGoat runs inside a Docker container, so it’s easy to deploy. Clone the repository and run the script:
kali > git clone https://github.com/ine-labs/GearGoat.git
kali > cd GearGoat
kali > sudo chmod +x initial_setup.sh
kali > sudo ./initial_setup.sh
Then you need to configure the virtual CAN interface (vcan0):
kali > sudo chmod +x vcan_setup.sh
kali > sudo ./vcan_setup.sh
On certain distros you might be missing kernel modules. Here’s how you install them:
kali > sudo apt-get install -y linux-modules-extra-$(uname -r)
It doesn’t always work on Kali Linux though. You can manually load the required modules and create the interface yourself:
kali > sudo modprobe vcan
kali > sudo ip link add dev vcan0 type vcan
kali > sudo ip link set up vcan0
kali > ip link show vcan0
Now everything should be ready. You can start GearGoat:
kali > sudo docker run --network="host" --privileged geargoat
The simulator will be hosted on http://localhost. There you’ll see different car functions. Each button on the interface generates CAN traffic.
Intercepting Traffic
While the simulator’s running, it continuously generates CAN traffic. To see this traffic, use cansniffer.
kali > cansniffer -c vcan0
The output can feel overwhelming. The tool keeps highlighting changing bytes dynamically. It’s very noisy when you’re trying to establish a baseline. You need a way to tell the tool what normal looks like. Press Shift + 3 + Enter multiple times and cansniffer will treat the current state as the baseline. It won’t highlight the background noise anymore, so you’ll only see the changes you make.
Once the baseline is set, you can start playing with the simulator. Click the Left Indicator button and you’ll notice a change in the CAN data.
The first byte of a frame changes and it’s tied to 0x188. That means this identifier controls the indicator state.
When you play with the speedometer, you’ll see a different pattern. The changes happen in the 4th and 5th bytes are associated with 0x244. The speed climbs gradually.
Repeat this with other controls and you’ll see how functions map on the CAN bus.
Sending Input
Now we know which messages control specific functions, so we can interact with them.
To control the indicators, we’ll send CAN frames using cansend:
kali > cansend vcan0 188#0100000000000000 # left
kali > cansend vcan0 188#0200000000000000 # right
These commands will turn on the left and right indicators. The CAN bus runs at high speed, so these changes can be hard to catch. We used the watch command to make it more visible:
kali > watch -n 0.1 "cansend vcan0 188#0200000000000000"
Working with speed gets slightly more complex. Earlier, we found the address (0x244) and that specific bytes that control the value. To set a speed, we need to convert miles per hour into the format the CAN message expects.
To simulate a speed of 50 miles per hour you send:
kali > cansend vcan0 244#0000001F6F
You can see the simulator accelerating. Use the formula V = round(mph / 0.6213751 * 100) to calculate the value, then convert it into hexadecimal using big-endian.
Capturing and Replaying Traffic
You can also capture and replay traffic. That way you can record a sequence of actions and reproduce them.
To capture traffic, you use candump with logging:
kali > candump -l vcan0
It’ll record the CAN messages into a log file. Once captured, you can replay it:
kali > canplayer -I <log_file_name>.log
Summary
GearGoat can get you started with car hacking. You work with a simulated CAN bus to understand the communication patterns and message structure. It’s easy to set up and it’s not resource intensive, so it’ll run on pretty much any computer.
We also have our three-day Car Hacking training, showing you real attacks. It includes CAN protocol exploitation and the use of Software Defined Radio (SDR). There we show you how modern vehicles are actually compromised.
Login
