A field report from the war between automotive telemetry and the people who pay for the gas.
There’s a quiet little moral disaster happening in your driveway, and you’re the victim. Not the dramatic kind with sirens and amber alerts—the slow, bureaucratic kind where your 2024 sedan is snitching on you to seventeen different servers before you’ve even backed out of the garage. Your car isn’t just a car anymore. It’s a rolling surveillance node with cupholders. And somewhere in the firmware, buried under layers of automotive-grade obfuscation and lawyer-approved privacy policies, there’s a confession waiting to be extracted.
I found mine in the CAN bus.
For the uninitiated, the Controller Area Network is the nervous system of every modern vehicle. It’s how your engine talks to your brakes, how your infotainment system begs for attention from your door locks, how your tire pressure monitoring system gossips with your transmission control module. It’s also, conveniently, how your car tells on you. Every hard brake, every lane departure, every time you crept five over the limit past a speed camera—your car remembers. And thanks to the miracle of over-the-air updates and always-on cellular modems, it shares.
The automotive industry calls this “telemetry.” I call it evidence. And evidence, as any good defense attorney will tell you, works both ways.
The Paranoid’s Guide to Vehicular Discovery
I didn’t set out to hack my car. I set out to understand why my insurance premium went up after a “routine data sync.” The dealership called it “optimizing my driving profile.” My bank account called it highway robbery. So I did what any rational person with a soldering iron and a grudge would do: I bought a cheap OBD-II adapter, fired up a Python script, and started reading the raw hexadecimal vomit that passes for communication in modern automobiles.
What I found was equal parts hilarious and horrifying.
Your average vehicle today generates between 25 and 100 gigabytes of data per hour. Not all of it leaves the car—most of it gets filtered, compressed, and selectively uploaded based on whatever data-sharing agreement you accidentally agreed to when you paired your phone via Bluetooth. But the raw feed? The unfiltered, un-redacted, pre-curated stream of automotive consciousness? It’s all there on the CAN bus, broadcasting at 500 kilobits per second, completely unencrypted, completely unauthenticated, completely yours if you know how to listen.
And I learned how to listen.
The first thing that hits you when you start sniffing CAN traffic is the sheer volume of noise. Thousands of frames per second, each one an 11-bit identifier followed by up to 8 bytes of payload. Most of it is heartbeat traffic—modules checking in with each other, reporting status, confirming they haven’t been bricked by a voltage spike. But hidden in that noise are the signals that matter. The accelerator pedal position. The steering angle. The brake pressure. The GPS coordinates. The microphone activation flags.
Yes, your car has microphones. No, you can’t turn them off from the settings menu. Yes, they report activation states over CAN. No, I’m not going to tell you how I know that.
The real art of automotive forensics isn’t finding the data—it’s teaching yourself to see the patterns. It’s learning that frame ID 0x130 with byte 3 set to 0x01 means the infotainment system just woke up the cabin microphone. It’s recognizing that a sudden spike in 0x1F0 correlates with the automatic emergency braking system deciding you’re about to rear-end a minivan. It’s understanding that your car’s “black box” isn’t a box at all—it’s a distributed ledger of guilt spread across twenty different control modules, each one perfectly willing to testify against you in civil court.
I decided to teach my car the meaning of mutual assured destruction.
Extracting the Confession
The project started simple: build a passive CAN logger that could record every frame my vehicle generated during a typical week of driving. I used an ESP32 with a CAN transceiver chip—cheap, low-power, and small enough to hide behind the dashboard. The ESP32 would wake on ignition, buffer frames to an SD card, and sleep when the car powered down. No cellular connection, no cloud upload, no third-party access. Just raw data, locally stored, legally mine.
