▲ Training · Hands-on

Training.

We provide a three or four day hands-on training, see details below. Please contact us for more information.

Request a training →
Format
3–4 days
Hands-on labs with real ECUs
Group size
5+
Location
On-site or Gouda, NL
Willem presenting an automotive security training to a room of participants.

Private offerings

This training can be offered privately for groups of five or more. Training can be taken at our location in Gouda, The Netherlands, or we can come to you so you don't have to worry about traveling.

Public offerings

Current public offerings:

  • There are currently no public offerings planned.

To stay up to date with any public trainings, you can sign up to our mailing list.

What to expect | Key learning objectives

Interested in opening up a car hacker's toolbox and applying these tools and techniques hands-on? Then this training is the best fit for you!

In this course, the participant will become familiar with the theory and practice around numerous techniques in automotive security. This allows the participant to see what's in a car hacker's toolbox, and how to mitigate possible security vulnerabilities.

The trainee will learn how to leverage open source tools to perform an analysis of various aspects of the modern car. Everything from attacks on the physical layer and diagnostic protocols to the reverse engineering of firmware will be covered.

Various simulated networks and real Electronic Control Units (ECUs) will be available to practice on. Based on experience level, different ECUs and challenges will be available.

Due to the wide variety of hands-on exercises, the training is suitable for both beginners and people more experienced with automotive (security). It's the ideal method for security researchers to become familiar with the automotive domain, and be able to start a real project in the span of a few days.

Overview

Training overview

The training is split across three or four days. Each day combines theory with hands-on labs on real ECUs. Below is a summary of the key topics covered.

Topics

  • Attacks on the communication networks found in cars, such as spoofing, DOS and MITM and their mitigations.
  • Overview of diagnostic protocols such as UDS and CCP/XCP and their security features.
  • Various methods to obtain firmware files, and how these files can be protected.
  • Reverse engineering of automotive firmware. Learn how to quickly identify the relevant part of an ECUs firmware.
01

Day 1 - Vehicle Networks and Tools

Day 1 of the training will be used to become familiar with the standards used for the communication between Electronic Control Units (ECUs) in a vehicle. Attacks on the physical and link layer will be discussed, and their possible detection and mitigation.

In the second part of the day, we will look at hardware used to interact with the vehicle’s network, and implement our first attack.

Theory

  • Introduction to a typical modern car network layout and gateways found within.
  • Physical and link layer standards such as CAN, CAN-FD, LIN, FlexRay and Automotive Ethernet.
  • Where to find schematics and how to interpret them, look at available OEM software for repair shops.
  • Hardware attacks on these networks and possible mitigation strategies.
  • Real world examples of CAN traffic including integrity checks such as counters and checksums
  • Recent developments in cryptography for automotive networks (SecOC).
  • Hardware used to interact with the vehicle’s network.

Hands-On

  • Introduction to analyzing CAN traffic using Wireshark and cabana.
  • Find signals on CAN bus and create a DBC file.
  • Connect to a CAN bus using your computer, and perform an attack on the physical layer.
  • Reverse engineer a checksum algorithm and spoof a message
02

Day 2 - Diagnostic Protocols and Hardware

On the second day of the training, we will dive into the actual hardware of a car and its ECUs. You’ll learn how to find the schematics of a certain car, and identify the best points to connect to the different networks. We will look at software provided to repair shops by the manufacturer

Theory

  • Diagnostic protocols such as OBD-II, KWP2000 (ISO 14230-3), Unified Diagnostic Services (UDS, ISO 14229-1) and Can Calibration Protocol (CCP/XCP).
  • Discuss different microcontroller architectures commonly used in ECUs.
  • PCB reverse engineering, extract firmware from ECU using debug probe.
  • Fault injection attacks against automotive microcontrollers.

Hands-On

  • Implement a scanner to identify available UDS endpoints.
  • Find and communicate with CCP/XCP endpoints.
  • Communicate using Diagnostics over IP (DoIP)
  • Extract ECU firmware using various methods
03

Day 3 - Reverse Engineering

Different firmware update files and their protections will be discussed. We will also look at the inside of an ECU and ways to extract its firmware. A quick introduction to Ghidra will be given.

An ECU firmware file consists of up to millions of lines of code which would take a long time to fully reverse engineer. Tips and tricks will be taught to quickly identify parts of the firmware that are of interest. After reverse engineering the security access algorithm we can flash the firmware back to the ECU.

Theory

  • Extract firmware from manufacturer update file.
  • UDS update/flashing procedures.
  • Fault injection techniques
  • Introduction to Ghidra.
  • Identify processor architecture and load firmware into Ghidra.
  • Common patterns used in automotive firmware.
  • Firmware integrity checks: checksums and secure boot.

