1 00:00:05,501 --> 00:00:08,999 JASON STAGGS: Well, hello, DEF CON! 2 00:00:11,709 --> 00:00:12,999 (Cheers). 3 00:00:19,334 --> 00:00:22,834 JASON STAGGS: How is everybody doing? 4 00:00:23,667 --> 00:00:25,417 All right. 5 00:00:34,999 --> 00:00:38,667 We will go ahead and get started. 6 00:00:39,083 --> 00:00:40,999 First things first. 7 00:00:40,999 --> 00:00:45,999 My name is Jason Staggs. 8 00:00:46,667 --> 00:00:50,250 This is my second time here at DEF CON. 9 00:01:00,375 --> 00:01:04,542 I was here last year at DEF CON 20. 10 00:01:04,834 --> 00:01:08,999 I had a great time and met people doing interesting stuff and I'm glad 11 00:01:08,999 --> 00:01:13,918 to be back here this year to relive the experience the title of my talk 12 00:01:13,918 --> 00:01:16,667 is "How to Hack Your Mini Cooper: Reverse 13 00:01:16,667 --> 00:01:21,083 engineering com messages on passenger automobiles." 14 00:01:31,959 --> 00:01:33,918 I'm a graduate student for the institute 15 00:01:33,918 --> 00:01:36,334 for information security at TU. 16 00:01:41,667 --> 00:01:44,999 AUDIENCE MEMBER: Yeah. 17 00:01:45,751 --> 00:01:47,542 JASON STAGGS: Right on. 18 00:01:50,083 --> 00:01:53,999 I'm also currently finishing up my master's thesis, related 19 00:01:53,999 --> 00:01:57,999 to drive by attack mitigation and network intrusion detection 20 00:01:57,999 --> 00:02:02,167 systems and critical infrastructure protection, digital forensics 21 00:02:02,167 --> 00:02:05,083 and most recently, vehicle network security, 22 00:02:05,083 --> 00:02:08,417 which I carry out through TU's crash reconstruction 23 00:02:08,417 --> 00:02:13,167 research consortium which is directed by Dr. Jeremy Daley. 24 00:02:20,584 --> 00:02:23,667 I quite literally wrote the book on automotive collision 25 00:02:23,667 --> 00:02:26,083 reconstruction fundamentals. 26 00:02:34,375 --> 00:02:37,542 We are fortunate to have someone with his caliber 27 00:02:37,542 --> 00:02:40,834 of expertise leading those efforts. 28 00:02:40,999 --> 00:02:43,459 And then before I game to TU, I was actually 29 00:02:43,459 --> 00:02:46,876 a cyber security analyst for an information security firm 30 00:02:46,876 --> 00:02:50,709 in Tulsa, Oklahoma, called True Digital Security. 31 00:03:01,459 --> 00:03:04,459 So who here in the audience remembers Tim 32 00:03:04,459 --> 00:03:09,209 Burton's "Bat Man Returns" from like the early '90s. 33 00:03:14,334 --> 00:03:17,083 Several of you, good. 34 00:03:17,125 --> 00:03:18,125 Good. 35 00:03:33,292 --> 00:03:36,959 There's a scene in the movie where batman parks his 36 00:03:36,959 --> 00:03:41,375 bat mobile and he leaves to attend to his crime fighting business 37 00:03:41,375 --> 00:03:45,501 and then all of a sudden the penguin and his gangster thugs 38 00:03:45,501 --> 00:03:49,999 stumble across the Batmobile and they start taking things apart 39 00:03:49,999 --> 00:03:53,584 and then all of a sudden they attach a wireless gizmo 40 00:03:53,584 --> 00:03:56,250 to the Batmobile, designed to interface 41 00:03:56,250 --> 00:03:59,959 with the computer systems on the car. 42 00:04:11,125 --> 00:04:16,125 They basically reassemble everything they take off. 43 00:04:16,125 --> 00:04:19,334 Batman comes back later on that night and hops 44 00:04:19,334 --> 00:04:24,999 in the Batmobile and goes off and leaves and then all a sudden 45 00:04:24,999 --> 00:04:29,459 of Penguin appears on the informational screen and 46 00:04:29,459 --> 00:04:33,999 he says, gentlemen, start your engines. 47 00:04:41,542 --> 00:04:47,125 And Batman is trying to step on the brake pedal. 