00:00:00.000-->00:00:06.708 >>Hello Def Con. I am p3n3troot0r. >>I’m ginsback. >>We are here today to present a 00:00:06.708-->00:00:12.500 framework built into the mainline Linux Kernel four. Hacking connected vehicles. Uh 00:00:12.500-->00:00:17.500 it’s free, open source, free to all. Uh It uses standard commercial off the shelf uh wifi 00:00:24.708-->00:00:29.708 hardware and uh let’s get started. So, the state of the world today. Um automation is 00:00:33.333-->00:00:38.542 becoming widespread in the commercial industry and it’s starting to become available in 00:00:38.542-->00:00:44.042 commercial platforms including in automotive systems so um vehicular network architectures 00:00:44.042-->00:00:49.042 today uh such as CANBUS are not designed for highly complex systems. Not designed to handle 00:00:51.667-->00:00:58.500 the throughput latency uh and security requirements. Um however these architectures are 00:00:58.500-->00:01:03.500 still being used as the basis for uh developing future automotive systems and this is 00:01:06.333-->00:01:12.250 bad right? Um as we develop the next generation of automotive safety standards it is 00:01:12.250-->00:01:17.167 impertinent that we build security and from the bottom up and not use something that is 00:01:17.167-->00:01:23.208 heavily flawed such that we deploy, irreversibly deploy um y’know platforms that are 00:01:23.208-->00:01:27.708 vulnerable and weak, especially in the context of safety, critical infrastructure, like 00:01:27.708-->00:01:34.625 automotive systems that pretty much everyone in the civilized world use, um alright. >>Gotcha. 00:01:34.625-->00:01:39.625 >>Okay so Um I think we’re actually one slide ahead. >>Yeah buddy. >>Okay Up Up. Okay so we 00:01:48.792-->00:01:54.417 can classify these autonomous systems um that we’ll see in the future. So we have uh 00:01:54.417-->00:02:00.708 classification of zero to five. We’re right now we can say we’re at stage two. Automation for 00:02:00.708-->00:02:06.250 vehicles where we can say non safety critical functions are automated using the exchange of 00:02:06.250-->00:02:11.458 stayed information on the internal networks and the transition up to stage three 00:02:11.458-->00:02:16.667 requires um inter vehicle communication and synchronization. So these safety 00:02:16.667-->00:02:21.667 critical vehicle functions can be automated with the presence of an operator. Um yeah. And so 00:02:24.833-->00:02:29.833 some of the barriers to this are uh so primary issues are who owns the infrastructure and 00:02:32.583-->00:02:36.625 who’s responsible for problems that are resultant from the deployment of these systems, 00:02:36.625-->00:02:42.625 right? You know. Who makes you know, who can make these decisions about public safety 00:02:42.625-->00:02:46.917 you know in the context of automotive systems and who’s responsible when these systems 00:02:46.917-->00:02:52.917 fail and there’s injury and potentially even death. And a good example of this is the 00:02:52.917-->00:02:59.333 machine learning systems we have uh that do vision aren’t actually robust to uh a lot of 00:02:59.333-->00:03:04.667 the adversarial attacks that can be constructed. So you see this, this picture’s an example of 00:03:04.667-->00:03:09.542 that. So in the top layer we have uh images that are fed into a machine learning classifying 00:03:09.542-->00:03:14.375 system to try and determine what the image is representing according to the classifier and 00:03:14.375-->00:03:19.000 you can see in the bottom image we’ve introduced, or not we, but previous resear-researchers 00:03:19.000-->00:03:23.750 introduced noise to these images such that the human eye cannot tell the difference but the 00:03:23.750-->00:03:30.500 actual vision system on the car uh gets tricked and you can imagine for things like a stop 00:03:30.500-->00:03:35.500 sign, a yield sign, you know that are present here. That could lead to some very 00:03:38.833-->00:03:43.833 dangerous effects. >>Indeed so this leads us to this concept of be the X. What is stage three 00:03:47.625-->00:03:52.625 autonomy. Um essentially um it can be described as such. Uh using a vehicular ad hoc 00:03:56.292-->00:04:01.833 network. A VANET to enable rapid high throughput exchange of state information between 00:04:01.833-->00:04:06.833 network participants. Uh that as such provides enhanced safety and uh network wide optimization 00:04:09.792-->00:04:14.792 that isn’t possible using the uh sensor systems on board any isolated system. Um so this is 00:04:17.583-->00:04:23.375 done by layering a protocol stack. The V2X protocol stack on top of the control BUS to which 00:04:23.375-->00:04:27.833 reactionary instructions are sent to control the vehicle based on proximal network 00:04:27.833-->00:04:32.833 activity in the VANET. Um and this concept V2X serves as the technological bridge between 00:04:36.500-->00:04:42.458 stage two and stage four automation. Going from traditional automotive systems 00:04:42.458-->00:04:47.458 to self driving cars to the future. So it will, the deployment of robust successful 00:04:51.125-->00:04:57.583 V2V will shed light on the technological but more so legal advocal and moral challenges 00:04:57.583-->00:05:02.583 that are presented by the use of high stage automation in public systems, in consumer systems. Um 00:05:05.500-->00:05:12.208 so the critical aspects, the critical aspects of this technology um using this VANET 00:05:12.208-->00:05:17.000 promote greater operational awareness in the highly trafficked environment by the 00:05:17.000-->00:05:20.375 exchange of state information between vehicle and infrastructure points with the 00:05:20.375-->00:05:24.250 idea that this can be homogeneously applied to transportation systems 00:05:24.250-->00:05:30.333 worldwide. Um it's designed to be integratable into the existing transportation network 00:05:30.333-->00:05:37.292 leveraging infrastructure that already exists. Um and in fact some V2X systems are being 00:05:37.292-->00:05:43.500 experimentally deployed um however they’re being developed very much in isolation not um 