AI
CAN Address Claim: The Core Vulnerability
Controller area networks (CAN) use two wires and differential signaling for embedded devices. In the NMEA 2000 application layer, every node must claim a source address (0–253) by sending an address claim message with a name field. Conflicts are resolved by name priority: the lower name value wins. There is no authentication. A malicious node can claim the same address with a lower name value, and the legitimate node gets thrown off the network. That is the address claim attack.
Unlocked JTAG Opens the Autopilot
The team removed the autopilot PCB from its enclosure and identified the NMEA 2000 connector (CAN high, CAN low, power, ground). A 20‑pin header provided a JTAG programming port. They connected a J‑Link debugger and found the port was unlocked. That allowed them to extract the entire firmware binary, modify it, and upload a patched version. Live debugging and register inspection were also possible. A software update file was available online from the manufacturer.
Patching the Firmware and Injecting the Attack
Using Ghidra, they reverse‑engineered the firmware to locate the CAN send function. They patched the function to hard‑code an address claim message that steals address 0 from the engine controller. The patched binary was re‑encoded as an S‑record XML file, the same format used for official software updates. They saved the file to an SD card, inserted it into the chart plotter, selected the autopilot as target, and clicked upgrade. The update was sent over CAN without authentication.
Live Demo: Kicking the Engine Off the Network
On stage, the team showed a CAN dump from a simulator. Normal messages flowed from the engine controller (source ID 0). After the malicious update executed, the autopilot sent repeated address claim messages. The engine controller disappeared from the network. Any other controller sending messages to the engine (brake, transmission) would fail to reach it. Green and Chatterjee concluded by urging the maritime community to sign firmware, disable JTAG in production, encrypt firmware, and implement secure boot.
Q&A
How pervasive are these autopilots on massive ships? The same kind of autopilots are present on large vessels, but they may use different protocols and hardware architectures. ▶ 15:26
Are there hybrid devices that combine Wi‑Fi with CAN? Some aftermarket devices bridge Wi‑Fi and the NMEA 2000 network. The team has not tested standard equipment, but another student in their lab is exploring that vector. ▶ 17:59
Notable Quotes
there is no authentication Carson Green · ▶ 5:49
essentially you can steal someone else’s address Rik Chatterjee · ▶ 5:52
we have gained remote code execution on the autopilot Carson Green · ▶ 13:07
the engine gets kicked off the network Carson Green · ▶ 19:33
sign firmware, disable JAGs in production, possibly encrypt firmware, remove identifiers from PCB components, go through a secure boot process Rik Chatterjee · ▶ 14:08
Key Takeaways
- Address claim attacks exploit the lack of authentication in CAN‑based protocols.
- An unlocked JTAG port allowed full firmware extraction and modification.
- Malicious firmware can be uploaded via SD card without any signature verification.
About the Speaker(s)
Carson Green is a graduate research assistant in systems engineering from Colorado State University, with a bachelor’s degree in electrical engineering. He enjoys designing and debugging PCBs, researching vulnerabilities in cyber-physical systems, and can often be found playing the banjo.
Rik Chatterjee is a PhD student at Colorado State University exploring the tangled edge of embedded systems and cybersecurity. His research focuses on real-world vulnerabilities in automotive and industrial controllers, from reverse-engineering to network protocol level vulnerabilities. He has previously shared his work at DEF CON and NDSS.