48 00:04:53,918 --> 00:04:56,542 A scenario such as that was near impossible considering 49 00:04:56,542 --> 00:04:58,626 all the mechanical devices used to control 50 00:04:58,626 --> 00:05:01,209 the various components of vehicle. 51 00:05:22,959 --> 00:05:26,125 But today a scenario such as that is fairly realistic. 52 00:05:45,709 --> 00:05:49,999 So what originally got me interested in vehicle network security was some 53 00:05:49,999 --> 00:05:52,626 research that was put out by the University 54 00:05:52,626 --> 00:05:56,250 of Washington and the University of California San Diego, back 55 00:05:56,250 --> 00:05:58,250 in 2010 and 2011. 56 00:06:58,999 --> 00:07:02,542 What they did originally was they actually did an empirical study 57 00:07:02,542 --> 00:07:04,834 to see how resilient the computer systems 58 00:07:04,834 --> 00:07:08,083 on vehicles were to digit attacks, and the short answer to that 59 00:07:08,083 --> 00:07:12,375 is they're not too resilient whatsoever, surprise, surprise! 60 00:07:26,792 --> 00:07:29,459 So in their first paper, they actually were able 61 00:07:29,459 --> 00:07:32,792 to compromise various systems on the automobile, assuming 62 00:07:32,792 --> 00:07:36,083 the attacker had physical access to the bus, you know, what 63 00:07:36,083 --> 00:07:40,209 all could they do, and they were able to take full control of the brakes, 64 00:07:40,209 --> 00:07:44,209 the accelerator pedal and body control mechanisms, the locks, interior 65 00:07:44,209 --> 00:07:47,834 and exterior lighting, basically everything. 66 00:07:50,792 --> 00:07:54,667 They later received some criticism from automotive manufacturers saying, 67 00:07:54,667 --> 00:07:57,999 yeah, well, you were able to do that but you had physical access 68 00:07:57,999 --> 00:08:00,083 to the car anyways. 69 00:08:00,083 --> 00:08:02,167 Why not just cut the brake lines. 70 00:08:14,959 --> 00:08:17,459 Well, okay. 71 00:08:40,542 --> 00:08:45,167 So the following year, they put out some more research, basically 72 00:08:45,167 --> 00:08:50,083 they were able to carry out the same types of attacks. 73 00:09:01,834 --> 00:09:05,999 Basically, by taking advantage of some vulnerabilities and some short 74 00:09:05,999 --> 00:09:10,999 wave radio communication such as Bluetooth and the telemetry device. 75 00:09:22,375 --> 00:09:25,959 So at TU we are interested in doing this research as well. 76 00:09:27,292 --> 00:09:31,626 The actual systems on the actual vehicle networks 77 00:09:31,626 --> 00:09:36,999 themselves, we also assess the accuracy of the actual precrash 78 00:09:36,999 --> 00:09:41,209 and crash data stored on event data recorders, so 79 00:09:41,209 --> 00:09:46,459 the little black boxes that automobiles contain. 80 00:09:53,999 --> 00:09:56,876 And then we want to be able to understand these systems 81 00:09:56,876 --> 00:09:59,709 and networks at a very low level and be able to understand 82 00:09:59,709 --> 00:10:02,959 the potential points of vulnerable on these systems and networks, 83 00:10:02,959 --> 00:10:05,999 but most importantly, we want to be able to prevent something 84 00:10:05,999 --> 00:10:09,250 like this from turning into this because of this. 85 00:10:09,250 --> 00:10:14,209 So what you guys are looking at here on the table, I'm sure a lot 86 00:10:14,209 --> 00:10:19,584 of you can't see it in the back but what we are calling it 87 00:10:19,584 --> 00:10:22,042 is the CAN clock. 88 00:10:22,042 --> 00:10:26,999 It was actually a project that was the outcome 89 00:10:26,999 --> 00:10:31,999 of a research driven class that I was involved 90 00:10:31,999 --> 00:10:38,999 with last semester called vehicle communication systems. 