00:05:43.500-->00:05:49.333 coordinated between standard bodies in different countries. Ergo we are uh the standards as 00:05:49.333-->00:05:55.125 they exist are very much fragmented and disorganized. So we will come back to this 00:05:55.125-->00:06:00.125 though. First uh let's let’s do a little more with the impact of the technology. >>So I guess one 00:06:02.500-->00:06:08.708 of the most important questions to ask is y’know why the h**l should we care about this? Um so 00:06:08.708-->00:06:13.208 transportation is obviously a ubiquitous thing that we all engage in. Everyone has to get 00:06:13.208-->00:06:19.500 somewhere in society. Um not only just people but freight. Uh Industrial processes so the 00:06:19.500-->00:06:24.917 increased levels of automation here and the increased connectivity of these systems 00:06:24.917-->00:06:30.208 unprecedentedly expands the threat landscape present um in terms of the automotive cyber 00:06:30.208-->00:06:34.792 security and more generally in terms of uh the security of critical infrastructure as all 00:06:34.792-->00:06:38.417 of these systems are in some way connected to critical infrastructure in the 00:06:38.417-->00:06:43.417 transportation network. Um so I guess more specifically then what does this mean for 00:06:46.417-->00:06:51.417 consumers? >>Okay. Okay cool. >>Um Uh let’s see. Okay so the deployment of these strong 00:07:04.042-->00:07:09.792 y’know ubiquitous-ubiquitous-ubiquitous ly adopted V2V systems uh have 00:07:09.792-->00:07:13.500 y’know a number of benefits. These are all estimated from the US department of transportation 00:07:13.500-->00:07:18.958 from three pilot studies they ran in Tampa Bay, New York City and I believe Wyoming and uh you 00:07:18.958-->00:07:23.958 see a significant reduction in fatalities, crashes, property damage and y’know significant 00:07:25.958-->00:07:31.167 improvements in traffic throughput in general um roadside optimization. Um so 00:07:31.167-->00:07:36.167 y’know by integrating these systems in with the actual cars you can reduce the stress of the 00:07:39.417-->00:07:46.208 driver uh remove certain safety hazards and just generally improve it for the consumer. 00:07:46.208-->00:07:51.208 >>Uh but uh let’s expand that. Let’s expand that perspective. What’s the impact on the global 00:07:53.958-->00:08:00.792 industry. So this allows us uh to scale V2X technologies across industrial platforms to optimize 00:08:00.792-->00:08:06.000 economic operations right like freight and agriculture. Uh it provides the same kind of 00:08:06.000-->00:08:11.000 enhancement to safety uh of the uh of the operators of the machines. Uh it allows for the 00:08:13.375-->00:08:19.917 synchronization and coordination of logistical operations, right? Think uh air traffic control for 00:08:19.917-->00:08:24.917 trucks. So it-it sheds or enables uh greater transparency to the root uh cause of 00:08:27.042-->00:08:31.542 inefficiencies and failures. Um these are these are what’s attractive right? From from 00:08:31.542-->00:08:38.500 industrial perspective. Um Let’s-let’s keep going, right? What’s the impact on critical 00:08:38.500-->00:08:43.500 infrastructure systems. So, it the VANET outside the context of inter vehicle communications 00:08:48.292-->00:08:53.292 serves as a potential carrier for data in the absence of something like LTE so it’s a uh 00:08:55.625-->00:09:02.500 it’s-it provides access to a, uh, a network that you can easily propagate messages across 00:09:02.500-->00:09:06.875 from one single entry point uh across the national and potentially global 00:09:06.875-->00:09:11.875 transportation network. Um and it uh therefore you can like distribute information about 00:09:16.625-->00:09:22.875 emergency events. You can distribute uh you can use it for distributing uh software updates 00:09:22.875-->00:09:27.458 right to vehicles to infrastructure systems or potentially for the people in 00:09:27.458-->00:09:33.000 this room, you can use it to do a whole lot of uh interesting ward driving and data collection 00:09:33.000-->00:09:36.708 and fuzzing of critical infrastructure systems that simply wasn’t possible before. 00:09:36.708-->00:09:41.708 The-the barrier um to a lot of automoti-automotive security is wireless access I mean we-we’ve 00:09:44.458-->00:09:49.458 seen it’s trivially easy to physically modify CANBUS but can you get in wirelessly well not 00:09:52.208-->00:09:57.208 you eliminate having to break a 4G modem um now we have a wifi like protocol that is becoming 00:10:01.583-->00:10:07.958 standardized in every consumer vehicle that doesn’t use strong authentication or encryption or 00:10:07.958-->00:10:13.167 association that you can rapidly propagate information across um arbitrarily and compromise from 00:10:13.167-->00:10:18.167 one single entrance point. That is pretty cool, right? Um now. >>So, So uh y’know what’s the 00:10:20.708-->00:10:25.708 impact for automotive security in general? I mean Duncan went over some of the points but uh I 00:10:29.292-->00:10:34.292 guess generally the exposure of this wireless attack surface means that you can very rapidly 00:10:36.500-->00:10:41.708 propagate messages from one point to another. Say you are at the bottom of some highway 00:10:41.708-->00:10:45.750 system and you send a message off to one car that carries it to another car, they carry it to 00:10:45.750-->00:10:51.083 another and so on and so on and now all of a sudden you’re in New York. Um, so that’s y’know a 00:10:51.083-->00:10:57.583 huge impact and beyond that you can actually do uh sort of packet sniffing. You can place 00:10:57.583-->00:11:01.708 either on the road- y’know on the roadside little sniffers or have your car y’know actively 00:11:01.708-->00:11:06.083 while driving and actually listening to these this traffic and reconstruct behavioral 00:11:06.083-->00:11:10.333 profiles of the cars as they move across the road and this allows you to reverse engineer 00:11:10.333-->00:11:14.542 some of their behaviors. You can send probe responses, try to figure out what firmware they’re 00:11:14.542-->00:11:19.792 running, or potentially. And use that knowledge of their firmware and their system architecture to 00:11:19.792-->00:11:24.792 actually exploit. Um right. So that means that you can hack cars easier than has ever been 00:11:27.208-->00:11:32.208 possible before. But it also means that your cars are gonna get hacked a lot easier. 