1 00:00:00,000 --> 00:00:07,060 My name's Corey. I'm going to be talking about, the title of the talk for this was Insecure by Law, 2 00:00:07,260 --> 00:00:15,180 but we're going to be talking about hacking heavy trucks and the dongles and whatnot that are associated with each. 3 00:00:16,540 --> 00:00:23,920 I work as a senior security researcher at IOactive, and prior to this I did some auto dongle work 4 00:00:23,920 --> 00:00:30,440 under a company called Digital Bond, doing the progressive dongle research. 5 00:00:31,540 --> 00:00:38,940 Basically, for me, what gets me hot about cars is when we start connecting third-party aftermarket stuff 6 00:00:38,940 --> 00:00:42,060 and expanding the tech surface and making it more interesting, 7 00:00:42,200 --> 00:00:49,620 because cars by themselves are sort of insecure by design, in my opinion, and we're not really going to fix that. 8 00:00:49,860 --> 00:00:51,360 We'll get into that in just a minute. 9 00:00:51,820 --> 00:00:53,900 So, basic overview of what we're going to talk about. 10 00:00:53,920 --> 00:00:56,660 What we're going to talk about is we're going to go through a real quick can primer. 11 00:00:56,920 --> 00:01:00,860 We're going to talk about heavy trucking, because that's important to this particular research, 12 00:01:01,040 --> 00:01:03,060 understanding the context of why this matters. 13 00:01:03,340 --> 00:01:06,420 Because heavy trucking, even though a lot of the technologies are the same, 14 00:01:07,160 --> 00:01:13,020 fundamentally and culturally and its impact on the world is a little bit different. 15 00:01:13,220 --> 00:01:17,100 And then we'll go into the analysis of some of the logging devices that we got, 16 00:01:17,260 --> 00:01:22,500 talk about this cool little event that happened about three weeks ago called the Cybertruck Challenge, 17 00:01:22,680 --> 00:01:23,900 and then we'll go through. 18 00:01:23,920 --> 00:01:26,180 And then we'll go through the summary of what came up. 19 00:01:27,880 --> 00:01:33,240 So, back to sort of what I had jumped in earlier when it comes to car hacking. 20 00:01:33,360 --> 00:01:37,480 If you haven't spent time sitting down in the village out there or looking at different stuff, 21 00:01:37,600 --> 00:01:41,060 sending some CAN bus messages and that kind of thing, I encourage you to do so. 22 00:01:43,020 --> 00:01:49,200 But when we talk about car hacking, in my opinion, it's a little bit interesting and kind of boring at the same time, 23 00:01:49,260 --> 00:01:53,580 because when you're talking about CAN bus and then vehicle messages, 24 00:01:53,920 --> 00:01:58,800 you're really talking about an 8-byte payload maximum and then an arbitration ID. 25 00:01:58,960 --> 00:02:01,820 So, you've got an address and a payload, and there's no authentication. 26 00:02:02,440 --> 00:02:07,060 There's no anything on there. 27 00:02:07,160 --> 00:02:08,420 It's just a basic bus. 28 00:02:08,620 --> 00:02:14,180 So, when you talk about car hacking and you're looking for controlling a vehicle with these types of messages, 29 00:02:15,880 --> 00:02:19,160 with different auto manufacturers, they use different IDs to mean the same thing. 30 00:02:19,280 --> 00:02:23,900 So, for a GM, for example, the ID that shows... 31 00:02:23,920 --> 00:02:27,960 shows you what the RPM is on the bus, that transmits what the current RPM of the engine is, 32 00:02:28,480 --> 00:02:30,140 might be different than another one. 33 00:02:30,380 --> 00:02:33,360 And then it might be a different offset within that payload, too. 34 00:02:33,460 --> 00:02:38,940 So, the address might be 310, and then the RPMs might be the last two bytes. 35 00:02:39,480 --> 00:02:42,960 The first two bytes are some kind of flag setup, for an example. 