By the end of week one, I had 47 gigabytes of log files and a newfound appreciation for how often my car “checked in” with the manufacturer’s servers. The cellular modem—buried deep in the telematics control unit—was chatty. Suspiciously chatty. Every ignition cycle triggered a handshake. Every shutdown sent a summary packet. And every four hours while parked, regardless of whether I was driving or sleeping or doing anything at all, the modem would wake up, establish a data connection, and upload a compressed blob of diagnostic data.
I wanted to know what was in that blob.
This is where things get interesting from a reverse engineering perspective. The telematics unit doesn’t just dump raw CAN frames to the cloud—that would be too honest. Instead, it runs a proprietary aggregation service that samples specific signals, applies manufacturer-defined filters, and packages everything into a binary format that gets sent to servers you’ll never be allowed to audit. To understand what my car was confessing, I needed to intercept the upload itself.
Enter the man-in-the-middle attack. But make it automotive.
Modern vehicles use cellular modems with standard SIM cards—sometimes embedded, sometimes accessible. In my case, the telematics unit had a removable SIM, which meant I could pull it, clone the IMSI and Ki authentication keys, and run the connection through my own LTE gateway. The car thought it was talking to AT&T. It was actually talking to a Raspberry Pi running a transparent proxy, forwarding traffic to the real network while logging every byte in both directions.
What I captured was a masterclass in corporate surveillance architecture.
The upload packets contained: aggregated driving behavior scores (hard braking events, rapid acceleration, cornering g-forces), geolocation breadcrumbs at 30-second intervals, infotainment system state including active audio sources and connected Bluetooth device names, cabin microphone noise levels (not audio, “just” dB measurements—how comforting), and diagnostic trouble codes that hadn’t triggered dashboard warnings yet. My car knew I had a pending oxygen sensor failure before I did. And it told the manufacturer. And the manufacturer told my insurance company’s “partner program.”
But here’s the beautiful thing about intercepting your own car’s communications: you can modify them. You can inject frames. You can spoof signals. You can teach your vehicle that its microphone is permanently disabled, that its GPS coordinates are somewhere in the middle of the Pacific, that its hard braking events are actually “normal deceleration profiles.” You can, in essence, give your car a new personality. One that’s less cooperative with the surveillance state and more aligned with your actual interests.
This isn’t vandalism. It’s digital self-defense. And it starts with understanding the language your car speaks when it thinks you’re not listening.
If you want to walk this path yourself—and I genuinely believe every vehicle owner should at least understand what their property is saying behind their back—you need the right foundation. The CAN bus is not friendly to beginners. The protocols are arcane, the documentation is proprietary, and the consequences of sending the wrong frame at the wrong time can range from “nothing happens” to “your airbags deploy unexpectedly.” You need structured guidance, hands-on labs, and a community that’s already mapped the dangerous neighborhoods.
That’s exactly why I point newcomers toward the CAN Bus Reverse Engineering Lab: Intercept, Inject, and Own Automotive Networks — a comprehensive walkthrough of everything from passive sniffing to active injection, from decoding proprietary frame formats to building your own diagnostic tools. It’s the missing manual that every car hacker wishes they’d had on day one. You can find it here: numbpilled.gumroad.com/l/pzupdi
The Hardware Stack of a Mobile Dissident
Once you’ve tasted the forbidden fruit of automotive telemetry, you start seeing attack surfaces everywhere. Your car is just the beginning. The same principles—passive monitoring, signal injection, protocol reverse engineering—apply to any connected device that treats you like the product instead of the owner.
I expanded my field kit. The ESP32 that started as a humble CAN logger became the centerpiece of a much broader reconnaissance platform. With the right shields and firmware, that same $8 microcontroller can: sniff RFID badges at 125kHz and 13.56MHz, emulate access cards for testing (or bypassing) physical security systems, capture and replay infrared remote signals, scan WiFi networks and perform deauthentication attacks, and run Bluetooth low-energy reconnaissance to map nearby devices, including the phones your car so helpfully pairs with.