00:11:34.417-->00:11:39.417 [inaudible off mic] >>Okay. Um so here’s some here’s some examples of some of the features 00:11:41.833-->00:11:45.875 that are intended to be implemented through these uh coordinated systems. So we have 00:11:45.875-->00:11:51.792 uh collision avoidance so say you have a blind spot. A car in front of you y’know off to the 00:11:51.792-->00:11:56.667 blind spot is gonna send a message and say “hey I’m here.” Now you know they’re there so 00:11:56.667-->00:11:59.917 you don’t hit them. Um advanced driver assistance, uh cooperative adaptive cruise 00:11:59.917-->00:12:05.167 control, which is where you have um messages cascading back throughout traffic to try and 00:12:05.167-->00:12:10.000 synchronize how the cars actually accelerate and deccelerate to y’know optimize 00:12:10.000-->00:12:16.292 the gaps between them and y’know make traffic smoother. And of course you have things like 00:12:16.292-->00:12:21.292 y’know, automated ticketing, automated tolling and other y’know application level um 00:12:23.958-->00:12:28.958 products that we’ll-we’ll go into a bit later. Uh so this gives our primary motivation for 00:12:32.292-->00:12:38.208 developing this y’know free and open source and easily accessible V2X stack so that we 00:12:38.208-->00:12:44.750 can and you can communicate using just y’know a Linux box with some cheap hardware and 00:12:44.750-->00:12:51.083 mess around with these systems >>And participate and participate in the national and 00:12:51.083-->00:12:56.083 potentially global VANET. Um so let’s talk vision. Um Vision of socket V2V our platform right is 00:13:00.167-->00:13:07.000 uh the history, history tells us that security through obscurity leads to inevitable PWNing. Um 00:13:07.000-->00:13:12.375 we have allowed security standards for safety critical systems to be developed behind 00:13:12.375-->00:13:18.958 closed doors and in the general case those have developed these standards have wildly failed us. 00:13:18.958-->00:13:25.167 Um this is the counterpoint of our vision here in releasing this. We are providing a means 00:13:25.167-->00:13:31.458 for security researchers and global researchers alike to participate in the development 00:13:31.458-->00:13:38.208 of the V2X standards because they affect us. They affect our daily lives and our families. 00:13:38.208-->00:13:43.208 Our Wives and our children if uh if we could ever find them. Um they um and the deployment of 00:13:45.792-->00:13:52.250 another set of weak standards will inevitably lead to the compromise of systems that are 00:13:52.250-->00:13:56.417 integral to the continuing functioning of our society. It's not just a transportation 00:13:56.417-->00:14:00.500 network but what will the transportation network, the connected transportation network 00:14:00.500-->00:14:06.167 touch. It will touch financial systems. It will touch energy. And like all of the thirteen or 00:14:06.167-->00:14:11.208 so current infrastructure sectors alone alike as we move into higher levels of 00:14:11.208-->00:14:16.625 automation. Um this is why perhaps it's particularly interesting to all of us here. 00:14:16.625-->00:14:23.417 From hacking uh cars using wifi we can potentially gain access to a-the global transportation 00:14:23.417-->00:14:30.833 infrastructure and to the energy systems that control it. Um so this is neat for us but at the 00:14:30.833-->00:14:39.625 same time there’s a clear uh need to make this-these standards not suck as badly as 00:14:39.625-->00:14:50.750 they have before. Um so, we uh let’s see. The biggest, probably the selling point here is that 00:14:50.750-->00:14:54.792 previously to do this it required a two to five to ten thousand dollar DSRC radio. We 00:14:54.792-->00:14:59.417 are enabling you to do it with a twenty dollar commercial off the shelf wifi card that can run 00:14:59.417-->00:15:05.000 five gigahertz. Um and we’ll tell you the couple simple modifications you need to make 00:15:05.000-->00:15:11.500 to your standard Linux Kernel and pretty much after you take our stack and compile it in your 00:15:11.500-->00:15:14.958 Kernel and make a few little changes to our W you can immediately start participating 00:15:14.958-->00:15:22.292 in the VANET which pretty much doesn’t really exist yet. Um and that’s why we’re giving it you. 00:15:22.292-->00:15:30.542 So a little background. Uh began development circa 2015. Um there had been a good amount of uh of 00:15:30.542-->00:15:35.708 work done and published previously in this space which we quickly found was um 00:15:35.708-->00:15:40.667 non-existent, non-functional. Pretty much every project that had been started had been 00:15:40.667-->00:15:46.625 orphaned. Um, or those that they stated they were developing an open source made them closed 00:15:46.625-->00:15:51.875 source and um or they’re no longer compliant as they’re being deployed. So um we 00:15:51.875-->00:16:00.958 basically spent. Took me two years of digging deep into the soulless chasm that is Linux 00:16:00.958-->00:16:08.875 Kernel driver development and at last have managed to service here again. Um and now I would 00:16:08.875-->00:16:17.708 say V2V is more real than it had ever been before. Um, so we already touched on some of these 00:16:17.708-->00:16:23.125 motivations but just to reiterate a little bit. Increase in automation leads to increase 00:16:23.125-->00:16:26.333 in attack service. Um the industry is calling for proprietary closed source 00:16:26.333-->00:16:34.458 implementation of V2V. Well lets think about this for a moment. The standards are incomplete and 00:16:34.458-->00:16:42.417 bound for change. In fact, the security uh layer of the V2X standards is non existent as it 00:16:42.417-->00:16:48.750 stands today so, so OEM, as big corporate is going closed source uh and