36 00:02:43,340 --> 00:02:49,520 And when it comes to car hacking, these are the kinds of messages that people are usually talking about 37 00:02:49,520 --> 00:02:51,760 when you're doing reverse engineering of vehicles. 38 00:02:51,960 --> 00:02:53,580 So, when Charlie and Chris were doing stuff, 39 00:02:53,920 --> 00:02:57,500 when other people have gone through and published car hacking things, 40 00:02:57,560 --> 00:03:01,520 mostly the hard problem when it comes to car hacking is figuring out what messages do what. 41 00:03:03,760 --> 00:03:08,400 But, when I look at it, I mean, that's very interesting, and that is a hard problem, 42 00:03:08,480 --> 00:03:11,360 but it's kind of boring because you're not going to ever fix this. 43 00:03:11,860 --> 00:03:17,680 And it's insecure by design, is the term that I'm borrowing from industrial control systems, 44 00:03:17,820 --> 00:03:19,680 which is where I came from before getting into auto. 45 00:03:20,340 --> 00:03:23,640 And the realization that this is a broken protocol, 46 00:03:23,920 --> 00:03:26,420 and we're not going to be able to put, really, security on top of it. 47 00:03:26,760 --> 00:03:33,360 So, when it comes to that, I get interested when we add on a different attack surface. 48 00:03:33,500 --> 00:03:39,320 So, when we're putting a dongle in between this insecure bus and the Internet, 49 00:03:40,020 --> 00:03:43,160 that's when I'm really like, okay, well, we should take this seriously, 50 00:03:43,180 --> 00:03:47,340 because, yes, this is insecure by itself, but it's not until you start connecting it. 51 00:03:47,400 --> 00:03:50,060 Same thing with power plants, which is where I was before. 52 00:03:50,580 --> 00:03:53,300 When we started connecting those, and people want to control 53 00:03:53,300 --> 00:03:55,520 and monitor their plants from their living room on a Saturday, 54 00:03:56,140 --> 00:03:59,820 nobody wants to drive 40 miles out to a substation in the middle of nowhere 55 00:03:59,820 --> 00:04:02,720 to do something when you can use remote connectivity to do it. 56 00:04:02,800 --> 00:04:03,740 So, the advantages are there. 57 00:04:03,900 --> 00:04:04,960 Same thing with auto. 58 00:04:05,240 --> 00:04:08,480 We want to get as much telematics off of an engine as we can, 59 00:04:08,540 --> 00:04:11,740 so we can do things like predictive failure analysis, like really cool shit. 60 00:04:12,160 --> 00:04:17,740 But that also means that we're taking these broken, fundamentally broken things 61 00:04:17,740 --> 00:04:19,180 and then connecting them to the Internet. 62 00:04:19,620 --> 00:04:22,560 And so that's where the attack surface increases, 63 00:04:23,340 --> 00:04:25,560 where it gets pretty interesting, just from my perspective. 64 00:04:27,540 --> 00:04:29,300 So, we're going to depart all that. 65 00:04:29,440 --> 00:04:31,640 Basically, what I said was more on the passenger vehicle side, 66 00:04:31,800 --> 00:04:33,220 and now we're going to talk about trucks, 67 00:04:33,680 --> 00:04:37,100 because trucks, they do use CAN bus underneath them, 68 00:04:37,180 --> 00:04:39,180 but it works quite a bit differently. 69 00:04:40,500 --> 00:04:45,360 So, the United States, for one thing, because that's what I have statistics on, 70 00:04:45,440 --> 00:04:47,760 heavily, heavily depends on the trucking industry. 71 00:04:47,900 --> 00:04:52,320 The idiom in the trucking industry is, if you bought it, a truck brought it. 72 00:04:53,540 --> 00:04:58,360 And if the trucking industry goes down, there are three days, 73 00:04:58,440 --> 00:05:01,120 one day before you can no longer get fuel at gas stations, 74 00:05:01,320 --> 00:05:06,640 three days before you can no longer get food and items off of your grocery store, 75 00:05:06,860 --> 00:05:08,720 department store, Walmart, shelves. 76 00:05:09,200 --> 00:05:13,700 So, this is critical infrastructure to the United States of America. 