Inside A CAN Bus Mileage Manipulator

In the days of carburetors and leaf spring suspensions, odometer fraud was pretty simple to do just by disconnecting the cable or even winding the odometer backwards. With the OBD standard and the prevalence of electronics in cars, promises were made by marketing teams that this risk had all but been eliminated. In reality, however, the manipulation of CAN bus makes odometer fraud just as easy, and [Andras] is here to show us exactly how easy with a teardown of a few cheap CAN bus adapters.

We featured another project that was a hardware teardown of one of these devices, but [Andras] takes this a step further by probing into the code running on the microcontroller. One would imagine that basic measures would have been taken by the attackers to obscure code or at least disable debugging modes, but on this one no such effort was made. [Andras] was able to dump the firmware from both of his test devices and start analyzing them.

Analyzing the codes showed identical firmware running on both devices, which made his job half as hard. It looked like the code was executing a type of man-in-the-middle attack on the CAN bus which allowed it to insert the bogus mileage reading. There’s a lot of interesting information in [Andras]’s writeup though, so if you’re interested in CAN bus or attacks like this, it’s definitely worth a read.

Turn By Turn Driving Directions From A Turntable

Many of us now carry a phone that can give us detailed directions from where we are to a destination of our choosing. This luxury became commonplace over the last decade plus, replacing the pen-and-paper solution of consulting a map to plan a trip and writing down steps along the way. During the trip we would have to manually keep track of which step we’re on, but wouldn’t it have been nice to have the car do that automatically? [Ars Technica] showed us that innovators were marketing solutions for automatic step by step driving directions in a car over a 100 years ago.

Systems like the Jones Live-Map obviously predated GPS satellites, so they used vehicle odometry. Given a starting point and a mechanical link to the drivetrain, these machines can calculate miles traversed and scroll to the corresponding place in the list of instructions. This is a concept that has been used in many different contexts since, including the “Next Bus in 7 Minutes” type of display at bus stops. Because a bus runs a fixed route, it is possible to determine location of a bus given its odometer reading transmitted over radio. This was useful before the days of cheap GPS receiver and cellular modems. But the odometry systems would go awry if a bus rerouted due to accidents or weather, and obviously the same would apply to those old school systems as well. Taking a detour or, as the article stated, even erratic driving would accumulate errors by the end of the trip.

The other shortcoming is that these systems predated text-to-speech, so reading the fine print on those wheels became a predecessor to today’s distracted driving problem. One of the patent diagrams explained the solution is to hand the device to a passenger to read. But if there’s a copilot available for reading, they can just as easily track the manual list of directions or use a map directly. The limited utility relative to complexity and cost is probably why those systems faded away. But the desire to solve the problem never faded, so every time new technology became available, someone would try again. Just as they did with a tape casette system in the 1970s and the computerized Etak in the 1980s.

[Photo by Seal Cove Auto Museum]

Dashboard Dongle Teardown Reveals Hardware Needed To Bust Miles

Progress and the proliferation of computers in automotive applications have almost made the shade tree mechanic a relic of the past. Few people brave the engine compartment of any car made after 1999 or so, and fewer still dive into the space behind the dashboard. More’s the pity, because someone may be trying to turn back the odometer with one of these nefarious controller area network (CAN bus) dongles.

Sold through the usual outlets and marketed as “CAN bus filters,” [Big Clive] got a hold of one removed from a 2015 Mercedes E-Class sedan, where a mechanic had found it installed between the instrument cluster and the OEM wiring harness. When the dongle was removed, the odometer instantly added 40,000 kilometers to its total, betraying someone’s dishonesty.

[Big Clive]’s subsequent teardown of the unit showed that remarkably little is needed to spoof a CAN bus odometer. The board has little more than an STM32F microcontroller, a pair of CAN bus transceiver chips, and some support circuitry like voltage regulators. Attached to a wiring harness that passes through most of the lines from the instrument cluster unmolested while picking off the CAN bus lines, the device can trick the dashboard display into showing whatever number it wants. The really interesting bit would be the code, into which [Clive] does not delve. That’s a pity, but as he points out, it’s likely the designers set the lock bit on the microcontroller to cover their tracks. There’s no honor among thieves.

We found this plunge into the dark recesses of the automotive world fascinating, and [Big Clive]’s tutelage top-notch as always. If you need to get up to speed on CAN bus basics, check out [Eric Evenchick]’s series on automotive network hacking.

Continue reading “Dashboard Dongle Teardown Reveals Hardware Needed To Bust Miles”

Retrotechtacular: Car Navigation Like It’s 1971

Anyone old enough to have driven before the GPS era probably wonders, as we do, how anyone ever found anything. Navigation back then meant outdated paper maps, long detours because of missed turns, and the far too frequent stops at dingy gas stations for the humiliation of asking for directions. It took forever sometimes, and though we got where we were going, it always seemed like there had to be a better way.

Indeed there was, but instead of waiting for the future and a constellation of satellites to guide the way, some clever folks in the early 1970s had a go at dead reckoning systems for car navigation. The video below shows one, called Cassette Navigation, in action. It consisted of a controller mounted under the dash and a modified cassette player. Special tapes, with spoken turn-by-turn instructions recorded for a specific route, were used. Each step was separated from the next by a tone, the length of which encoded the distance the car would cover before the next step needed to be played. The controller was hooked to the speedometer cable, and when the distance traveled corresponded to the tone length, the next instruction was played. There’s a long list of problems with this method, not least of which is no choice in road tunes while using it, but given the limitations at the time, it was pretty ingenious.

Dead reckoning is better than nothing, but it’s a far cry from GPS navigation. If you’re still baffled by how that cloud of satellites points you to the nearest Waffle House at 3:00 AM, check out our GPS primer for the details.

Continue reading “Retrotechtacular: Car Navigation Like It’s 1971”

Racking Up Miles On A Bicycle Odometer

[jonh] religiously tracks the miles he rides on his bicycle. When his odometer’s battery started getting low, he wanted a way to run the miles up to where they were before, since replacing the battery resets everything to zero. [jonh] used an Atmel microcontroller to run up the miles on his bike computer so he could pick right back up where he left off. There is definitely a Ferris Bueller’s Day Off joke in here somewhere.

The bike computer itself is designed to plug into a base that connects to a magnet-triggered reed relay. It uses a wheel-mounted magnet to count the number of revolutions made and thus the distance traveled. [jonh] hooked up a simple microcontroller-driven circuit to these connectors to trick the bike computer into thinking it was moving, and moving fast! Since he knew the number of miles he wanted to sandbag onto the odometer, he was able to program it to run up the proper amount of miles and then stop. There’s no source code listing for the project, but this shouldn’t be too hard to reproduce. He provides a pencil-drawn schematic for the connection to the cyclometer from the microcontroller. At the end, there’s also some sage advice for those of you who are interested in building a decent hardware hacking lab on the cheap.

Make Your Own Odometer From Scraps

For those out there who would enjoy a quick and interesting weekend project, this odometer made by [PeckLauros] is for you. Featured on Instructables it is made from the simplest of materials including some cardboard, a calculator, wires, glue, hot glue, magnetic drive key, an old CD and a reader, and a rubber band.  The magnets, when attached to the CD work in a calculation to add 0.11m to the calculator when a magnet closes the circuit. [PeckLauros] points out that since it is a homebrewed device, it does have flaws such as adding 0.11m twice when the CD is rotated too slowly.  It is easily fixed by simply running faster.  The video is below the break.

Continue reading “Make Your Own Odometer From Scraps”