developing these 00:16:48.750-->00:16:54.417 standards in isolation while the standards are b-well developing these systems in isolation while 00:16:54.417-->00:16:57.417 the standards are bound for change. This will inevitably lead to the deployment of 00:16:57.417-->00:17:01.333 obsolete systems and hinder the development of V2V any further. And it's already happening 00:17:01.333-->00:17:07.875 today. So um this is one of the lessons we learned from previous epic failure. Right? Um closed 00:17:07.875-->00:17:16.667 source leads to weakness. Um and also Kernel dev is hard, y’know you keep you keep using those 00:17:16.667-->00:17:21.542 words Kernel dev. I don’t I don’t think they mean what you think they mean. This is an 00:17:21.542-->00:17:26.125 example right of uh, we we pulled this from a patch that was submitted to the main Linux 00:17:26.125-->00:17:32.333 Kernel developer thinking uh thinking he was enabling ADEX 11P which is the physical layer 00:17:32.333-->00:17:37.167 of the V2X stack. Well if you, if you look right here I commented something out “WTF.” 00:17:37.167-->00:17:43.333 If it’s this frame return false. If it’s this return false. This return false. Otherwise return 00:17:43.333-->00:17:48.000 false, right? So pretty much the accepted solution is completely dysfunctional with like no frame 00:17:48.000-->00:17:50.583 whatever would actually be accepted and passed through the wireless interface. That took a- 00:17:50.583-->00:17:56.042 that took about a year to find in y’know the billions of lines of code. And this is- this is 00:17:56.042-->00:18:00.167 one of the many many many critical mistakes. While there’s things that are very very 00:18:00.167-->00:18:06.000 partially implemented and then widely accepted as functional. Um just simply isn’t true and it 00:18:06.000-->00:18:12.042 took two years of clawing my eyes out to, to get here. To tell you that. Um so let’s see. 00:18:12.042-->00:18:22.750 Now we’re gonna do a stack overview. Uh Real quick. >>So, yeah. Okay. Oop. Is it working? 00:18:22.750-->00:18:26.375 >>Yeah Buddy. >>So we’ll start at the uh the physical layer of this stack. That is eight oh two 00:18:26.375-->00:18:32.958 eleven P. This operates on uh five point eight to five point nine gigahertz um OFDM. Um five 00:18:32.958-->00:18:40.333 to ten megahertz sub character width. And uh right above that we got um I triple E sixteen oh 00:18:40.333-->00:18:43.917 nine four. Which is the multichannel operation modes. It determines how you switch 00:18:43.917-->00:18:47.000 between the service channel and the control channel. Y’know service channel has well 00:18:47.000-->00:18:51.375 services and control channel has privileged controls that propagate through the network. 00:18:51.375-->00:18:56.458 Um and then going above that even further we have sixteen oh nine three. Which handles the 00:18:56.458-->00:19:02.583 messaging coding for the short messages that are used as the primitives in communication. And 00:19:02.583-->00:19:12.042 we also have things that uh deal with the uh RF parameters um the uh routing advertisements, the 00:19:12.042-->00:19:17.500 service advertisements y’know and so on. And at the application layer there’s J2735. 00:19:17.500-->00:19:24.667 Which it contains basic safety messages um emergency vehicle alerts and roadside alerts. As 00:19:24.667-->00:19:31.167 long as y’know um along with many others. And those are y’know packed inside of the 00:19:31.167-->00:19:36.875 short messages that end up getting down and dispatched finally along the physical layer 00:19:36.875-->00:19:48.917 of eight oh two eleven P. Um. Yep. >>So um so to quickly go over each of those in a little 00:19:48.917-->00:19:55.583 bit more depth. Um eight oh two eleven P comprised the physical and MAC layer of the V2X stack. 00:19:55.583-->00:20:04.333 Um as so right the kernel components are um five ten megahertz uh with subcarriers 00:20:04.333-->00:20:07.417 using a DM over five point nine gigahertz. Five point eight to five point nine gigahertz. Uh 00:20:07.417-->00:20:13.833 frequency band. Um reserve freeze by intelligent transportation systems. Um using 00:20:13.833-->00:20:17.958 multicast addressing with no association, no authentication, no encryption this is specified 00:20:17.958-->00:20:24.667 to uh exist at a higher layer. Um such as in the sixteen oh nine NJ twenty-seven 00:20:24.667-->00:20:32.042 thirty-five. Um and the uh and to define this networking mode called OCB mode uh out of 00:20:32.042-->00:20:37.833 context it would be assessed that pretty much uh allows you. Its-its like ad hoc mesh 00:20:37.833-->00:20:44.417 networking just with the beaconing association, authentication, encryption all 00:20:44.417-->00:20:55.083 disabled. Um so next is wave DSR. Oh! Oh! Oh buddy. Looks like you got a little preview 00:20:55.083-->00:21:04.375 thereof our entire presentation, um. Alright here we are. >>So a WAVE, slash DSRC, so wave is the 00:21:04.375-->00:21:09.458 basis of the wave short message protocol. WAVE stands for Wireless Access in Vehicular 00:21:09.458-->00:21:13.167 Environments specified in I triple E sixteen oh nine. So it's an encoding scheme and its 00:21:13.167-->00:21:18.833 also management plan for V2V so that includes multi channel operation uh service identifier 00:21:18.833-->00:21:26.208 allocations, um y’know all of the stuff you might expect in this kind of ad hoc networking 00:21:26.208-->00:21:30.708 that allows the communication of the kind of fields you would expect in vehicles. Y’know 00:21:30.708-->00:21:40.875 location, telemetry, um trajectory, these kinds of things. Um, Kay and J 00:21:40.875-->00:21:46.083 twenty-seven- oh sorry. This is a WAVE, this is an example of a WAVE short message so you can 00:21:46.083-->00:21:50.708 see that this is a- a fairly bare bones. Y’know Quite literally a hello world example. 