77 00:05:13,860 --> 00:05:19,380 The trucking industry is significantly important when it comes to just keeping our lives operating. 78 00:05:20,460 --> 00:05:23,140 There are, the other thing to note about the trucking industry, 79 00:05:23,140 --> 00:05:28,300 is there are regulations that prevent drivers from overexerting themselves, driving too long, 80 00:05:28,440 --> 00:05:30,480 and all that is recorded in log books. 81 00:05:30,960 --> 00:05:36,580 So, a driver has to record how long they were driving, when they took a lunch, that kind of a thing. 82 00:05:37,000 --> 00:05:39,680 And so, you're limited to make sure that everybody's safe, right? 83 00:05:39,740 --> 00:05:42,200 There's a good reason that we have those regulations in place. 84 00:05:42,480 --> 00:05:47,100 But the problem is that checking log books is fairly tedious, and people can lie. 85 00:05:47,320 --> 00:05:50,600 And we don't want those truckers lying to us in our log books. 86 00:05:50,660 --> 00:05:52,900 We want to make sure that they're obeying all the rules, 87 00:05:53,540 --> 00:05:56,740 because naturally you're incentivized to move as much product as possible, 88 00:05:56,920 --> 00:05:59,340 maximize your profits, that kind of thing. 89 00:05:59,400 --> 00:06:01,840 Or sometimes you just want to get home earlier than before. 90 00:06:02,640 --> 00:06:09,440 And so, when people are going around our regulation, the natural solution is to add more regulation. 91 00:06:09,580 --> 00:06:10,540 It's like brute force, right? 92 00:06:10,800 --> 00:06:12,660 If brute force isn't working, you're not using enough. 93 00:06:12,780 --> 00:06:15,800 If regulation isn't working, we're just going to add more. 94 00:06:16,340 --> 00:06:17,920 And that's how we're going to solve this problem. 95 00:06:18,280 --> 00:06:19,500 So, that's what they did. 96 00:06:21,360 --> 00:06:23,120 And there are other reasons for it. 97 00:06:23,140 --> 00:06:29,280 Not just solving the log book fraud or misused problem. 98 00:06:29,520 --> 00:06:33,640 But the government mandated these electronic logging devices. 99 00:06:34,040 --> 00:06:40,540 So, there was a law passed that said, by December 2017, all trucks have to have this electronic logging device. 100 00:06:40,720 --> 00:06:44,800 And that's what we're going to use to monitor and make sure that everybody's obeying the regulations 101 00:06:45,520 --> 00:06:50,220 and get some extra gravy on top in terms of what kind of analytics we can do on that data. 102 00:06:50,680 --> 00:06:52,880 And it is 444 pages long. 103 00:06:54,300 --> 00:06:55,120 Which is awesome. 104 00:06:56,240 --> 00:07:01,680 And that's the kind of thing that somebody who's going to manufacture these dongles or use the dongles or what not, 105 00:07:01,740 --> 00:07:06,040 they have to go through, sort through that, and make sure that they're compliant. 106 00:07:08,480 --> 00:07:13,220 So, in looking through the 444 pages, I'm just going to highlight a couple awesome gems for you. 107 00:07:13,480 --> 00:07:17,820 So, I went to the table of contents and I'm like, quality assurance, alright, that's probably where security lives. 108 00:07:18,440 --> 00:07:21,100 And it's right here, the entirety of it. 109 00:07:21,180 --> 00:07:22,600 It says, insert quality assurance. 110 00:07:23,420 --> 00:07:24,220 Section here. 111 00:07:24,440 --> 00:07:29,940 And this is the finalized out, these are the guidelines in those 444 pages. 112 00:07:30,120 --> 00:07:33,120 So, the quality assurance section is non-existent. 113 00:07:33,360 --> 00:07:39,520 And that's where, I mean, that's, security is sort of glorified QA, really. 114 00:07:40,480 --> 00:07:43,860 Making sure that the system does what it's supposed to do and that it doesn't do anything else. 115 00:07:44,000 --> 00:07:45,100 That's what security is all about. 116 00:07:45,340 --> 00:07:49,620 So, to have these sections empty is a little concerning. 