91 00:10:54,375 --> 00:10:57,999 That was co taught by Dr. Daley and Dr. 92 00:10:57,999 --> 00:11:03,292 Mauricio Poppa who is a computer scientist and specializes 93 00:11:03,292 --> 00:11:06,209 in computer networks. 94 00:11:10,501 --> 00:11:15,083 It was designed as a proof of concept to demonstrate what 95 00:11:15,083 --> 00:11:20,999 a rogue ECU device could do if it was attached to a CAN bus. 96 00:11:27,083 --> 00:11:31,999 And the overall goal was to actually transform 97 00:11:31,999 --> 00:11:39,417 the instrument cluster from the Mini Cooper into a CAN clock. 98 00:11:39,417 --> 00:11:41,667 There were two problems I had no prior knowledge 99 00:11:41,667 --> 00:11:45,083 to how these systems worked beforehand. 100 00:11:49,667 --> 00:11:53,876 I had to build a CAN bus from scratch and then also 101 00:11:53,876 --> 00:11:58,542 with the automobiles, the message IDs that are responsible 102 00:11:58,542 --> 00:12:03,250 to control the vehicle, proprietary in nature. 103 00:12:03,250 --> 00:12:06,876 So some reverse engineering methods were used to identify 104 00:12:06,876 --> 00:12:10,083 the message IDs themselves is. 105 00:12:12,083 --> 00:12:18,999 So it's actually quite common for vehicles to have multiple types 106 00:12:18,999 --> 00:12:24,209 of networks in place on these vehicles. 107 00:12:25,834 --> 00:12:29,417 If you have a car that was manufactured on or 108 00:12:29,417 --> 00:12:33,083 after 2008, then by law you actually have CAN 109 00:12:33,083 --> 00:12:37,667 whether you know it or not on your vehicle. 110 00:12:53,501 --> 00:12:57,584 If you are curious to see whether or not you have 111 00:12:57,584 --> 00:13:01,626 a CAN enabled vehicle, you can do a voltage check 112 00:13:01,626 --> 00:13:05,209 on pin 6 and 14 on your diagnostic connector 113 00:13:05,209 --> 00:13:08,918 underneath your steering wheel. 114 00:13:09,834 --> 00:13:12,834 Network protocols such as FlexRain, LIN, MOST, 115 00:13:12,834 --> 00:13:16,667 a high speed application within vehicles and J1850 and J1939 116 00:13:16,667 --> 00:13:21,542 is actually a protocol used for the heavy trucking industry. 117 00:13:21,792 --> 00:13:26,709 That sort of sets on top of CAN. 118 00:13:34,334 --> 00:13:38,250 And then what we're looking at right here 119 00:13:38,250 --> 00:13:44,584 is actually data bus diagram of the Mini Cooper itself. 120 00:13:44,584 --> 00:13:47,459 As you can see, there's actually four different networks 121 00:13:47,459 --> 00:13:52,083 here that are all interconnected with the actual instrument cluster, 122 00:13:52,083 --> 00:13:55,999 believe it or not, acting as the gateway. 123 00:14:13,959 --> 00:14:16,292 And these systems are actually kind of segmented based 124 00:14:16,292 --> 00:14:18,292 on common functionality and information that 125 00:14:18,292 --> 00:14:20,792 they share between one another. 126 00:14:29,459 --> 00:14:33,999 So when we're talking about CAN, Controller Area Networks, 127 00:14:33,999 --> 00:14:38,292 it was actually developed by Robert Wash back in the '80s 128 00:14:38,292 --> 00:14:42,209 to actually as a method for basically communication 129 00:14:42,209 --> 00:14:46,083 between embedded systems with a bus style topology 130 00:14:46,083 --> 00:14:48,292 within vehicles. 131 00:14:49,125 --> 00:14:53,083 Prior to CAN, the solutions for networking embedded systems 132 00:14:53,083 --> 00:14:57,792 on vehicles, sort of called for more of the ring style mesh topology, 133 00:14:57,792 --> 00:15:01,209 where nodes were sort of interconnected and dependent 134 00:15:01,209 --> 00:15:03,375 upon one another. 