Mobilized Immobilizer: Bypassing Motorcycle Security

Mobilized Immobilizer: Bypassing Motorcycle Security

Speakers: Scott Sheahan, Owner and Principal Consultant, Rustic Security

Conference: Hardwear.io USA

YouTube: https://www.youtube.com/watch?v=5AIbVJ2FdVI

Overview

In "Mobilized Immobilizer: Bypassing Motorcycle Security," Scott Sheahan, Owner and Principal Consultant at Rustic Security, presents compelling research into the vulnerabilities of modern motorcycle security systems. The talk details his journey from a defensive cybersecurity role to an offensive embedded penetration tester, using his personal Indian Scout Bobber motorcycle as a target. Sheahan systematically dissects the bike's "tech package," exposing critical weaknesses in its electronic immobilizer system.

The presentation highlights how seemingly advanced features, such as smart keys and PIN entry, can mask fundamental cryptographic flaws that enable a determined attacker with physical access to bypass security controls and steal the vehicle. Sheahan’s work provides a stark reminder that the integration of digital technology into physical devices, while offering convenience, often introduces complex security challenges that are poorly addressed by manufacturers. This research is particularly significant for automotive and motorcycle original equipment manufacturers (OEMs), security professionals, and vehicle owners, demonstrating the real-world implications of insecure embedded system design.

The core contribution of this talk lies in its practical demonstration of how an attacker can leverage weak cryptographic primitives (specifically XOR-based authentication), physical access, and CAN bus manipulation to compromise a vehicle's primary security mechanism. Sheahan not only identifies these vulnerabilities but also builds a proof-of-concept hardware implant to illustrate a complete, end-to-end theft scenario. His findings underscore the urgent need for a shift towards robust, modern cryptographic practices and comprehensive layered security in vehicle architectures.

Background

▶ Watch: Introduction to motorcycle security research (0:00)

Scott Sheahan's journey into motorcycle security was driven by a personal and professional quest. With a robust background in embedded device integration, having worked on projects ranging from the EA-18G Growlers' next-generation jammer in aerospace to developing car architecture at Ford and driver assistance modules at Aptiv, Sheahan had extensive experience in blue team (defensive) security. However, he yearned to transition into red team (offensive) penetration testing, a path that proved challenging within corporate structures. A layoff provided the catalyst, prompting him to embark on a do-it-yourself research project, combining a childhood dream of getting a motorcycle license with a professional goal of embedded pentesting.

His target was an Indian Scout Bobber with the "tech package," a modern motorcycle featuring electronic controls and connectivity. Sheahan began by establishing a dedicated research space in a converted pole barn, equipping it with essential tools like a logic analyzer, a CAN Pico (a Raspberry Pi Pico with a CAN transceiver), and a Kvaser Leaf Light for CAN bus sniffing and analysis.

The fundamental shift in vehicle security from older, purely mechanical systems to modern electronic ones forms the core context of his investigation. Historically, starting a motorcycle involved a simple mechanical key switch that completed a circuit, allowing current to flow to the starter relay and motor. Modern bikes, however, integrate an immobilizer system. This system involves multiple Electronic Control Units (ECUs) such as an Engine Control Module (ECM), a Power Control Module (PCM) (or Vehicle Control Module, VCM), and a dedicated Wireless Control Module (WCM) acting as the immobilizer. The WCM's role is to prevent the engine from starting until a successful authentication has occurred, typically via a smart key fob or a PIN entry on a digital display. This authentication usually involves a challenge-response protocol between the key/PIN interface and the immobilizer module.

Sheahan's initial disassembly of the bike revealed a complex Controller Area Network (CAN bus) architecture. The Indian Scout Bobber utilized four segmented CAN networks (A, B, C, D), bridged by a central CAN Gateway Module. Key components included a telematics control unit for cellular connectivity, a digital round display for user interface (including PIN entry), and the WCM, which directly communicated with the key fob via RF. The PIN input, routed through the digital round and gateway, also ultimately authenticated with the WCM. Understanding this intricate network and the roles of each module was the first step in identifying potential attack vectors.

