Security access seed randomness analysis about caringcaribou

[kasperkarlsson]

Hello @Cr0wTom - if you have developed a module for Caring Caribou, feel free to send a pull request!

Assuming that your module follows the tool's coding standard (e.g. by using built-in CC modules where applicable and being compatible with both Python 2.7 and 3.x), it can likely be accepted quickly 🙂

[bhass1]

+1 this feature. Would love to help when I get some more time and the weather gets nice enough for me to sit in my car.

To handle ECUs that only renew their seeds on boot (which is becoming much more common), you could send a UDS ECUReset message to cause a hard-reset. I believe the payload is: 02 11 01 00 00 00 00 00.

Another sub-feature I would like to see is attempting to send a random key (Send Key) in response to the Request Seed response. It's a simple pen-test to check if the keys are actually being checked. Probably low priority though because most ECUs will have an actual check in place.

[kasperkarlsson]

@bhass1 These ideas sound great and your help would of course be welcome. If you do implement a module, just send a pull request and we will look into it!

If you happen to find specific use cases which are only valid for a certain vendor or product line/vehicle series, this could also be of interest. While this enhancement proposal issue considers a generic module, a vendor specific analysis module could also prove useful to other CC users.

[bhass1]

FYI, I have code to perform seed dump in a private branch. It has been tested on a bench module. Waiting for company approval to submit.

I'm working on a few other features that I hope to open issues for and submit.. eventually :).

[kasperkarlsson]

That sounds great, @bhass1! I'll keep my fingers crossed for your company's approval of sending a PR 👍

[Cr0wTom]

Hello, I implemented a seed randomness fuzzer, that I would be happy to share with the community. If someone is interested, you can find it here. Please contact me for more, and let me know if you are interested in hosting it in the master repo :)

It's the module uds_fuzz.

[Cr0wTom]

#70 pull request regarding seed randomness fuzzer for ECUs where the random number generator is seeded with the system timer. :)

[kasperkarlsson]

Implemented in #70.