135 00:15:09,834 --> 00:15:14,459 If one node were to fail, that could potentially affect 136 00:15:14,459 --> 00:15:18,918 the other node on the vehicle and that was somewhat 137 00:15:18,918 --> 00:15:22,999 of a nightmare from a service technician's point 138 00:15:22,999 --> 00:15:27,999 of view trying to troubleshoot these networks. 139 00:15:30,209 --> 00:15:32,209 So CAN was actually designed to be 140 00:15:32,209 --> 00:15:35,834 a very resilient networking protocol, and standard designed 141 00:15:35,834 --> 00:15:39,542 to with stand harsh operating environments such as the heats and 142 00:15:39,542 --> 00:15:44,209 the colds, electromagnetic interference, those sorts of things. 143 00:15:58,250 --> 00:16:01,542 And then automotive manufacturers European automotive manufacturers 144 00:16:01,542 --> 00:16:05,417 were early adopters, so Volkswagen, Mercedes were the early. 145 00:16:07,083 --> 00:16:11,125 And CAN is a multi broadcast system. 146 00:16:11,125 --> 00:16:16,709 So if one node were to transmit a message, then 147 00:16:16,709 --> 00:16:23,375 all other nodes on the bus would actually receive 148 00:16:23,375 --> 00:16:26,125 that message. 149 00:16:26,334 --> 00:16:29,584 Whether or not a node actually processes that 150 00:16:29,584 --> 00:16:33,999 message is dependent upon something called acceptance 151 00:16:33,999 --> 00:16:38,584 filters on the actual CAN controller itself. 152 00:16:45,918 --> 00:16:50,584 So if a message matches up with the actual acceptance filter, 153 00:16:50,584 --> 00:16:54,083 it then gets passed on to the microcontroller 154 00:16:54,083 --> 00:16:58,999 for further processing, otherwise it's disregarded. 155 00:17:13,250 --> 00:17:15,918 With CAN, there's no notion of source addresses. 156 00:18:12,501 --> 00:18:15,999 So it's nearly impossible to identify where 157 00:18:15,999 --> 00:18:21,501 a message actually came from, which is sort of a problem. 158 00:18:22,334 --> 00:18:25,083 And CAN actually comes in two flavors. 159 00:18:36,667 --> 00:18:43,334 So there is at standard format which is used on the passenger automobiles, 160 00:18:43,334 --> 00:18:47,792 and then there's the extended format. 161 00:19:01,999 --> 00:19:07,083 With the standard format, it uses 11 bit message ID and then 162 00:19:07,083 --> 00:19:11,501 in the automotive, the passenger automotive world, 163 00:19:11,501 --> 00:19:14,999 these messages are actually proprietary, 164 00:19:14,999 --> 00:19:19,876 but when we are talking about something like J1939 which 165 00:19:19,876 --> 00:19:23,999 is the protocol for the heavy trucking industry, 166 00:19:23,999 --> 00:19:29,083 it uses a 29 bit message ID and actually this whole standard 167 00:19:29,083 --> 00:19:31,959 is fully documented. 168 00:19:39,918 --> 00:19:42,167 So if somebody was wanting to create a message, designed 169 00:19:42,167 --> 00:19:44,792 to maybe override a brake control, they would have to refer 170 00:19:44,792 --> 00:19:48,334 to the automobile association, to construction such a message. 171 00:19:57,709 --> 00:19:59,999 Here's what a CAN frame looks like. 172 00:20:02,459 --> 00:20:07,626 So with a CAN frame, the actual payload portion of it 173 00:20:07,626 --> 00:20:12,083 is limited to up to 8 bytes which I thought was 174 00:20:12,083 --> 00:20:18,334 somewhat limited to, like, the stuff like ethernet, which can be 175 00:20:18,334 --> 00:20:20,999 up to 1500 bytes. 