Penetration Testing for ECUs

#!/usr/bin/env python3
import can, time

def enumerate_ecus(iface="vcan0") -> dict:
    # Broadcast UDS 0x22/0xF18B to enumerate responding ECUs on bus
    bus = can.interface.Bus(iface, bustype="socketcan")
    ecus = {}

    # Functional address 0x7DF → all ECUs respond with physical address 0x7E8+
    frame = can.Message(arbitration_id=0x7DF,
                        data=[0x03,0x22,0xF1,0x8B,0,0,0,0],
                        is_extended_id=False)
    bus.send(frame)

    deadline = time.time() + 0.2
    while time.time() < deadline:
        msg = bus.recv(timeout=0.01)
        if msg and 0x700 <= msg.arbitration_id <= 0x7FF and msg.data[1] == 0x62:
            addr = msg.arbitration_id - 0x40
            ecus[hex(addr)] = {"response_id": hex(msg.arbitration_id),
                               "mfg_date": msg.data[3:9].hex()}
            print(f"  ECU at {hex(addr)}: DID F18B = {msg.data[3:9].hex()}")
    bus.shutdown()
    return ecus

# After ECU enumeration: document each interface, protocol, observed services,
# and authentication state → input to exploitation phase

#!/usr/bin/env python3
findings = [
    {"id":"PT-001",
     "title":"DoIP RoutingActivation without mTLS",
     "severity":"Critical","cvss":9.8,
     "cwe":"CWE-306 Missing Authentication",
     "tara_ref":"TS-09","status":"Open","fixed":False,
     "fix":"Enforce TLS 1.3 + mandatory OEM client certificate for RoutingActivation"},

    {"id":"PT-002",
     "title":"SecOC 24-bit truncated MAC on ASIL C powertrain PDU",
     "severity":"High","cvss":7.4,
     "cwe":"CWE-327 Weak Cryptographic Algorithm",
     "tara_ref":"TS-11","status":"Fixed v3.3.0","fixed":True,
     "fix":"SecOCAuthInfoTruncLength increased from 24 to 48 bits"},

    {"id":"PT-003",
     "title":"JTAG debug port active on production ECU",
     "severity":"Critical","cvss":9.0,
     "cwe":"CWE-1191 On-Chip Debug/Test Interface With Improper Access Control",
     "tara_ref":"Physical access threat","status":"Open","fixed":False,
     "fix":"Disable JTAG in production via fuse; verify with JTAG probe rejection test"},
]

for f in findings:
    icon = "✓" if f["fixed"] else "⚠️"
    print(f"[{icon}] {f['id']} [{f['severity']}] CVSS {f['cvss']}: {f['title']}")
    print(f"    Fix: {f['fix']}")
    print(f"    TARA: {f['tara_ref']} | {f['status']}")
    print()

open_critical = [f for f in findings if not f["fixed"] and f["severity"]=="Critical"]
print(f"{len(open_critical)} open Critical finding(s) -- block SOP until resolved")