117 00:07:51,000 --> 00:07:52,500 But there is some good. 118 00:07:53,140 --> 00:07:54,080 So, this section is in the 444 pages. 119 00:07:54,440 --> 00:08:01,280 If anybody's ever worked in the government or known anybody, putting these documents together can be a process. 120 00:08:02,860 --> 00:08:09,820 But this particular section, I think someone was in charge of writing this particular section and they maybe knew a thing or two. 121 00:08:10,560 --> 00:08:20,920 But under, so this section is under certain circumstances, like if there's an officer at the vehicle and there's Wi-Fi on, but there's not cellular and not Bluetooth. 122 00:08:20,920 --> 00:08:26,100 And it's the, Mars is in the fourth quadrant of the universe. 123 00:08:26,340 --> 00:08:34,780 Then you apply this section and this is the only mention of TLS or an SSL, any kind of secure communications. 124 00:08:35,140 --> 00:08:38,220 So, in this, like this one section, then we're talking about it. 125 00:08:38,280 --> 00:08:41,160 So, but it's in the document, so it's there somewhere. 126 00:08:41,840 --> 00:08:50,040 But then, when it comes to actually figuring out how, whether a device implements this is trouble. 127 00:08:50,200 --> 00:08:50,900 So, let's say you're a developer. 128 00:08:50,900 --> 00:08:54,440 You're a dongle manufacturer and you want to get in on this sweet cheddar that's coming out. 129 00:08:54,560 --> 00:08:57,380 The government's mandating something, so there's going to be guaranteed money there. 130 00:08:57,500 --> 00:09:03,640 So, let's go ahead and even though we're, we make macaroni and cheese for our business, I think we can probably get in on this. 131 00:09:03,860 --> 00:09:06,360 Get some of that awesome, awesome money coming out. 132 00:09:06,880 --> 00:09:08,340 So, you say, 444 pages. 133 00:09:08,660 --> 00:09:12,900 Man, how are we going to make a dongle that meets all the requirements in there? 134 00:09:13,120 --> 00:09:13,740 But it's okay. 135 00:09:13,780 --> 00:09:17,880 You don't have to worry because the only requirement is that you have self-certification. 136 00:09:20,220 --> 00:09:20,880 So, if you say, well, I don't know. 137 00:09:20,900 --> 00:09:24,500 If you self-certify that you meet all the requirements, then you're good. 138 00:09:25,140 --> 00:09:26,360 Then everything's great. 139 00:09:26,680 --> 00:09:27,420 You're awesome. 140 00:09:27,580 --> 00:09:28,640 You're going to start making some money. 141 00:09:28,740 --> 00:09:33,060 You're going to get on the list of all the approved dongles and be good to go. 142 00:09:33,280 --> 00:09:37,120 And the list is maintained by the FMCSA. 143 00:09:38,020 --> 00:09:44,620 It is, they don't make any, obviously the government doesn't make any charge that you actually meet the requirements. 144 00:09:44,920 --> 00:09:46,760 This is the reason for self-certification. 145 00:09:47,040 --> 00:09:50,540 If you've ever been in that government, then you totally understand. 146 00:09:50,540 --> 00:09:51,200 Why they did that? 147 00:09:51,280 --> 00:09:55,680 Because that takes the liability off of you and puts it on the people who make the dongle. 148 00:09:55,960 --> 00:09:58,900 But there are over 70 at the time of this screenshot. 149 00:09:59,160 --> 00:10:01,680 I'm sure it's increased probably lately. 150 00:10:02,120 --> 00:10:03,180 But there's a lot of them. 151 00:10:03,560 --> 00:10:10,140 And so, you can just go and get any of these and that will do your electronic logging for you. 152 00:10:10,720 --> 00:10:13,800 What they end up, what they tend to look like is something like this. 153 00:10:14,540 --> 00:10:18,900 So, this one is available at Walmart. 154 00:10:20,540 --> 00:10:25,840 So, as a sort of consequence to this mandate, you've got guaranteed money there. 