176 00:20:22,834 --> 00:20:31,999 And so the way one of the cool things about CAN 177 00:20:31,999 --> 00:20:39,792 is the way it handles arbitration. 178 00:20:54,209 --> 00:20:59,999 So if two nodes attempting to transmit at the same time, 179 00:20:59,999 --> 00:21:06,375 obviously perform a collision, the way it handles arbitration 180 00:21:06,375 --> 00:21:12,584 is based on the identifier, the message ID itself. 181 00:21:39,501 --> 00:21:46,334 So the idea of a node trying to transmit a message 182 00:21:46,334 --> 00:21:55,999 with a lower message ID has higher precedence than another node trying 183 00:21:55,999 --> 00:22:03,375 to transmit a message with a higher message ID. 184 00:22:03,375 --> 00:22:04,709 And then the actual computer systems 185 00:22:04,709 --> 00:22:08,751 on CAN networks or vehicle systems for that matter, we call ECUs, 186 00:22:08,751 --> 00:22:11,751 electronic control units, and these are designed 187 00:22:11,751 --> 00:22:15,375 to control a variety of features on the vehicle, everything 188 00:22:15,375 --> 00:22:20,751 from vehicle safety, critical systems to non safety critical systems. 189 00:22:20,834 --> 00:22:24,542 And these devices are for the most part programmable, 190 00:22:24,542 --> 00:22:28,792 which is nice from the automotive manufacturer point 191 00:22:28,792 --> 00:22:33,999 of view, because if there's a flaw or a vulnerability discovered 192 00:22:33,999 --> 00:22:38,999 within one of these devices, they can just push out, you know, 193 00:22:38,999 --> 00:22:43,584 firmware updates or patches, whatever, updates, as opposed 194 00:22:43,584 --> 00:22:47,542 to physically removing these devices. 195 00:22:48,375 --> 00:22:53,209 And then the average modern day luxury vehicle 196 00:22:53,209 --> 00:22:58,999 has somewhere on the order of 70 or so ECUs. 197 00:23:01,167 --> 00:23:02,999 All right. 198 00:23:07,584 --> 00:23:10,083 So let's get back to the actual CAN clock instrument 199 00:23:10,083 --> 00:23:12,709 cluster thing that I built here. 200 00:23:12,709 --> 00:23:17,292 So what we want to do is we want to be able to manipulate 201 00:23:17,292 --> 00:23:21,667 the tachometer, and the speedometer. 202 00:23:21,667 --> 00:23:23,959 So manufacturers don't publish the information 203 00:23:23,959 --> 00:23:27,083 to manipulate these accordingly. 204 00:23:36,334 --> 00:23:42,626 So we used several methods on how to configure this. 205 00:23:42,626 --> 00:23:45,209 We did visual correlations with identifiable patterns 206 00:23:45,209 --> 00:23:50,083 all see humans are inherently good at seeing patterns that we recognize 207 00:23:50,083 --> 00:23:54,417 on a graph, maybe something that is indicating a vehicle speed 208 00:23:54,417 --> 00:23:56,876 for an engine speed. 209 00:24:30,459 --> 00:24:35,999 And then for the ones that we were not able to use this method on, 210 00:24:35,999 --> 00:24:39,999 we used some simple fuzzing techniques to identify 211 00:24:39,999 --> 00:24:44,125 the various items we are interested in. 212 00:24:49,999 --> 00:24:54,999 In my demo, the lighting is causing some issues, 213 00:24:54,999 --> 00:25:01,083 but if you want to see this, I will be out in the hallway or 214 00:25:01,083 --> 00:25:05,083 the Chillout Lounge and I will be happy 215 00:25:05,083 --> 00:25:08,999 to demonstrate this for you. 216 00:25:19,999 --> 00:25:22,667 So the actual instrument cluster, was 217 00:25:22,667 --> 00:25:27,167 from a Mini Cooper that was involved in a collision. 218 00:25:27,167 --> 00:25:29,167 They were outfitted with external like instruments 219 00:25:29,167 --> 00:25:31,542 to measure such things as vehicle speed 220 00:25:31,542 --> 00:25:35,209 and then we correlated that information with the CAN bus itself 221 00:25:35,209 --> 00:25:37,667 to verify its accuracy. 