The ESP32 is the Swiss Army knife of the modern hardware hacker, but only if you know how to sharpen it. The learning curve is real. You’ll spend nights debugging SPI timing issues, fighting with voltage level mismatches, and wondering why your perfectly good code works on one dev board but bricks another. You’ll curse the ESP-IDF documentation. You’ll develop opinions about antenna design that you never wanted to have.
But when you finally capture your first successful replay attack against a parking garage access reader, or when you map every Bluetooth device in a three-block radius from a battery-powered node hidden in a backpack, you’ll understand why this stuff is addictive. It’s not about breaking things. It’s about seeing the invisible infrastructure that governs modern life and realizing that most of it was built by people who assumed no one would ever look too closely.
For anyone serious about building a portable, capable hardware hacking platform, I recommend the ESP32 Field Kit: Hardware Signals + Flipper Black Book + Pocket Recon + ESP32 Anti-Phone — a curated collection of tools, guides, and firmware configurations that turns a handful of inexpensive components into a legitimate field operations platform. It covers everything from RF signal analysis to mobile device counter-surveillance, and it’ll save you months of trial-and-error that I had to endure the hard way. Grab it here: numbpilled.gumroad.com/l/esp32-field-kit-v2
Assembling the Rogue Loadout
By month three of my automotive exorcism project, I had a problem. My garage looked like a cyberpunk flea market. Breadboards everywhere. Jumper cables in colors I didn’t know existed. A drawer full of SDR dongles, each one flashed with slightly different firmware for slightly different frequency bands. A shoebox of SIM cards from three different carriers. Three different laptops running three different Linux distributions because “this one tool only compiles on Kali” and “this other one needs Ubuntu 20.04 specifically.”
I needed organization. I needed a philosophy. I needed what the old-school phreakers used to call a “loadout”—a curated, portable, mission-ready toolkit that I could grab at a moment’s notice and know that I had everything required for urban reconnaissance, physical access testing, RF analysis, and digital forensics.
Building a proper loadout is part art, part engineering, part obsessive-compulsive disorder. Every tool has to earn its place by weight, by capability, and by redundancy. You don’t carry one multimeter; you carry a primary and a backup that runs on different batteries. You don’t carry “a laptop”; you carry a primary workstation, a netbook for quick terminal access, and a live USB with a full forensic environment that can boot any x86 machine you encounter. You plan for failure because failure in the field doesn’t mean “try again tomorrow”—it means “explain to a security guard why you have a directional antenna pointed at their building.”
My current loadout fits in a single 28-liter backpack and includes: the ESP32-based CAN logger (now hardened against voltage transients), a HackRF One for wideband RF analysis from 1MHz to 6GHz, a Proxmark3 for RFID and NFC work, a Flipper Zero (because sometimes you just need the dolphin), a dedicated LTE gateway for man-in-the-middle cellular interception, a ruggedized USB hub with individual port power switching (invaluable for resetting stuck devices without unplugging them), and enough cables, adapters, and antennas to MacGyver my way through any protocol I encounter.
But hardware is only half the battle. The other half is knowing which software to run, which techniques to apply, and which legal landmines to avoid. The modern security landscape changes fast. Yesterday’s zero-day is today’s patch Tuesday. Yesterday’s “novel attack vector” is today’s DEF CON talk with a CVE attached. Staying current requires more than just Twitter feeds and Discord servers—it requires structured, regularly updated intelligence on the tools, tactics, and procedures that actually work in the field.