155 00:10:25,980 --> 00:10:28,260 So, you've got a bunch of people entering the market with stuff. 156 00:10:28,440 --> 00:10:36,040 And as consequence then, the barrier goes real low in terms of how commoditized the hardware is. 157 00:10:36,160 --> 00:10:37,800 How commoditized the solution is. 158 00:10:37,940 --> 00:10:39,740 And this particular one is available at Walmart. 159 00:10:40,100 --> 00:10:46,040 There are also some that are in, if you go to a truck stop, you can probably walk the shelves in the trucking area. 160 00:10:46,240 --> 00:10:50,080 And you'll find ELDs prepackaged on the shelf. 161 00:10:50,080 --> 00:10:51,040 Ready to pull up. 162 00:10:51,100 --> 00:10:51,940 And then you just plug it in. 163 00:10:52,020 --> 00:10:52,700 And then now you're compliant. 164 00:10:54,640 --> 00:10:57,100 So, it's heavily, heavily commoditized. 165 00:10:57,260 --> 00:10:58,660 There's a lot of players in the space. 166 00:10:59,480 --> 00:11:02,060 And the only requirement is that they're self-certified. 167 00:11:04,040 --> 00:11:07,060 But as we go forward, it is actually still under contention. 168 00:11:07,120 --> 00:11:10,340 There are people who have some altruistic reasons. 169 00:11:11,800 --> 00:11:16,740 But this bill was just put into, I had to just add this slide because it was just added two weeks ago, I think. 170 00:11:17,540 --> 00:11:20,060 A representative from Texas put this bill forward. 171 00:11:20,060 --> 00:11:23,660 To try and kick back the adoption another two years. 172 00:11:23,820 --> 00:11:24,780 So they want to extend it. 173 00:11:26,220 --> 00:11:31,460 They cited cyber security vulnerabilities or cyber security concerns as one of the reasons. 174 00:11:31,660 --> 00:11:32,400 So that's significant. 175 00:11:33,360 --> 00:11:35,300 At least we're being used as a scapegoat. 176 00:11:35,840 --> 00:11:38,320 Even if it's not actually true. 177 00:11:38,420 --> 00:11:42,360 But hey, either way, somebody's going to care about cyber security, hopefully, as we go forward. 178 00:11:42,460 --> 00:11:45,740 Or maybe nothing will change and then it's just going to be two years before they're required to adopt it. 179 00:11:46,060 --> 00:11:46,740 I don't know. 180 00:11:47,260 --> 00:11:49,040 Depending on how cynical you are. 181 00:11:49,040 --> 00:11:50,680 You may fall on one side or another. 182 00:11:51,260 --> 00:11:53,460 But the other reason is there's logistical concerns. 183 00:11:53,820 --> 00:12:01,680 Because there are some, like livestock, get exemptions to the driving rules and that kind of a thing. 184 00:12:01,780 --> 00:12:05,660 So they're trying to make sure that their business is protected by this ELD thing. 185 00:12:05,980 --> 00:12:10,640 And I suspect it's actually less about the cyber security. 186 00:12:12,060 --> 00:12:15,480 So after we saw all this and we get excited. 187 00:12:15,580 --> 00:12:16,620 Like alright, there's a bunch of them. 188 00:12:16,680 --> 00:12:18,200 Let's go shopping. 189 00:12:19,040 --> 00:12:19,460 So we did. 190 00:12:19,720 --> 00:12:20,920 And we picked up. 191 00:12:21,080 --> 00:12:23,140 So as a caveat, this research. 192 00:12:23,180 --> 00:12:25,820 If you are a POC or GTFO person. 193 00:12:25,960 --> 00:12:27,600 Then you can probably GTFO. 194 00:12:27,740 --> 00:12:33,560 Because I'm not dropping a full payload weaponized ODAY or anything right now. 195 00:12:33,600 --> 00:12:36,300 The whole point of this research was a breadth first. 196 00:12:36,560 --> 00:12:37,600 Not depth first. 197 00:12:38,420 --> 00:12:42,900 To try and figure out how to hack a particular dongle and come up with an exploit. 198 00:12:43,100 --> 00:12:44,780 With a Metasploit module. 199 00:12:44,960 --> 00:12:45,820 That's not what the point was. 200 00:12:45,820 --> 00:12:47,840 The point was to get a few of these things. 201 00:12:48,260 --> 00:12:53,040 And see what the general security set up was with these commoditized dongles. 