222 00:25:38,876 --> 00:25:40,918 This capture lasted roughly 90 seconds. 223 00:25:43,626 --> 00:25:48,083 And over the course of that capture, they gave us 224 00:25:48,083 --> 00:25:53,375 around 106,000 actual messages on the CAN bus. 225 00:26:08,292 --> 00:26:11,125 I will show you guys the crash. 226 00:26:28,999 --> 00:26:30,083 Yeah. 227 00:26:30,083 --> 00:26:34,083 As you can see, the Mini Cooper didn't really stand 228 00:26:34,083 --> 00:26:37,999 much of a chance whatsoever. 229 00:26:39,834 --> 00:26:45,959 Oh, so we also hooked up a data logger 230 00:26:45,959 --> 00:26:51,501 to the actual can bus itself. 231 00:26:52,999 --> 00:26:56,501 It records all the messages on the bus so message IDs 232 00:26:56,501 --> 00:26:59,999 and raw payload information and then we need a unique 233 00:26:59,999 --> 00:27:03,125 on all the message IDs to see what IDs occurred 234 00:27:03,125 --> 00:27:06,999 and then a frequency count to see actually how many times 235 00:27:06,999 --> 00:27:10,792 a message was transmitted on the bus during that capture 236 00:27:10,792 --> 00:27:14,459 and then we started playing with the ones that were most 237 00:27:14,459 --> 00:27:16,542 occurring first. 238 00:27:46,792 --> 00:27:49,250 So back to the method of the visually CAN methods 239 00:27:49,250 --> 00:27:52,999 of interest based on plotting the data on a graph. 240 00:28:54,709 --> 00:28:59,999 If we are interested in vehicle speed, we basically will start we started 241 00:28:59,999 --> 00:29:04,667 to play with suspect message IDs and then for each buyoff set, 242 00:29:04,667 --> 00:29:08,292 we would plot data until something we saw that was 243 00:29:08,292 --> 00:29:14,083 indicative of the vehicle speed such as the third one right here. 244 00:29:24,876 --> 00:29:26,709 And then for the tachometer. 245 00:29:26,999 --> 00:29:29,918 You noticed in the video I just showed you, both 246 00:29:29,918 --> 00:29:36,334 of the cars were being pulled together with like a pulley system for a collision. 247 00:29:39,999 --> 00:29:53,501 So the actual engine speed itself was at an idle state the entire time. 248 00:29:55,167 --> 00:29:58,375 We basically had to use some simple fuzzy techniques 249 00:29:58,375 --> 00:30:01,250 until the tachometer flipped out of control and 250 00:30:01,250 --> 00:30:04,751 the needle started spinning like crazy. 251 00:30:14,334 --> 00:30:16,876 That was kind of interesting. 252 00:30:29,542 --> 00:30:31,918 So up until now, we have actually identified, you know, 253 00:30:31,918 --> 00:30:33,999 the message IDs responsible for the speedometer and 254 00:30:33,999 --> 00:30:35,876 the tachometer, as well as the pay load and 255 00:30:35,876 --> 00:30:37,999 the data offsets for those. 256 00:30:38,292 --> 00:30:42,999 We built a simple CAN bus and 8 gauge wire and 12 volt power 257 00:30:42,999 --> 00:30:46,250 source, arduino, and our CAN transceiver, 258 00:30:46,250 --> 00:30:51,292 the instrument cluster, obviously and the realtime clock module, 259 00:30:51,292 --> 00:30:58,083 and this is available on our website, as well as the source code for this. 260 00:31:36,125 --> 00:31:38,417 And here as an image of what it looked like early 261 00:31:38,417 --> 00:31:40,834 on in the prototyping stages. 