00:21:50.708-->00:21:55.583 So you have the version, the subtype, information element block which is similar to that 00:21:55.583-->00:22:00.083 found in other y’know eight oh two dot eleven stuff. And then at the bottom here we have um 00:22:00.083-->00:22:04.208 y’know the transfer interfire which determines how the message is actually forwarded along the 00:22:04.208-->00:22:10.208 network whether it hops or floods out. And then we have the data field which contains hello 00:22:10.208-->00:22:20.500 world. >>This brings us to the advocation layer. SAE J2735. Um provides a grammar and and 00:22:20.500-->00:22:26.500 dictionary set of safety messages in interoperating V2V systems. So probably the most uh 00:22:26.500-->00:22:32.250 common example is the basic safety message uh a message that will be continuously transmitted 00:22:32.250-->00:22:37.417 at a periodic interval between every member of the VANET to exchange state information about 00:22:37.417-->00:22:42.250 say the dimensionality of the car, heading, acceleration. So you can uh use this to to y’know 00:22:42.250-->00:22:48.208 do predictive optimization of the traffic flow. Um there’s collision avoidance which uh is 00:22:48.208-->00:22:54.000 exchanged when there’s a collision imminent to try and and and reduce or uh mitigate 00:22:54.000-->00:23:01.917 the harm to the driver and the and the and the stan- and those standing nearby. Um there’s 00:23:01.917-->00:23:09.042 emergency vehicle alerts which the emergency vehicles will use to um y’know modify traffic flow 00:23:09.042-->00:23:12.417 in the event that like an ambulance needs to get through or uh or a cop wants to pull you 00:23:12.417-->00:23:22.458 over. Um so say or in like the case of a natural disaster. Um really what this this allows you 00:23:22.458-->00:23:31.250 to do is um. Define um, y’know autonomously define direction or behavior that will happen um 00:23:31.250-->00:23:40.708 independent of the driver in order to, to create a safer VANET. Um by y’know by orders of 00:23:40.708-->00:23:46.625 magnitude has it been has it been sited in studies for the last fifteen years. So this is a 00:23:46.625-->00:23:50.750 great idea, right? This is, this sounds awesome and people have been talking about it since 2004 00:23:50.750-->00:23:56.583 and people have been making slides and presentations and nobody’s really been doing 00:23:56.583-->00:24:01.125 anything and the standards are continually getting changed and there. And we’re going to talk a 00:24:01.125-->00:24:06.833 little bit now actually uh about the the state of the standards. Um the, there have been multiple 00:24:06.833-->00:24:15.625 major revisions made to, uh to WAVE and to J2735 and they are not backwards compatible. Um 00:24:15.625-->00:24:25.417 they have, they lack a complete trust management framework. Um they-the current uh the current 00:24:25.417-->00:24:30.208 standards that are deployed are proprietary and closed source uh and incomplete. And-so this is a 00:24:30.208-->00:24:36.792 clear attempt at monopolization of the connected vehicle industry but it’s the-the 00:24:36.792-->00:24:43.542 inevitable outcome is the development of uh is the deployment of-of an incomplete, 00:24:43.542-->00:24:48.708 obsolete and vulnerable platforms. Um some, let’s-let’s go a little more in depth about 00:24:48.708-->00:24:58.792 these changes, right? >>Okay so some of the major changes that we’ve seen uh is that the-the 00:24:58.792-->00:25:02.625 certificate management system has actually been totally overhauled uh they-they’ve added 00:25:02.625-->00:25:07.292 um support for some implicit certificates and also a peer to peer certificate distribution 00:25:07.292-->00:25:13.000 system. Um there have been proposals for a trust management system that use uh misbehavior 00:25:13.000-->00:25:17.042 reporting so like y’know if you listen to a car next to you and they do something you don’t like 00:25:17.042-->00:25:19.958 you report em and then if enough people report em they’ll eventually get their certificate 00:25:19.958-->00:25:25.167 revoked. I mean that’s the idea. Um obviously that is uh quite a number of ways to actually 00:25:25.167-->00:25:31.417 manipulate that potentially. Um and y’know the-the J2735 standard has been completely 00:25:31.417-->00:25:36.958 overhauled. Several times. Such that y’know the old encodings don’t even work. Like at all. 00:25:36.958-->00:25:42.625 And we y’know with respect to the new encoding so the question is y’know how are these 00:25:42.625-->00:25:49.667 completely incompatible, not backwards compatible systems and systems where the security is 00:25:49.667-->00:25:55.208 just totally influx supposed to actually work properly without exposing huge vulnerabilities. 00:25:55.208-->00:26:01.083 And the answer is, they’re not supposed to work. I mean. >>So we-we like to call this possibly 00:26:01.083-->00:26:07.542 unintentional obfuscation of the standards, right? Um cause we’re-we’re gonna allow the 00:26:07.542-->00:26:13.833 possibility that this could be somewhat on this-this could possibly be a mistake, right? Um 00:26:13.833-->00:26:19.542 we in-in revisions of the J2735 uh measures verification codes CRCs are moved from emergency 00:26:19.542-->00:26:24.375 vehicle alerts from roadside advertisements. Um and some of these there almost no 00:26:24.375-->00:26:28.083 specification given for a lot of design choices. I mean here’s-here’s some pulled out of 00:26:28.083-->00:26:36.333 uh the trip sixteen oh nine spec. Um th-this guy here effect a receipt, nothing. So we see 00:26:36.333-->00:26:40.917 there’s ambiguity right? And what does ambiguity mean in terms of communication systems? 00:26:40.917-->00:26:47.917 Um it means that there’s a, yet another attack service in-in the way the messages are received. 