Lion Cipher Lab
Inject and fuzz CAN frames to spoof a gauge and jam the bus — automotive attacks, Part 2
- SOC Analyst / Blue Team
- Intermediate
- ~60 min
- Free · no account required
Why it matters
Replaying a whole capture is loud and blunt. Real automotive attacks are surgical: an attacker finds the one message that controls a target function and forges exactly that, or floods the bus to deny a safety-critical signal. In 2015 Charlie Miller and Chris Valasek did precisely this to an unaltered Jeep over the internet — injecting crafted CAN frames to affect steering, brakes and the dashboard — which triggered a 1.4-million-vehicle recall. Feeling targeted injection and a bus flood in your own hands, then building the detection mindset a SOC uses to catch them, is how you understand why…
What you'll learn
- isolating a target CAN arbitration ID by diffing captures
- forging a single CAN frame with cansend to spoof a gauge
- bus flooding / denial-of-service with cangen and CAN arbitration
- why lower-ID frames win the bus (priority arbitration)
- CAN intrusion detection: cadence baselining and anomaly flags
- message authentication (AUTOSAR SecOC: MAC + freshness) vs. encryption
Steps in this lab
- Read this first — the same one rule as Part 1
- Recap: re-establish the virtual bus and ICSim
- Capture while you operate ONE control
- Diff the capture to isolate the target ID and bytes
- Forge ONE frame with cansend and watch the gauge jump
- Flood the bus: a denial-of-service on a safety-critical network
- The defender's view: detecting injection and flooding
- What actually stops it: authentication, freshness, segmentation
- What you did, and why it matters