262 00:31:43,417 --> 00:31:47,375 It's kind of a mess. 263 00:31:48,459 --> 00:31:50,999 And as far as talking CAN, with the Arduino, 264 00:31:50,999 --> 00:31:53,999 we just used basically a CAN controller library that was 265 00:31:53,999 --> 00:31:57,167 designed to communicate with the MCP2515 that allowed us 266 00:31:57,167 --> 00:32:01,083 to create CAN frames and inject them on to the bus. 267 00:33:01,083 --> 00:33:06,584 And so basically, there's two modes of operation, the clock mode 268 00:33:06,584 --> 00:33:09,542 and then the demo mode. 269 00:33:13,999 --> 00:33:17,999 So the demo mode, incrementing the speedometer and the tachometer. 270 00:33:25,999 --> 00:33:33,999 Like I say, I will show you a demo afterwards if you are interested. 271 00:34:07,083 --> 00:34:09,999 So, you know, if you have physical access 272 00:34:09,999 --> 00:34:13,501 to the car anyways, you know, oh, well. 273 00:34:26,999 --> 00:34:30,709 But, you know, there's a bunch of possible scenarios in which case, 274 00:34:30,709 --> 00:34:34,459 like, potential conspirators like service technicians and mechanics, 275 00:34:34,459 --> 00:34:37,125 car rental companies, coworkers, family, friends, 276 00:34:37,125 --> 00:34:41,083 ex girlfriends could potentially have momentary access to your CAN bus 277 00:34:41,083 --> 00:34:44,751 or car and attach a rogue ECU for less than $100 and that's kind 278 00:34:44,751 --> 00:34:46,417 of a problem. 279 00:34:57,584 --> 00:35:01,250 And they could attach whether that be 280 00:35:01,250 --> 00:35:05,999 to the OBD2 port underneath the steering wheel 281 00:35:05,999 --> 00:35:10,792 or tapping the CAN bus, either under the hood or 282 00:35:10,792 --> 00:35:13,792 by some other means. 283 00:35:15,999 --> 00:35:22,834 So what's surprising to me is that the actual access control, I guess, 284 00:35:22,834 --> 00:35:27,999 between ECU and ECU or network to network on vehicles 285 00:35:27,999 --> 00:35:32,876 is somewhat nonexistent or the ones that had been 286 00:35:32,876 --> 00:35:37,876 the ones that are in existence aren't very good and 287 00:35:37,876 --> 00:35:41,209 they are easily bypassed. 288 00:35:46,918 --> 00:35:49,918 So maybe applying conventional network security techniques such 289 00:35:49,918 --> 00:35:52,999 as like make network intrusion prevention systems or some firewalls 290 00:35:52,999 --> 00:35:56,334 to these networks might provide a better solution. 291 00:36:32,792 --> 00:36:39,459 And then maybe some sort of like message anomaly prevention 292 00:36:39,459 --> 00:36:45,999 depending on the context of other messages on the CAN bus 293 00:36:45,999 --> 00:36:48,292 at the time. 294 00:37:08,334 --> 00:37:14,709 Maybe there should be a message that says, okay, someone 295 00:37:14,709 --> 00:37:20,417 is trying to apply full throttle to the accelerator 296 00:37:20,417 --> 00:37:28,250 but at the same time they are trying to, you know, apply full pressure 297 00:37:28,250 --> 00:37:30,999 to the brakes. 298 00:37:34,999 --> 00:37:41,918 And then if you are in case you are interested in some 299 00:37:41,918 --> 00:37:50,083 of the research that we are doing, here's some links to our sites 300 00:37:50,083 --> 00:37:56,999 and some of the stuff that we are working on. 301 00:38:08,167 --> 00:38:14,542 Like I said a full tutorial is available on our site. 302 00:38:31,542 --> 00:38:34,999 So feel free to check out our stuff. 303 00:38:54,501 --> 00:38:58,209 And I will be out roaming around. 304 00:39:06,918 --> 00:39:10,876 So if you see me around here, feel free to come 305 00:39:10,876 --> 00:39:13,999 out and ask me questions. 306 00:39:15,626 --> 00:39:19,999 If you have some questions or ideas or concerns, feel free to email me. 307 00:40:17,375 --> 00:40:19,876 Thank you very much.