Lion Cipher Lab
Speak an ECU's language: UDS diagnostics over CAN (ISO-TP), the diagnostic session, and brute-forcing Security Access — automotive, Part 3
- SOC Analyst / Blue Team
- Intermediate
- ~75 min
- Free · no account required
Why it matters
Raw CAN injection (Parts 1 and 2) moves gauges, but the interesting, high-value functions of a car — reading VINs and fault codes, flashing firmware, unlocking a coding session, resetting an ECU — live one layer up, in the DIAGNOSTIC protocol every modern vehicle speaks: UDS over ISO-TP. That is the layer a mechanic's scan tool uses, and it is the layer an attacker abuses to reach privileged operations. The gatekeeper for those operations is UDS SecurityAccess, a challenge-response 'seed-key' unlock — and it is famous for being weak: real ECUs have shipped with 16-bit or even constant seeds…
What you'll learn
- what UDS (ISO 14229) is and how diagnostic services are addressed by SID
- why raw CAN needs ISO-TP (ISO 15765-2) and setting up the can-isotp kernel module
- entering an extended diagnostic session (0x10) and reading data by identifier (0x22)
- reading UDS positive (SID+0x40) vs negative (0x7F) responses
- the 0x27 SecurityAccess seed-key challenge and requesting a seed
- why a weak/short/fixed seed makes Security Access brute-forceable — and the entropy/lockout defenses that fix it
Steps in this lab
- Read this first — the one rule, same as Parts 1 and 2
- Recap and the big picture: from raw frames up to a diagnostic conversation
- Why ISO-TP exists — and load the can-isotp kernel module
- Bring up the virtual bus (vcan0)
- Install the diagnostic tooling: python-can and CaringCaribou
- Start the simulated ECU (your safe target)
- Discover which arbitration IDs answer diagnostics
- Enter an extended diagnostic session (SID 0x10) — and read a positive vs negative response
- Read data by identifier (SID 0x22) and reset the ECU (SID 0x11)
- Reach SecurityAccess (SID 0x27): request the seed and see the seed-key challenge
- Demonstrate the brute force — and understand exactly when it's feasible
- Do it better: entropy, lockout, and the truth about UDS 'security'
- What you did, and why it matters