00:26:47.917-->00:27:01.000 Um so uh like what gives, right? What fricken gives? Um >>To go over some of the subtleties that 00:27:01.000-->00:27:05.458 are uh in the protocol y’know to drive home the point a little bit. Uh there are typing 00:27:05.458-->00:27:09.375 congruity and there’s actually there’s type redundancy in these messages so you actually have 00:27:09.375-->00:27:13.417 lower layer protocols that will specify, or lower layer segments of the protocols that’ll specify 00:27:13.417-->00:27:17.875 certain things like location and GPS data and they’ll also be redundantly specified on the 00:27:17.875-->00:27:21.542 high level-higher layer protocols. And if these two things are incompatible. Y’know 00:27:21.542-->00:27:26.500 the values are different then you can actually have issues where you can confuse the 00:27:26.500-->00:27:33.542 software and y’know cause the car to go swerve off somewhere. Um the-the actual uh encoding of 00:27:33.542-->00:27:42.958 the um sixteen oh nine messages is-it’s a little poor I mean so there-there are points in some 00:27:42.958-->00:27:49.625 of the routing advertisements where there’s actually a byte that uh depending on who you 00:27:49.625-->00:27:55.292 interpret in the committee should be there or maybe shouldn’t be there. Um so that 00:27:55.292-->00:27:59.167 can-that can lead to very obvious parsing issues. That can just cause memory to crash and 00:27:59.167-->00:28:04.333 do whatever. Uh and the channel switching mechanisms on single antenna systems are actually 00:28:04.333-->00:28:10.458 such that you can um you can jam the actual, the effectively jam the communications for however 00:28:10.458-->00:28:16.708 long you want just by broadcasting off sync with the rest of the network and that can 00:28:16.708-->00:28:21.208 just shut down communication and disrupt peer to peer sift gear distribution and no one can talk 00:28:21.208-->00:28:35.167 in some closed area for a very long time. >>So um what does the, are we on attack services 00:28:35.167-->00:28:40.625 yet? No. No. Attack surfaces. Um in the-so let-let’s move on to the juicy interesting stuff here 00:28:40.625-->00:28:46.792 right? Um what are the attack surfaces for uh V2X. Uh Well the entire VA network is accessible 00:28:46.792-->00:28:52.833 from one single endpoint. Um due to the-the ad hoc mesh nature of it so you can propagate a 00:28:52.833-->00:28:59.375 message uh from one single point of entry. Uh massively distribute malware uh of course 00:28:59.375-->00:29:05.958 it was meant for safety information. Um you compromise one radio in one vehicle and 00:29:05.958-->00:29:11.292 that could be a compromise due to a proprietary implementation uh weakness. Then you can 00:29:11.292-->00:29:16.708 therefore potentially compromise all vehicles um in the nearby proximity uh which would 00:29:16.708-->00:29:22.583 propagate to the global network. Um you can highjack emergency vehicle authority uh and execute 00:29:22.583-->00:29:27.208 services like platooning that are built into the V2X standards. Uh in order to 00:29:27.208-->00:29:34.250 disable uh vehicles um y’know for law enforcement uh or whatever reason y’know some of 00:29:34.250-->00:29:37.458 you might want to make your vehicle stop in the middle of the road on a, in the middle of 00:29:37.458-->00:29:44.917 the highway. Um so what does the adversary look like? Um a passive adversary can do y’know 00:29:44.917-->00:29:53.333 sniffing and mapping of the uh of the network uh both in terms of y’know mapping uh services 00:29:53.333-->00:29:58.000 that are available built into the sixteen oh nine standards and those that are left reserved 00:29:58.000-->00:30:02.875 for the manufacturers to implement. So what this means is diagnostic functions built into 00:30:02.875-->00:30:11.500 DSRC that allow you to execute uh routines on y’know on-on each vehicle. Um and there’s a lot of 00:30:11.500-->00:30:17.042 services that are defined and there’s a lot of that are left very ambiguous in the sixteen oh 00:30:17.042-->00:30:25.958 nine standards. Um what else? Let’s see. We can uh gain a lot of visibility into the global 00:30:25.958-->00:30:32.500 transportation network that is gonna be rather unique to the individual right. So think if 00:30:32.500-->00:30:38.583 you can understand um where y’know the nature of the economic operations in terms of 00:30:38.583-->00:30:42.417 the transportation network. You know where our supply and distribution networks are 00:30:42.417-->00:30:48.708 operating poorly and efficiently then you can perform arbitrage and and-and gain y’know economic 00:30:48.708-->00:30:57.667 advantage. Um and then use it for y’know for-for evil s**t right? Uh but more interesting, 00:30:57.667-->00:31:04.000 what is the active adversary look like? Uh I mean he might look like that. Um uh he could 00:31:04.000-->00:31:10.542 he might perform denial of service, man in the middle attacks between vehicles and 00:31:10.542-->00:31:13.875 infrastructure points so you can manipulate the misbehavior reporting schemes for example. 00:31:13.875-->00:31:19.792 Um you can disrupt vehicle traffic uh and target individuals. Not just 00:31:19.792-->00:31:25.667 individuals you can target uh y’know classes of systems so not only perform y’know target 00:31:25.667-->00:31:35.458 individual, uh you can target a company or a corporate entity or a s-some kind of other um 00:31:35.458-->00:31:41.500 governing body that uh that uses these kinds of systems that is gonna use it highly proprietary 00:31:41.500-->00:31:50.083 or-or highly specific uh you custom tailored implementation of it. Um I-and and I mean 00:31:50.083-->00:31:56.917 who-who wants to deal with that guy right there? He looks like a d**k. Um so now if we consider 00:31:56.917-->00:32:01.583 the threat model that we introduced earlier from a theoretical level and then apply 00:32:01.583-->00:32:04.833 what the information gave you about the state of the standards etcetera, how does the threat 00:32:04.833-->00:32:14.250 model change? >>So the-the threat model that we have um in light of this information so we 00:32:14.250-->00:32:20.958 can corrupt traffic over the air wirelessly on y’know on the road. You can use the um 00:32:20.958-->00:32:25.458 diagnostic information and the DSRC radios to manipulate and control vehicles, exfiltrate 00:32:25.458-->00:32:29.625 data, do whatever the h**l you want. You can use the RF signatures of the actual radios 00:32:29.625-->00:32:34.958 on these things to break the pseudonym uh and non the pseudonymity schemes that they 00:32:34.958-->00:32:40.042 use to try and protect the identity of drivers. So what they do is uh you randomize