Hands-On

  • Reverse engineer an ECUs security access algorithm.
  • Write your own tool to flash the firmware onto an ECU.
04
(optional)

Day 4 - RF Hacking using Software Defined Radio

On the last day of the training we will look into all things wireless. Using a Software Defined Radio (SDR) we will interact with different parts of the vehicle. We will look into how tire pressure monitoring systems work. Recent developments in FM radio have opened up a whole new wireless attack surface.

We will also look at the different kinds of attacks on keyfobs. Finally we will learn about how the powerline communication between EV and charging station (EVSE) can be monitored with an SDR to leak personal information, and can be disrupted.

Theory

  • How do Tire Pressure Monitoring System (TPMS) sensors communicate
  • Attack surfaces on modern FM radio’s (RDS, HD Radio, DAB+)
  • Attacks on keyfobs
  • Powerline Communication between EV and charging station

Hands-On

  • Receive and spoof a TPMS sensor
  • Various attacks on keyfobs

Who should attend? | Target audience

  • Security researchers interested in automotive
  • Engineers interested in developing aftermarket automotive products
  • Automotive engineers/suppliers
  • Hackers interested in learning more about their own car

What to bring? | Hardware

All hands-on exercises will be done on a Raspberry Pi running Jupyter Notebooks.

Required hardware:

  • Laptop with functional ethernet port. If your laptop does not have a built-in ethernet port, make sure to bring your own USB adapter.
  • Latest version of Ghidra Installed (including required Java JDK)
  • Windows/MacOS/Linux are all fine

What to bring? | Knowledge

  • Experience with hardware and microcontrollers
  • Python programming experience
  • Basic reverse engineering knowledge preferred, but not mandatory

Resources provided at the training

  • Each trainee will work on many real ECUs.
  • 30+ Capture the Flag style challenges that can be used to put theory into practice
  • A USB to CAN adapter will be provided for use during the training
  • Syllabus that can be used as a reference during the hands-on part of the course, and contains some extra material not covered in the slides.
Portable training setups organized in a hard case with adapters and electronics.

Experience from previous participants

I can't imagine a more productive three days to dive into the field of automotive security.
Willem's training saved us valuable time on getting up to speed with automotive security. The training focuses on hands-on experience against real automotive ECU's. Adding to this the trainer's extensive knowledge on car hacking made this training an excellent experience.
I attended the Practical Car Hacking training by Willem and I consider it to be a great foundation for my car hacking knowledge. I now feel like I have the required expertise to perform a real-life assessment on the security of a car, despite knowing little about car hacking before attending the training.
The best training I have taken at Black Hat.
I recently attended the three-day car hacking course that was not only a worthwhile way to end my week but also proved to be an excellent introduction to the world of practical car hacking, even for someone without prior experience. The course struck a perfect balance between theory and hands-on learning, ensuring accessibility for all participants. The practical challenges were thoughtfully designed, and Willem's knowledge and passion for the subject matter made the learning experience engaging. I highly recommend this course for anyone interested in Car hacking, as it provided both valuable skills and a newfound appreciation for the field.
The course for the training was very informative and useful to understand the networking within a car and how an attacker can abuse it. This was a very fun course especially the hands on challenges using the tools comma ai, Cabana, and reversing using Ghidra to solve challenges that involved ECUs from Tesla model 3, Volkswagen Golf, Hyundai Sonata, etc. I highly recommend it for anyone who is curious about automotive hacking.
As a noob to car hacking and associated concepts like reverse engineering this course provided me with a fantastic understanding of in car networks, protocols and tools required for vehicle ECU hacking. The hands on labs/CTFs were expertly put together and a pleasure to work through.
I loved that the course goes into detail really quickly and covers a lot of real life scenarios. The primary focus was hands on training, and it covered all the theory topics. I would recommend to anyone looking to expand their knowledge in the different attack vectors of car hacking.
A great hands-on training where you get to work with actual car-parts. The 3-day training thought me the necessary skills to further develop in this field on my own.
I really enjoyed the training. The hands-on assignments were well thought out and learned more in-depth how ECUs operate and communicate.

About the trainer

Willem Melching (https://twitter.com/PD0WM) is an independent security researcher and 3x Black Badge winner of the DEF CON Car Hacking Village CTF. He has over 7 years of experience working on automotive security and reverse engineering. During his time at comma.ai he worked on an aftermarket ADAS device and providing open source tools to help the community reverse and interact with a wide variety of cars.

Request a training

Private sessions from 5 participants. On-site at your location or at our lab in Gouda, NL. 3 to 4 days.

Request a training →