Skip to content

Objective 7: Solve the Sleigh's CAN-D-BUS Problem


Jack Frost is somehow inserting malicious messages onto the sleigh's CAN-D bus. We need you to exclude the malicious messages and no others to fix the sleigh. Visit the NetWars room on the roof and talk to Wunorse Openslae for hints.

TL;DR - Answer


Try filtering out one CAN-ID at a time and create a table of what each might pertain to. What's up with the brakes and doors?


To access the sleigh you must be Santa.

Let's start by filtering out all of the recurring events like we did for CAN-Bus Investigation. Here is the set of filters to apply:

ID Operator Criterion
018 Equals 000000000000
244 Equals 000000000000
188 Equals 000000000000
019 Equals 000000000000
080 Equals 000000000000
19B Equals 0000000F2057

With the noise out of the way, we need to focus on two subsystems based on the hints: the doors and the brakes. We've already figured out the CAN ID for the doors from the CAN-Bus Investigation is 19B. As a result, our last filter is likely already filtering out that bad message, and that is the only other message on the bus with that code so the doors are probably good.

Let's apply the brakes and see the messages that are recorded. If we set the brakes to 50 (0x32), we see messages with the ID of 080 coming up, so 080 is probably the brake subsystem.

One of the messages in each set contains the position of the brake as expected, but the other has a very large value that doesn't really make sense. These are probably Jack's malicious messages. Let's try applying a filter for values larger than 100 (0x64) and see if that gets rid of these messages. If you apply the filter and try again, you will notice the messages don't go away. This is because the values are signed integers, meaning the FFFF... values are actually negative. Modify the filter to be less than 0 and the messages will be gone.


At this point let's remove all of our filters except the following

ID Operator Criterion
19B Equals 0000000F2057
080 Less 000000000000

With that we will get the message "Sleigh deFrosted!", meaning we have successfully filtered out Jack's malicious messages.