202 00:12:54,140 --> 00:12:55,900 Because especially when there's 70 of them. 203 00:12:55,960 --> 00:12:59,400 I didn't want to get in the position where we got one of them and that happened to be the bad one. 204 00:12:59,500 --> 00:13:00,300 But the rest of them were good. 205 00:13:00,620 --> 00:13:04,640 So we did a breadth first search of the dongles to figure out what's going on. 206 00:13:05,240 --> 00:13:07,920 So we got ELDs from three different manufacturers. 207 00:13:08,560 --> 00:13:10,200 Again these are consumer off the shelf. 208 00:13:10,320 --> 00:13:12,260 You just go pick them up or you order them directly from them. 209 00:13:12,740 --> 00:13:14,620 The suppliers were chosen at random. 210 00:13:15,100 --> 00:13:15,460 So. 211 00:13:16,380 --> 00:13:18,100 But again being a breadth first. 212 00:13:18,200 --> 00:13:20,480 This was more to get a sense of the industry. 213 00:13:21,080 --> 00:13:23,600 And so I'm not trying to pick on any given supplier. 214 00:13:24,260 --> 00:13:25,160 In any of this. 215 00:13:25,340 --> 00:13:26,960 So please as another caveat. 216 00:13:27,080 --> 00:13:28,220 Do not take this to say. 217 00:13:28,440 --> 00:13:31,340 If I have a suppliers name or I'm holding one right here. 218 00:13:31,440 --> 00:13:33,160 That does not mean that these guys are the only bad guys. 219 00:13:33,980 --> 00:13:36,060 But I will give you a particular tip about this one. 220 00:13:36,120 --> 00:13:36,580 Because it's cool. 221 00:13:38,020 --> 00:13:38,960 So going forward. 222 00:13:40,020 --> 00:13:40,780 We got them. 223 00:13:40,860 --> 00:13:41,440 We ordered them. 224 00:13:41,880 --> 00:13:43,320 And we started off great. 225 00:13:45,820 --> 00:13:47,120 So we got some emails to sign up. 226 00:13:47,200 --> 00:13:49,460 Because almost all of these have companion apps or back end stuff. 227 00:13:50,200 --> 00:13:50,880 And so. 228 00:13:51,260 --> 00:13:53,060 It's like here you know address. 229 00:13:53,340 --> 00:13:55,560 And they put the password in a get parameter. 230 00:13:56,020 --> 00:13:57,320 Like that's a small vulnerability. 231 00:13:57,720 --> 00:13:58,480 It's not really a big deal. 232 00:13:58,580 --> 00:13:59,320 People do it all the time. 233 00:13:59,500 --> 00:14:02,500 But that was the first experience with any of these. 234 00:14:02,700 --> 00:14:04,660 So it was sort of like alright. 235 00:14:06,720 --> 00:14:09,300 The bar for the average. 236 00:14:09,480 --> 00:14:11,880 In terms of what I've grown to expect out of hardware stuff. 237 00:14:12,000 --> 00:14:12,520 Is pretty low. 238 00:14:12,880 --> 00:14:14,780 And so far it looks like we're par for the course. 239 00:14:15,820 --> 00:14:16,160 We're starting out. 240 00:14:16,720 --> 00:14:17,620 So we got them. 241 00:14:17,740 --> 00:14:20,060 And then we began to do some hardware analysis. 242 00:14:20,380 --> 00:14:22,000 So that's this one taken apart. 243 00:14:22,940 --> 00:14:25,680 And it's actually just a very simple one board. 244 00:14:25,780 --> 00:14:27,360 With a daughter cellular board. 245 00:14:27,600 --> 00:14:29,740 But it comes down to an ARM processor. 246 00:14:31,060 --> 00:14:32,160 Some spy flash. 247 00:14:32,600 --> 00:14:33,840 And a CAN transceiver. 248 00:14:34,000 --> 00:14:34,660 And that's it. 249 00:14:35,020 --> 00:14:35,460 Basically. 250 00:14:35,640 --> 00:14:36,800 We're talking very simple. 251 00:14:36,880 --> 00:14:37,620 Very minimal. 252 00:14:37,760 --> 00:14:38,980 How cheap can we make this thing. 253 00:14:39,200 --> 00:14:40,560 How fast can we get it out to market. 254 00:14:45,820 --> 00:14:47,600 And then it has a cellular daughter board. 255 00:14:48,360 --> 00:14:48,840 As well. 256 00:14:48,960 --> 00:14:51,120 And you can see if anybody does any hardware hacking. 