your 00:32:40.042-->00:32:43.625 MAC address and your certificates time out and you generate new certificates but 00:32:43.625-->00:32:47.833 the problem with this is that if you have great enough visibility over the network you can 00:32:47.833-->00:32:53.083 trivially track this and identify anyone as they move across the road regardless of 00:32:53.083-->00:33:00.500 this, y’know kind of like slapped on attempt at anonymity. Um so obviously V2V has quite a 00:33:00.500-->00:33:07.792 number of problems and you know our solution right is to. So just put it on Linux >>Yeah man 00:33:07.792-->00:33:15.083 just use Linux dude. Uh just use Linux. So, um, right we we have this free and open source 00:33:15.083-->00:33:21.583 platform uh that is uh I mean its. So we have a little asterisk here its platform 00:33:21.583-->00:33:27.250 independence. It’s uh accessible in a generic Linux environment so it's uh we we took the V2X 00:33:27.250-->00:33:33.542 stack and implemented it in the Linux kernel network and subsystems. The asterisk there 00:33:33.542-->00:33:40.417 is because uh hardware that manufacture- uh manufacturers specify a regulatory domain in 00:33:40.417-->00:33:43.625 the hardware that they’ve produced so you have to go into the driver and make slight 00:33:43.625-->00:33:48.208 modifications to participate in the intelligent transportation bands um but past that the 00:33:48.208-->00:33:52.875 modifications to each driver are pretty slight right now. We have published support for atheros 00:33:52.875-->00:33:59.500 9k. We’re extending it to RTL wifi um and y’know ideally soon enough to-to all standard um 00:33:59.500-->00:34:08.208 networking driver architectures. Um so just use Linux. It’s-it’s always-it's never been that easy 00:34:08.208-->00:34:14.708 right? Um how we do this, uh first we’ll start with eight oh two eleven P. So we’ll go up up 00:34:14.708-->00:34:20.500 the stack um. You just define the ad definitions for the intelligent transportation 00:34:20.500-->00:34:26.250 channels in the wifi drivers so this one we stick in the atheros 9k. The same one goes into RTL 00:34:26.250-->00:34:33.667 etcetera. Uh next you uh modify the kernel and you just space regulatory domains uh so this is 00:34:33.667-->00:34:41.500 what we’re saying um the, the FCC and the-the manufacturers alike so specify um a specific 00:34:41.500-->00:34:45.708 regulatory domain that you’re allowed to use in each country so you can pretty easily modify 00:34:45.708-->00:34:50.042 this by going and doing a little bit of kernel hacking and forcing uh the kernel to accept 00:34:50.042-->00:34:56.083 a regulatory domain that you specify. Um so what we do here is we add the intelligent 00:34:56.083-->00:35:02.917 transportation bands. Um make it OCB only because there’s no channel sharing um uh etcetera 00:35:02.917-->00:35:08.583 and we do the same thing here in the atheros driver on the bottom um and then we add support for 00:35:08.583-->00:35:16.125 filtering of eight oh two eleven P frames. Um so this is just a function that we that we’ve 00:35:16.125-->00:35:20.417 pulled we stuck it in there and we did the sorts of frames you accept uh management data um and 00:35:20.417-->00:35:31.500 QRS frames and then >>Uh you just make to-to finish the uh integration eight oh two eleven 00:35:31.500-->00:35:39.042 P the um modify standard Lin-uh Linux space utilities so desired W. Uh the wireless reg DP which 00:35:39.042-->00:35:44.833 we went over a second ago and CRDA so in IW. What we do is add uh you specify command that 00:35:44.833-->00:35:49.958 allows you to join an OCB channel. Specify the uh frequency and the uh megahertz 00:35:49.958-->00:35:54.167 whether you’re gonna use five or ten megahertz with sub carriers. Uh we add definitions for the 00:35:54.167-->00:36:00.708 five and ten megahertz uh with sub carriers in uh in the IW regulatory domain and using uh 00:36:00.708-->00:36:07.958 the command specified above you can see we’ve successfully joined uh a y’know an OCB five 00:36:07.958-->00:36:13.083 gigahertz network. Uh we published the code to do this in in the github group that we’ll 00:36:13.083-->00:36:20.917 give you at the end. Um so moving up to.. >>Moving up sorry moving up to uh wave or sixteen 00:36:20.917-->00:36:26.333 oh nine. So we have to specify or rather we had to specify all the relevant data structures you 00:36:26.333-->00:36:31.792 know the short message, service advertisements, the routing advertisements and-and so on. Um 00:36:31.792-->00:36:36.250 and all y’know full modificati-er full ability to modify any of the fields in 00:36:36.250-->00:36:40.667 there to create custom packets that you just inject off to the wireless interface and send over 00:36:40.667-->00:36:47.708 the air. Um as well as uh managing the channels uh channel synchronization and channel 00:36:47.708-->00:36:54.333 hopping and um just the MAC level extensions of the actual uh management plane in-inside 00:36:54.333-->00:37:06.500 y’know. Inside the operations. Click. Click. [inaudible off mic] >>Okay Um so okay so the 00:37:06.500-->00:37:17.292 usage of the uh WSMP so you have the ability to take the structs that are defined and encode 00:37:17.292-->00:37:21.500 them, conversely decode them as they come over the air cause they’ll come up through a socket 00:37:21.500-->00:37:28.458 interface and you just take the byte stream and decode it. And uh use the user specified WSMP 00:37:28.458-->00:37:34.542 packets using libpcap or y’know whatever you want to just inject it into the wireless interface 00:37:34.542-->00:37:44.167 and it’s-it’s there. It’s on the air. So this is the uh the WSM struct. The wave short message. 