Home

Awesome

Caring Caribou

A friendly automotive security exploration tool.

Rationale

This work was initiated as part of the research project HEAVENS (HEAling Vulnerabilities to ENhance Software Security and Safety), but lives on as a stand-alone project. We were lacking a security testing tool for automotive; a zero-knowledge tool that can be dropped onto any CAN network and collect information regarding what services and vulnerabilities exist. This project is a start.

Documentation

Get started

Install the tool:

python setup.py install

The best way to understand how to use Caring Caribou is to look at the help screen:

caringcaribou --help

This will list all available modules at the bottom of the output. Help for specific modules works the same way. For example, the help screen for the send module is shown by running

caringcaribou send --help

The module help always includes some usage examples. If the module has multiple sub functions, these have similar help screens as well:

caringcaribou send message -h
caringcaribou send file -h

More detailed usage information is available in the documentation on usage.

Features and Architecture

Caring Caribou is based on a main entry point in caringcaribou.py which runs the show. This enables an easy drop-in architecture for new modules, which are located in the caringcaribou/modules folder.

The caringcaribou/utils folder contains various higher level CAN protocol implementations and shared functions, meant to be used by modules.

The caringcaribou/tests folder contains automated test suites and /documentation stores documentation files (modules are also documented here).

List of Modules

A clean installation of Caring Caribou includes the following modules:

dump - Dump CAN traffic

Dumps incoming traffic to stdout (terminal output) or file

Details here: dump module

send - Send CAN packets

Raw message transmission module, used to send messages manually from command line or replay dump files

Details here: send module

listener - Listener

Lists all distinct arbitration IDs being used on the CAN bus

Details here: listener module

fuzzer - CAN fuzzer

Details here: fuzzer module

uds - Universal Diagnostic Services

Discovers and utilizes various ISO 14229-1 services.

Details here: uds module

uds_fuzz - Universal Diagnostic Services Fuzzer

Fuzzing module for UDS security seed randomness evaluation and testing.

Details here: uds_fuzz module

doip - Diagnostic communication over Internet Protocol

Discovers and utilizes various ISO 13400-2 services.

Details here: doip module

xcp - Universal Measurement and Calibration Protocol (XCP)

Details here: xcp module

dcm - [deprecated] Diagnostics Control Module

Note: This module has been replaced by the UDS module. It is still supported by CC due to legacy reasons.

Details here: dcm module

test - Run test suite

Runs automated Caring Caribou test suites

List of libraries/utilities

The caringcaribou/utils folder contains the following:

can_actions.py

Provides abstraction for access to the CAN bus, bruteforce engines etc.

common.py

Contains various common functions, type converters etc.

constants.py

Constant definitions

iso14229_1.py

Implementation of the ISO-14229-1 standard for Unified Diagnostic Services (UDS).

iso15765_2.py

Implementation of the ISO-15765-2 standard (ISO-TP). This is a transport protocol which enables sending of messages longer than 8 bytes over CAN by splitting them into multiple data frames.

Hardware requirements

Some sort of CAN bus interface (http://elinux.org/CAN_Bus#CAN_Support_in_Linux)

Software requirements

Extending the project with new modules

If your new module is located in caringcaribou/modules/foo.py you will run it with the command caringcaribou foo. Additional arguments (if any) are passed as arguments to the module_main function.

The target

The target ECU used for the development setup is an STM32F107 based dev-board from ArcCore called Arctic EVK-M3, but the tool can be used against any ECU communicating over a CAN bus.

Contributors