257 00:14:51,320 --> 00:14:52,980 There's some interesting pads there. 258 00:14:53,520 --> 00:14:54,620 That were fun to play with. 259 00:14:55,100 --> 00:14:55,780 The connector. 260 00:14:56,100 --> 00:14:57,000 Which is not exposed. 261 00:14:57,360 --> 00:14:58,900 You'll see that connector over at the top. 262 00:14:58,940 --> 00:15:00,520 Not exposed here. 263 00:15:02,680 --> 00:15:04,180 But if you take the top of this thing off. 264 00:15:04,300 --> 00:15:06,140 Which is kind of what I was hoping somebody had a pin for. 265 00:15:06,260 --> 00:15:07,060 But that's alright. 266 00:15:08,800 --> 00:15:11,940 And then this is another example of one similar type thing. 267 00:15:12,100 --> 00:15:12,800 You've got your processor. 268 00:15:12,960 --> 00:15:13,700 You've got your spy flash. 269 00:15:15,820 --> 00:15:16,740 And then a bunch of power regulation. 270 00:15:16,940 --> 00:15:17,580 And that kind of a thing. 271 00:15:17,740 --> 00:15:21,760 And usually with some kind of communications chip on top. 272 00:15:21,900 --> 00:15:23,300 That they speak with over. 273 00:15:23,960 --> 00:15:25,140 Over serial line. 274 00:15:25,980 --> 00:15:27,320 In order to do the communications. 275 00:15:28,320 --> 00:15:29,620 And then another one. 276 00:15:29,660 --> 00:15:30,400 Looks like this. 277 00:15:30,460 --> 00:15:32,500 This one is interesting because this one has a screen. 278 00:15:33,180 --> 00:15:34,660 So it's a little bit more complicated. 279 00:15:34,920 --> 00:15:36,520 So there's some other cool stuff. 280 00:15:37,120 --> 00:15:37,900 Playing with it. 281 00:15:38,360 --> 00:15:40,700 This one's also interesting because this one. 282 00:15:41,240 --> 00:15:42,620 Doesn't plug into the truck. 283 00:15:43,140 --> 00:15:43,620 So. 284 00:15:44,360 --> 00:15:45,100 Spoiler alert. 285 00:15:45,240 --> 00:15:46,460 This one's the most secure. 286 00:15:47,180 --> 00:15:50,860 In terms of whether you're affecting the truck or not. 287 00:15:51,240 --> 00:15:52,300 But unfortunately. 288 00:15:52,360 --> 00:15:53,700 You can't legally use this one. 289 00:15:53,940 --> 00:15:54,780 Because legally. 290 00:15:55,700 --> 00:15:57,280 As the document says. 291 00:15:57,520 --> 00:15:59,460 It's required to plug into the truck. 292 00:15:59,540 --> 00:16:00,680 To get information out of the truck. 293 00:16:01,100 --> 00:16:01,500 So. 294 00:16:03,300 --> 00:16:03,780 Unfortunately. 295 00:16:05,000 --> 00:16:06,100 But they're self certified. 296 00:16:06,280 --> 00:16:07,080 So maybe it's fine. 297 00:16:10,480 --> 00:16:11,740 And this is similar. 298 00:16:12,620 --> 00:16:12,760 But underneath. 299 00:16:12,760 --> 00:16:13,940 There's a lot more components in here. 300 00:16:14,000 --> 00:16:15,840 Because we've got a screen and a printer on it. 301 00:16:16,040 --> 00:16:16,760 Which was cool. 302 00:16:16,900 --> 00:16:17,400 So this one. 303 00:16:17,800 --> 00:16:19,880 If you want the full log book out. 304 00:16:19,980 --> 00:16:20,940 Then you go and it prints it. 305 00:16:21,700 --> 00:16:24,400 And then you can hand that to your regulation officer. 306 00:16:25,300 --> 00:16:26,200 This is another one. 307 00:16:26,320 --> 00:16:27,080 Another screen. 308 00:16:27,140 --> 00:16:27,560 The same one. 309 00:16:27,980 --> 00:16:29,100 Ribbon cable that goes out. 310 00:16:29,180 --> 00:16:29,660 And that kind of thing. 311 00:16:29,800 --> 00:16:32,560 And the SIM there for cellular back end communications. 312 00:16:33,200 --> 00:16:33,680 But again. 313 00:16:42,620 --> 00:16:42,960 Plug in. 314 00:16:43,060 --> 00:16:45,720 And then you feed the cable to the unit. 315 00:16:46,820 --> 00:16:48,620 So after doing some hardware analysis. 316 00:16:49,120 --> 00:16:49,760 Pulling flash. 317 00:16:51,060 --> 00:16:51,460 Grabbing. 318 00:16:52,000 --> 00:16:53,640 Seeing if we could get the debug going. 