00:37:44.167-->00:37:50.875 This is a top level structure of the actual message encoding. This um specifies the transport 00:37:50.875-->00:37:54.958 identifier which is how the message will actually be routed across the network. Whether 00:37:54.958-->00:38:04.500 you’re gonna hop y’know however many times you want. And also uh the um the data fields and all 00:38:04.500-->00:38:11.750 of the ancillary data gets packed into here. So this is the, this is the information 00:38:11.750-->00:38:17.958 element extension which includes the RF parameters um the routing information and all, all of this 00:38:17.958-->00:38:24.167 other fun stuff.Uh and other ancillary structures that include y’know routing 00:38:24.167-->00:38:30.250 advertisements, service advertisements, channel info and service info. Right? >>So then 00:38:30.250-->00:38:38.833 how do we apply this? Um we take some of the uh, we-we define J2735 uh critical messages uh 00:38:38.833-->00:38:44.375 somewhat based on the, the SA provided it, broken ASN1 spec that we fixed and made a heck of 00:38:44.375-->00:38:47.708 a lot more pretty and then you see we just filled up with uh parameters that are compliant 00:38:47.708-->00:38:54.667 within the limitations of uh of each field. Then what we can do, generate a WSM message as uh he 00:38:54.667-->00:39:01.083 just showed uh and these-these fields are uh are from the sample uh given y’know a couple, 00:39:01.083-->00:39:07.667 twenty slides up. Uh We serialize it using a-a encoding function that we wrote. Uh well 00:39:07.667-->00:39:13.917 first we pack the basic safety meshes that we made right here. And you pack it right into the 00:39:13.917-->00:39:19.625 data field of the WSM uh serialize it and dispatch it to uh the wireless interface using 00:39:19.625-->00:39:26.417 peak app inject and the result is um successfully transmitted WSMP messages. So Wireshark has 00:39:26.417-->00:39:32.708 a-a plugin for WSMP uh that’s-that’s outdated uh doesn’t uh support the current 00:39:32.708-->00:39:38.542 coding types but it sorta at least sorta recognized what uh what we did here. Uh figured 00:39:38.542-->00:39:44.833 given the-the nature of the week we would avoid uh doing uh a wireless demo with 5G tech. Um 00:39:44.833-->00:39:51.708 But, what we can see here is we successfully transmit and inject a WSM message. Uh using Linux 00:39:51.708-->00:39:58.583 open source stack and an atheros 9K twenty dollar wifi chip. Uh and now you can do this too, 00:39:58.583-->00:40:05.083 right? So the exact same thing is possible for the other types of safety messages using the 00:40:05.083-->00:40:09.958 exact same methodology so we show an emergency vehicle alert, roadside advertisement. You pack 00:40:09.958-->00:40:15.833 it into the um into the WSM struct and you can, you can serialize and transmit it um 00:40:15.833-->00:40:21.542 just as easy and actually start interfacing with infrastructure and connected vehicle systems 00:40:21.542-->00:40:27.750 that exist today in isolation. Um so yeah what are you gonna do with this? You wanna be a 00:40:27.750-->00:40:32.250 master? Uh You wanna pwn some connected vehicles? Well we’re gonna sorta go here in 00:40:32.250-->00:40:38.542 increasing level of uh of when. >>Right so level one would be you can imagine a denial of 00:40:38.542-->00:40:42.500 service, so f**k with the channel synchronization and just kind of disrupt the network, 00:40:42.500-->00:40:46.958 prevent people from broadcasting. It's very possible for single antenna systems. I’m 00:40:46.958-->00:40:52.958 sure there are more clever ways to do it by breaking the parsers. Um stage two, sorry, 00:40:52.958-->00:40:58.042 level two would be to enumerate, essentially map out all of the proprietary services offered at 00:40:58.042-->00:41:03.250 the application layer to get an understanding of the attack surface of each car and actually 00:41:03.250-->00:41:13.125 exploit that. [inaudible off mic] Oh oh. Okay. Level-sorry level three would be uh sir 00:41:13.125-->00:41:17.625 masquerading as a toll booth so um electronic toll collection is actually a future imple- er 00:41:17.625-->00:41:23.958 future um aspect of this technology so if you’re able to hijack that- hijack that 00:41:23.958-->00:41:28.292 certificate you can essentially prop up a mobile toll station and go around collecting fare 00:41:28.292-->00:41:33.625 from everyone y’know as you pass by. Uh then of course you bump up a little bit and you can 00:41:33.625-->00:41:37.917 start dealing with emergency vehicles y’know going-uh pretend you’re a squad car and uh force 00:41:37.917-->00:41:43.125 someone to pull over. >>I’m an ambulance. And if you really want to be a elite maybe you can 00:41:43.125-->00:41:48.875 figure out how to execute the platooning service that’s built into J2735 that lets you uh take 00:41:48.875-->00:41:54.667 full control uh or rather assume direct control of any vehicle particip-participating in the 00:41:54.667-->00:42:02.625 VANET, right? But um I think we have a few more types of pwning here right? Um what do we got? 00:42:02.625-->00:42:11.792 What do we got? We can not read at all. Um so, you can you can pwn in a bunch more clever ways 00:42:11.792-->00:42:18.875 um but really it really-this isn’t just about pwning vehicles. Um completely. This is 00:42:18.875-->00:42:24.833 about providing an interface that allows you to participate in the development of secure 00:42:24.833-->00:42:29.917 good standards by hacking them so we’re using all these evil superpowers to deploy systems 00:42:29.917-->00:42:38.125 that will be homogenous in transportation systems worldwide. Um we don’t want 00:42:38.125-->00:42:44.125 another CANBUS. We-we don’t want um to-to get stuck with a fully deployed completely vulnerable 00:42:44.125-->00:42:53.167 arbitrarily hackable uh network protocol alright? So we give this to you so that we together 00:42:53.167-->00:42:59.583 can make something that doesn’t suck, y’know in layman's terms, right? Um as always hack the 00:42:59.583-->00:43:06.750 planet. See what you can break. Use it to make the world better and please come and uh please 00:43:06.750-->00:43:10.667 reach out to us with any thoughts, ideas, questions. We are releasing this. It’s posted 00:43:10.667-->00:43:14.500 already on Github. Um you can find us in the car hacking village. We’re giving a talk 00:43:14.500-->00:43:18.792 immediately after this at three o’clock and we’ll be in the car hacking village afterwards at 00:43:18.792-->00:00:00.000 four. Um so thank you Def Con. [applause]