Key Findings

▶ Watch: Uncovering XOR vulnerability for engine authentication (22:00)

Sheahan's dynamic analysis of the Indian Scout Bobber’s electrical system quickly uncovered several critical vulnerabilities. His methodology involved setting up wire breakout harnesses to tap into the CAN bus, allowing him to monitor and record network traffic during various operations, such as starting the bike with a key fob versus using the PIN.

1. CAN Bus Protocol Analysis: The bike utilized the J1939 protocol, a standard often found in heavy trucking, over a CAN 2.0B bus. This protocol uses 29-bit identifiers for message arbitration and addressing. Sheahan observed that the first two bytes of the identifier define message type and priority, while the last two bytes specify source and destination addresses for modules on the bus. This structure allowed him to map communication flows between ECUs.

1. Weak "Seed and Key" Authentication: A significant finding was the widespread use of a "seed and key" challenge-response mechanism, a common but often insecure legacy practice in automotive systems. In this protocol, one module (e.g., the WCM) requests a "seed" (a random nonce) from another (e.g., the ECM). The responding module then calculates a "key" (an access token) by applying a specific algorithm using a shared secret to the received seed. This key is sent back for verification. Sheahan identified two distinct, wrapped challenge-response protocols:

• Outer Authentication (WCM to ECM): This primary authentication sequence, essential for starting the engine, involved the Wireless Control Module (immobilizer) and the Engine Control Module.
• Inner Authentication (Infotainment to WCM for PIN): This sequence occurred when the user entered a PIN via the digital display, involving the infotainment system and the WCM.

1. XOR as the Cryptographic Primitive: The most severe vulnerability discovered was that both authentication protocols relied on XOR with a static secret for generating the "key." Sheahan determined this by observing multiple seed-key pairs and applying XOR, revealing consistent static secret values.

• For the WCM-to-ECM authentication, the static secret was identified as A6 FFFFFF E60D.
• For the PIN entry authentication (Infotainment to WCM), the static secret was 87FFFFFFF7CC.
• The implication of this is profound: seed XOR key = static_secret. If an attacker can observe just one legitimate seed-key exchange, they can immediately deduce the static secret. With this secret, they can then generate a valid "key" for any future seed, effectively bypassing the authentication. In the case of the PIN, Sheahan also found that the PIN itself was used in a trivial calculation (FFF - actual_PIN_hex_value) before being XORed, making it easily recoverable if observed.

1. Redundant but Bypassable Immobilization: Initial attempts to bypass the immobilizer by forging the WCM-ECM authentication (using the recovered XOR secret) allowed the engine to start but only for about one minute before it would shut down. This indicated additional, redundant security measures. Sheahan discovered two such mechanisms:

• Physical Wires: The WCM used specific physical wires (pins 7 and 8) connected to the Vehicle Control Module (VCM) to send a shutdown signal. Manipulating these wires (e.g., cutting them or keeping them low) could extend the run time, but not indefinitely. The VCM was specifically looking for a falling edge trigger to shut down; preventing this trigger prolonged operation.
• Network Shutdown Message: Even with the physical wires handled, the WCM would still send a CAN bus message to the VCM to initiate a shutdown if it didn't detect proper authentication. This revealed a networked redundancy for immobilization.

These findings collectively painted a picture of a security system that, while layered, was fundamentally weakened by poor cryptographic implementation and a lack of robust authentication on the CAN bus itself.

Technical Deep Dive

▶ Watch: Bypassing network-based immobilizer shutdown (30:00)

Sheahan's deep dive into the Indian Scout Bobber’s security architecture revealed a blend of standard automotive protocols and critical implementation flaws. The foundation of his attack relied heavily on understanding and manipulating the CAN bus.

The bike employs CAN 2.0B, which uses 29-bit identifiers. These identifiers are crucial for arbitration on the shared bus, where lower IDs have higher priority. The J1939 protocol, a high-level protocol often used in heavy-duty vehicles, was layered on top of CAN. Within the 29-bit identifier, Sheahan observed that the top two bytes often indicated the message type and priority, while the last two bytes were used for source and destination addressing. For instance, module 00 typically represented the Engine Control Module (ECM), and 1D was identified as the Wireless Control Module (WCM), the primary immobilizer.

