“I can see you've got your motor running. But don't you feel I am just behind the wheels and control your car without your awareness?” This scene sounds scary. More and more people are talking about car hacking, e.g. Blackhat/DEFCON 2013 and Syscan 2014. CAN (Controller Area Network) is the most used protocol in the auto industry. It is based on broadcast bus, which means all message packets are sent to all ECUs. Long time ago, CAN-based automotive system is isolated and safe. Nowadays, advanced diagnostics enables cars to generate lots of profile data of engines and drivers, and submit them to the connected vehicle cloud. Meanwhile, with the fast evolvement of mobile technology, the number of mobile devices grows exponentially. When mobile connects both car and the vehicle cloud via mobile apps, the car becomes the new threat target. In this paper, we will show how to build the CAN Bus Firewall (CBF) to detect malicious injected commands and protect connected smart cars. In our knowledge, it is first time in the anti-malware industry to introduce auto anti-hacking solution. We will first go through how to reverse engineer a car by sharing our hands-on experiences with ECU, OBD2, CANBUS, how to get data from a car and send commands through OBD-2 ports to control cars, and how data transmitted on CAN bus among ECUs are monitored. We will also build up the car-hacking attack scenario database, and explain how to defend against each type of attack, including the attack scenes mentioned by other car-hacking researchers. Our firewall will filter messages and make sure that no hostile messages are going through and attacking the vehicle. Also it will block frames from unknown or untrusted sources, and set rate limitation to defend DoS attacks. The last but not the least, we also share our new research findings on security vulnerabilities of current commercial vehicle-related mobile products. Lots of vendors are offering vehicle diagnostic services and mobile apps, and they are actually selling good. Unfortunately, the security vulnerabilities existing inside these products will put users at high risks of personal privacy leakage and even human life! Note: our status: 1. We have successfully done with car reverse engineering and control experiments. 2. We are done with CBF firewall prototype. Differentiator with other car hacking research works at Blackhat and Syscan: v We are going to focus on anto-hack detection and prevention, instead of only hacking. v Our solution is able to evade their attack scenarios. v Our presentation also cover security issues of commercial auto-related mobile products, which are real threats in the real world. We will focus on more practices rather than theory. Here is one example to defend against one auto attack approach mentioned by Defcon 2013. Our firewall device applies white-list rules from ECU CAN ID (just like IP addresses on Internet). The firewall will monitor transmitted messages, and determine whether or not to block them by rule matching. ID 21 is for data stream message, and ID 13 is for error code IDH: 07, IDL: E0, Len: 08, Data: 05 31 01 40 44 FF 00 00 The Can ID is 0x07E0, which is for PCM (Power-train control module). It is for diagnosis, and it is fine for our diagnostic rule. However, 0x31 in red color is for auto controlling, StartRoutineByXXX, according to ISO14230-3. Therefore, this message cannot get through. Outline: 1. The security of embedded systems from car manufacturers; 2. Teach you how to reverse engineer a car with hands-on experiences: ECU, OBD2, CANBUS, etc. 3. Build auto reverse engineering testing environment step by step; 4. Demo: how to communicate with and control your car; 5. Present current attack scenarios against cars and the corresponding protection approaches; How to detect them by using our firewall; 6. Our new research findings on security vulnerabilities of current commercial vehicle-related mobile products; 7. Demo 8. Q&A