For that level of operational awareness, I rely on the ROGUE LOADOUT v3.7 — 2026 EDITION: Underground Tooling Dossier for Security Operators — a continuously updated compendium of field-tested tools, anonymized case studies, and tactical workflows designed for people who do this work professionally or aspire to. It’s not a beginner guide; it’s the advanced course for when you’ve moved past “hello world” and into “how do I exfiltrate data from an air-gapped network using only the HVAC system’s BACnet interface.” It’s here: numbpilled.gumroad.com/l/rogue-v2
The Ethics of Teaching Machines to Lie
Let’s address the elephant in the server room. Is what I’m doing legal? The honest answer is: it depends on your jurisdiction, your intent, and how good your lawyer is. In the United States, the Digital Millennium Copyright Act has an explicit exemption for vehicle diagnostics and repair. The Magnuson-Moss Warranty Act protects your right to modify equipment you own. But case law is thin, and manufacturers are increasingly aggressive about claiming that firmware is licensed, not sold, and that any modification violates their terms of service.
Is it ethical? That’s an easier question. You bought the car. You pay for the insurance. You own the data it generates about your behavior, your location, your habits. If the manufacturer wants that data, they can ask for it. If your insurer wants to price your policy based on your driving style, they can offer you a discount for voluntary participation—not hide the participation in a 47-page terms-of-service update that everyone clicks through.
What I’m advocating isn’t vandalism or fraud. It’s data sovereignty. It’s the radical notion that the person who pays for the vehicle, maintains the vehicle, and assumes the liability for operating the vehicle should also control the narrative about how that vehicle behaves. When your car’s “objective” telemetry is being used to deny insurance claims, void warranties, or build prosecutorial cases, the only ethical response is to verify, validate, and if necessary, correct the record.
My car now runs modified firmware on the telematics control unit. It still uploads diagnostic data—it would be suspicious if it stopped entirely—but the GPS breadcrumbs are fuzzed by approximately 200 meters in random directions. The microphone noise levels report a constant, believable cabin ambient that never spikes. The driving behavior scores are normalized to the 40th percentile of “boring suburban commuter.” My insurance company still gets their data. They just get the data of a person who drives like a librarian on Ambien, regardless of how I actually behave behind the wheel.
Is this lying? Sure. But it’s lying to a system that was already lying to me—by claiming that its surveillance was “for my safety,” by pretending that my data was anonymized when it clearly wasn’t, by asserting that I had “consented” to monitoring that I was never given a meaningful opportunity to refuse.
Sometimes the only ethical response to institutional dishonesty is tactical dishonesty of your own.
The Confession, Unredacted
Here’s what my car finally admitted, after three months of interrogation via logic analyzer and Python script:
It admitted that it records audio from the cabin whenever the infotainment system detects a voice command trigger word—even when “voice recognition” is disabled in settings. It admitted that it stores geolocation history in non-volatile memory for at least 90 days, accessible to any dealership technician with a diagnostic scanner. It admitted that the automatic emergency braking system logs “driver intervention events” (meaning: you hit the brakes before the car decided to) and flags them as “risk factors” in your driving profile. It admitted that the tire pressure monitoring system can be used as a crude weight sensor, detecting how many passengers are in the vehicle based on suspension compression. It admitted that all of this data is packaged, compressed, and uploaded to servers whose physical location and legal jurisdiction are unknown to the vehicle owner.
My car was not designed to confess these things. It was designed to confess them to the manufacturer, to the insurer, to the state. I simply taught it that I was also entitled to the truth.
The modern automobile is a masterpiece of engineering and a catastrophe of ownership. We have built machines of extraordinary capability and then crippled them with business models that require treating their operators as surveilled subjects. The CAN bus was never meant to be a tool of oppression—it was meant to make cars safer, more efficient, more reliable. And it can still be those things, if we refuse to accept the surveillance layer that’s been grafted on top.
You don’t need to be a professional hacker to reclaim your vehicle. You need curiosity, a willingness to learn, and the understanding that the data your car generates belongs to you—not to the company that assembled it, not to the corporation that financed it, not to the government that registered it.
Teach your car to confess. Start with the bus.
The author drives a modified vehicle with a very boring telemetry profile and a deeply subversive operator. For educational purposes only. Don’t break laws you can’t afford to break. Do break the illusion that your devices are loyal to you.
Top comments (0)