The core vulnerability revolved around the "seed and key" challenge-response protocol used for authentication between modules. This protocol works as follows:

1. Seed Request: Module A (e.g., WCM) sends a message requesting a "seed" (a random nonce) from Module B (e.g., ECM).
2. Seed Transmission: Module B generates a random seed and sends it back to Module A.
3. Key Calculation: Module A, possessing a shared secret or a known algorithm, performs an operation on the received seed to calculate an expected "key" (an access token).
4. Key Transmission: Module B also performs the same operation using its internal shared secret and the seed. It then sends its calculated "key" to Module A.
5. Verification: Module A compares the received key from Module B with its own calculated expected key. If they match, authentication is successful.

Sheahan discovered that the "operation" performed to generate the key was a simple XOR function using a static secret. This is a severe cryptographic weakness because if an attacker observes just one legitimate seed (S) and its corresponding key (K), they can easily derive the static secret (X) as S XOR K = X. Once X is known, the attacker can then generate a valid key for any new seed S' by simply calculating S' XOR X.

He identified two distinct instances of this flawed challenge-response:

1. Outer Challenge-Response (WCM to ECM): This is the primary authentication that allows the engine to start. The WCM (source address 1D) asks the ECM (destination address 00) if it's unlocked. The ECM sends a seed (prefixed with DD). The WCM then calculates and sends back a key/token. By observing this exchange, Sheahan recovered the static secret: A6 FFFFFF E60D. With this secret, an attacker can impersonate the WCM and send a valid authentication token to the ECM, allowing the engine to start.

1. Inner Challenge-Response (Infotainment to WCM for PIN): This occurs when a user enters their PIN on the digital display. The infotainment system requests a seed from the WCM (prefixed with FD). The user's PIN is then used in a calculation involving another static secret (87FFFFFFF7CC) and XOR to generate the key sent back to the WCM. Sheahan discovered that the PIN was incorporated via a trivial FFF - actual_PIN_hex_value operation (where the PIN was a 4-digit number from 0000-9999). This means that if an attacker observes a single PIN authentication sequence, they can recover the user's PIN.

The initial bypass strategy, using the recovered A6 FFFFFF E60D secret to authenticate the ECM, allowed the engine to start but only for approximately one minute. This led Sheahan to uncover the redundant immobilization mechanisms:

• Physical Shutdown Wires: Pins 7 and 8 from the WCM connected to the VCM. These wires would transition from high (12V) to low (0V) to signal a shutdown. Sheahan found that physically cutting these wires prevented the falling edge trigger, extending the engine's run time but not eliminating the shutdown entirely.
• Networked Shutdown: The WCM, still recognizing an unauthorized start, would send a specific CAN message to the VCM to command a shutdown.

To overcome the networked shutdown, Sheahan devised a CAN bus Denial of Service (DoS) attack targeting the WCM. Using a CAN PICO (a Raspberry Pi Pico with a CAN transceiver) and the CAN Hack Toolkit, he configured the device to monitor for any messages originating from the WCM. When a WCM message was detected, the CAN PICO would immediately inject error frames onto the bus, effectively driving the bus low. This continuous injection of error frames causes the WCM's internal CAN transceiver to detect persistent errors, eventually leading it to enter an "error passive" or "bus off" state, where it stops participating in CAN communication. By forcing the WCM off the bus, its network-based shutdown messages were suppressed, preventing the VCM from receiving the command to kill the engine.

Finally, Sheahan also developed a Denial of Service (DoS) attack against the legitimate owner. By injecting a new seed request mid-authentication, the attacker could effectively "desynchronize" the authentication process. When the owner's key fob or PIN attempts to authenticate, the seed they received would be stale, and their calculated key would be invalid, preventing the bike from starting. This allows the attacker to immobilize the bike for the owner, making it ripe for theft later.

Demo / Proof of Concept

▶ Watch: Hardware implant installation and owner bypass (34:00)

Scott Sheahan demonstrated his proof-of-concept attack using a hardware implant designed to facilitate the bypass. The implant consisted of a CAN PICO (a Raspberry Pi Pico microcontroller with an attached CAN transceiver) powered by the bike's existing wiring harness via a 5-volt converter. This device, running a Python script, was capable of monitoring the CAN bus, performing the necessary authentication calculations, and executing the denial-of-service attacks.

