DEF CON 33 - Modern Odometer Manipulation - collin & oblivion
Source: YouTube · DEFCONConference · published Oct 10, 2025 · 26:16
[BLUF: A device that manipulates car odometers by intercepting and altering CAN messages to prevent mileage increases or modify odometer values is reverse-engineered, revealing its simplicity and widespread potential impact on used car valuation and warranty systems.]2:31
Key Takeaways:
• The device uses an STM32 microcontroller to intercept CAN messages and modifies one byte of an odometer message before forwarding it to the instrument cluster 14:40.
• It supports multiple vehicle makes via a man-in-the-middle setup, but only modifies specific messages in defined CAN message IDs, with no evidence of oil life or other maintenance indicators being altered 19:36-19:48.
• Odometer manipulation occurs through simple logic—zeroing or dividing mileage values—using a configurable mode that can be toggled via steering wheel buttons 15:00-15:36.
• The device's firmware is vulnerable to flash read protection bypass via a power glitch attack, enabling extraction of code through a two-stage payload in SRAM 9:08-11:41.
• Pre-purchase inspections and diagnostic reports showing inconsistent odometer values across ECUs (e.g., 19,000 mi on dash vs. 30,000+ in gateway) can serve as indicators of manipulation 17:50-18:09.
[The device operates through a simple, exploitable CAN message manipulation, posing risks to used car buyers, warranty providers, and lease valuation models. Its existence highlights a critical gap in automotive data integrity and the need for better diagnostic checks.]
Sources:
- 2:31 Discussion of the device's functionality and its ability to manipulate odometer values across 53
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Cybersecurity. Commonly maps to: Security and Risk Management, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
All right, good afternoon everyone. My name is Colin and I'm here to talk about modern odometer manipulation. So, unfortunately, they told me that the slides aren't going to be working today. Um, they should be sharing them in the recording after this. So, there is some good stuff in the slides I'll try to talk through, but it might be difficult to follow a bit of the attack path and such. Not right now. Defcon will give them out. All right. So, the agenda for today, I'm going to tell everyone a little bit about me and how I got to be here. I'll talk a little bit about what the odometer is and why it's important. And then we'll get into the meat of this presentation, which is reverse engineering a device I found online that claims to be able to manipulate the odometer of various models of …