Dashboard Dongle Teardown Reveals Hardware Needed To Bust Miles

Progress and the proliferation of computers in automotive applications have almost made the shade tree mechanic a relic of the past. Few people brave the engine compartment of any car made after 1999 or so, and fewer still dive into the space behind the dashboard. More’s the pity, because someone may be trying to turn back the odometer with one of these nefarious controller area network (CAN bus) dongles.

Sold through the usual outlets and marketed as “CAN bus filters,” [Big Clive] got a hold of one removed from a 2015 Mercedes E-Class sedan, where a mechanic had found it installed between the instrument cluster and the OEM wiring harness. When the dongle was removed, the odometer instantly added 40,000 kilometers to its total, betraying someone’s dishonesty.

[Big Clive]’s subsequent teardown of the unit showed that remarkably little is needed to spoof a CAN bus odometer. The board has little more than an STM32F microcontroller, a pair of CAN bus transceiver chips, and some support circuitry like voltage regulators. Attached to a wiring harness that passes through most of the lines from the instrument cluster unmolested while picking off the CAN bus lines, the device can trick the dashboard display into showing whatever number it wants. The really interesting bit would be the code, into which [Clive] does not delve. That’s a pity, but as he points out, it’s likely the designers set the lock bit on the microcontroller to cover their tracks. There’s no honor among thieves.

We found this plunge into the dark recesses of the automotive world fascinating, and [Big Clive]’s tutelage top-notch as always. If you need to get up to speed on CAN bus basics, check out [Eric Evenchick]’s series on automotive network hacking.

Continue reading “Dashboard Dongle Teardown Reveals Hardware Needed To Bust Miles”

Custom CAN System Logs Motorcyle Data Like Magic

RW-2x_on_stand_at_TRC

A student team at Ohio State University has designed and built a custom Controller Area Network (CAN) data acquisition system complete with a sensor interface, rider display, and a Linux-based data logger for a RW-2x motorcyle.

They call their small, convenient micro-controller circuit board the Magic CAN Node, and it measures automotive sensors throughout the electric vehicle. This includes a variety of thermistor resistors to check changes in temperature. A few 0-5V and 0-12V sensors to monitor brake pressure transducers along with some differential air pressure sensors can be added too. Since the vehicle is basically a “rolling electromagnetic noise bomb”, they wanted to keep all of these analog sensors as close to the source as possible.

The Magic CAN Node is based on a Texas Instruments microcontroller called the TMS320F28035. This keeps the energy consumption at a low level.

For message handling, the team, led by [Aaron], tapped into the built-in CAN module within the F28035. All of the CAN plugs have two of the pins shorted to GND or +12V, so when there’s only one plug connected, the analog switch IC will connect a 120 ohm resistor across the CAN lines.

Continue reading “Custom CAN System Logs Motorcyle Data Like Magic”