The demonstration simulated a real-world theft scenario:

1. Implant Installation: The attacker first gains physical access to the bike, specifically under the seat where the Wireless Control Module (WCM) is located. Sheahan showed that the WCM was conveniently accessible. The attacker would disconnect the WCM from its wiring harness and then insert the custom hardware implant inline, effectively placing it between the WCM and the rest of the bike's electrical system. This allows the implant to intercept, observe, and inject CAN messages. The physical wires (pins 7 and 8) from the WCM to the VCM, responsible for the physical shutdown signal, would also be cut or manipulated as part of the implant’s setup. After installation, the implant and WCM are neatly tucked back under the seat, and the seat is re-secured.

1. Owner Immobilization: With the implant active, the legitimate owner returns to their bike. They use their key fob, the primary authentication method, to attempt to start the engine. However, due to the implant's pre-programmed Denial of Service (DoS) attack (e.g., injecting a new seed request during the WCM-ECM authentication), the owner's legitimate key fob authentication fails. The bike remains immobilized, displaying a message like "Pass Code." The owner, unable to start the bike, is forced to leave it to arrange for transport.

1. Attacker Takes Control: After the owner departs, the attacker returns. The attacker signals the implant to disable its DoS attack, for instance, by entering a specific sequence of joystick commands on the bike's handlebars (e.g., "up down up down"). With the DoS disabled, the implant then executes the final stages of the attack:

• It uses the previously recovered ECM secret (A6 FFFFFF E60D) to spoof the WCM and send a valid authentication token to the Engine Control Module (ECM), allowing the engine to start.
• Simultaneously, it initiates the CAN bus DoS against the WCM, preventing the WCM from sending its network-based shutdown messages to the Vehicle Control Module (VCM). This ensures the engine, once started, will not be shut down by the immobilizer system.

The demonstration concluded with the attacker successfully starting the bike, driving it off without the presence of the original key fob. Sheahan also highlighted an additional vulnerability: the ability to bypass the PIN screen entirely, allowing full access to the infotainment system while the bike was compromised. The entire sequence, from physical installation to driving away, showcased a complete, practical bypass of the motorcycle's security system.

Defensive Implications

▶ Watch: CVE disclosure and future research path (40:00)

Sheahan's research on the Indian Scout Bobber exposes several critical security deficiencies that extend beyond motorcycles to many modern embedded systems. Addressing these flaws requires a multi-faceted approach from manufacturers and a heightened awareness from users.

1. Robust Cryptographic Primitives: The most glaring vulnerability is the reliance on XOR for authentication secrets. XOR is not a cryptographic primitive suitable for securing authentication in any modern system. Manufacturers must transition to strong, industry-standard cryptographic algorithms such as AES-128 (or higher), HMACs, or digital signatures for all challenge-response protocols and key management. Shared secrets should be derived using secure key exchange protocols and protected against observation and brute-force attacks.

1. Secure CAN Bus Communication: The CAN bus, often treated as a trusted network, is highly vulnerable to sniffing, replay, spoofing, and denial-of-service attacks without proper security mechanisms. Critical messages, especially those related to authentication, immobilization, and vehicle control, must be authenticated and encrypted. Solutions like CANsec or MAC-based authentication (e.g., using a rolling message counter and a shared key) should be implemented to ensure message integrity and authenticity, preventing attackers from injecting forged commands or suppressing legitimate ones.

1. Layered Security with Strong Interdependencies: While the bike had redundant immobilization mechanisms (physical wires and network messages), these layers were ultimately undermined by a single point of failure: the weak cryptographic authentication. Each security layer must be robust and independently secure. If one layer is bypassed, the subsequent layers should still provide meaningful protection, ideally relying on different cryptographic principles or physical mechanisms. For instance, even if the CAN bus is compromised, a tamper-resistant hardware security module (HSM) should protect cryptographic keys and prevent engine startup.

1. Physical Security of Critical Modules: The attack required physical access to the Wireless Control Module (WCM) to install the implant. Manufacturers should design vehicles with physical security in mind:

• Tamper-Resistant Enclosures: Critical modules like the WCM should be housed in tamper-evident or tamper-resistant enclosures, making unauthorized access difficult to conceal.
• Secure Mounting: Modules should be mounted in hard-to-reach locations, requiring significant effort and time to access.
• Secure Harnesses: Wiring harnesses for critical modules should be protected, making it difficult to cut or splice wires without extensive disassembly.

1. Protection Against Observer-Based PIN Recovery: The ability to recover a user's PIN by observing a single authentication sequence on the CAN bus is a severe privacy and security flaw. PINs, like passwords, should never be transmitted or processed in a way that allows their recovery from network traffic. PIN entry mechanisms should use hashed or salted PINs for authentication, and the cryptographic operations should be robust against reverse engineering.

1. Secure Boot and Firmware Integrity: While not directly exploited in this talk, the ability to install a hardware implant often leads to opportunities for firmware modification. Implementing secure boot processes and ensuring firmware updates are cryptographically signed and verified by the hardware can prevent unauthorized code execution and modification of security logic.

1. Threat Modeling and Penetration Testing: Manufacturers must perform rigorous threat modeling and independent penetration testing on their embedded systems throughout the development lifecycle. Relying on legacy practices or assuming security by obscurity is insufficient. Automotive and motorcycle OEMs should engage with expert security researchers and adopt industry best practices for embedded device security.

1. User Awareness: While the primary responsibility lies with manufacturers, users should also be aware of the limitations of their vehicle's security. Relying solely on the electronic immobilizer might not be enough. Supplementary physical security measures, such as disc locks, chain locks, or secure garaging, remain important deterrents against theft.

The seven CVEs disclosed as a result of Sheahan's research underscore the severity and widespread nature of these issues. This work serves as a crucial call to action for the automotive and motorcycle industries to modernize their embedded security practices.

Key Takeaways

• Modern "Tech" Doesn't Equal Modern Security: The presence of digital displays, smart keys, and connectivity in vehicles does not automatically imply robust security. Underlying architectures may still rely on outdated and weak cryptographic practices.
• XOR is Not a Cryptographic Primitive: Relying on simple XOR operations with static secrets for authentication is a severe cryptographic flaw. Observing just one legitimate exchange allows an attacker to derive the secret and forge future authentications.
• Physical Access is a Gateway to Deeper Compromise: While often considered an advanced attack, physical access to embedded systems can quickly lead to full compromise if internal security mechanisms (like CAN bus communication and cryptographic implementations) are weak.
• CAN Bus Security is Paramount: The Controller Area Network (CAN bus) is often an overlooked attack surface. Without proper message authentication and encryption, it's vulnerable to sniffing, replay, spoofing, and denial-of-service attacks that can bypass critical security functions.
• Layered Security Requires Strong Implementation at Each Layer: The presence of redundant security mechanisms is beneficial, but each layer must be robustly implemented. A weakness in a fundamental layer (like cryptography) can undermine all subsequent layers.
• Dynamic Analysis and Custom Tooling are Essential for Embedded Pentesting: Effective embedded security research often requires hands-on dynamic analysis, custom hardware (like the CAN Pico), and specialized software to understand and manipulate low-level protocols.

About the Speaker(s)

Scott Sheahan is the Owner and Principal Consultant at Rustic Security. His career trajectory showcases a deep expertise in embedded systems and security across various high-stakes industries. He began in the aerospace industry, working on advanced projects like the next-generation jammer for EA-18G Growlers, focusing on embedded development. He then transitioned into the automotive sector, contributing to Ford's cybersecurity team and developing car architectures post-2015, followed by work on driver assistance modules at Aptiv. Before founding Rustic Security, he also worked on security for autonomous delivery bots at Nuro.

Sheahan's talk at Hardwear.io USA was particularly significant as it marked a personal and professional milestone: his successful transition from a "blue team" (defensive security) role to a "red team" (offensive security/penetration testing) expert. This research project, undertaken after a layoff, allowed him to combine his passion for motorcycles with his deep technical skills to explore embedded system vulnerabilities from an attacker's perspective. His work on the Indian Scout Bobber led to the disclosure of seven CVEs, solidifying his expertise in automotive and embedded security research. Sheahan expressed gratitude for achieving his goal and looks forward to continuing to dismantle security defenses in various devices.