319 00:16:53,880 --> 00:16:54,380 That kind of thing. 320 00:16:54,460 --> 00:16:55,480 Then you jump into the software. 321 00:16:55,880 --> 00:16:57,380 And of course the first thing that you do. 322 00:16:57,440 --> 00:16:58,440 Is the best hacker tool ever. 323 00:16:58,780 --> 00:16:59,180 Strings. 324 00:16:59,820 --> 00:17:01,980 Is the first step that I always do. 325 00:17:02,160 --> 00:17:04,440 Whenever I'm going to look at new firmware or anything. 326 00:17:04,640 --> 00:17:06,560 Because interesting things pop out of there. 327 00:17:07,160 --> 00:17:08,440 So like here we've got. 328 00:17:12,620 --> 00:17:13,940 But you've got full path. 329 00:17:14,120 --> 00:17:17,380 To somebody's directory structure. 330 00:17:17,700 --> 00:17:20,120 For how they were building out the project. 331 00:17:20,400 --> 00:17:21,240 His name is Jenkins. 332 00:17:22,260 --> 00:17:23,720 Which is an awesome name. 333 00:17:24,420 --> 00:17:26,160 So I imagine like they're sitting around. 334 00:17:26,420 --> 00:17:27,080 And the team is like. 335 00:17:27,160 --> 00:17:27,580 God Jenkins. 336 00:17:27,820 --> 00:17:29,500 We need to get this pushed out right away. 337 00:17:29,920 --> 00:17:30,560 And so. 338 00:17:32,780 --> 00:17:33,260 Okay. 339 00:17:37,640 --> 00:17:38,600 Oh okay. 340 00:17:38,940 --> 00:17:39,420 Alright. 341 00:17:39,660 --> 00:17:40,280 Damn it. 342 00:17:40,300 --> 00:17:41,380 You ruined my awesome story. 343 00:17:42,620 --> 00:17:43,000 I was unfamiliar with that. 344 00:17:43,520 --> 00:17:44,740 I was unfamiliar with that. 345 00:17:44,780 --> 00:17:45,220 You foiled it. 346 00:17:45,280 --> 00:17:45,520 Sorry. 347 00:17:45,800 --> 00:17:48,020 Can I choose to disbelieve the truth. 348 00:17:48,240 --> 00:17:49,400 And imagine that. 349 00:17:50,540 --> 00:17:51,220 I'm just kidding. 350 00:17:51,320 --> 00:17:52,000 No I appreciate that. 351 00:17:52,120 --> 00:17:52,880 I didn't know that actually. 352 00:17:54,680 --> 00:17:55,340 Oh okay. 353 00:17:55,520 --> 00:17:55,720 Okay. 354 00:17:56,900 --> 00:17:57,260 Cool. 355 00:17:57,840 --> 00:17:59,360 So this might be some of that same. 356 00:17:59,640 --> 00:18:00,980 No this one was from a different unit. 357 00:18:01,160 --> 00:18:03,480 So this is not the one that was built out of Jenkins. 358 00:18:12,620 --> 00:18:14,060 But what it comes down to is you're seeing. 359 00:18:14,460 --> 00:18:15,960 Like again this was a breadth research. 360 00:18:16,260 --> 00:18:16,980 So it was mostly like. 361 00:18:17,060 --> 00:18:19,220 How are they using like stir copy. 362 00:18:20,580 --> 00:18:22,960 Insecure band functions that we shouldn't be using anymore. 363 00:18:23,360 --> 00:18:25,220 Let's use memory safe versions instead. 364 00:18:25,440 --> 00:18:26,180 That kind of a thing. 365 00:18:26,340 --> 00:18:27,660 So basic software analysis. 366 00:18:27,920 --> 00:18:30,120 Again we weren't trying to get POC. 367 00:18:31,240 --> 00:18:32,520 Or anything like that on there. 368 00:18:33,140 --> 00:18:33,540 So. 369 00:18:35,100 --> 00:18:36,840 You don't have to just take my word for it. 370 00:18:36,940 --> 00:18:37,320 Either. 371 00:18:37,700 --> 00:18:40,020 When it comes to what the security. 372 00:18:40,680 --> 00:18:41,940 Opinion of these devices are. 373 00:18:42,700 --> 00:18:43,860 So like I mentioned. 374 00:18:44,140 --> 00:18:44,960 About three. 375 00:18:45,060 --> 00:18:46,180 Maybe it was four weeks ago now. 376 00:18:46,280 --> 00:18:47,440 Since we've been in Vegas for a week. 377 00:18:49,240 --> 00:18:51,880 They had a cyber security challenge. 378 00:18:52,120 --> 00:18:52,860 Out in Detroit. 379 00:18:53,960 --> 00:18:56,160 Where the Army TARDEC. 380 00:18:57,020 --> 00:18:57,400 Sponsored. 381 00:18:58,100 --> 00:18:58,700 This event. 382 00:18:59,180 --> 00:19:01,640 Where they brought out students from 12 different universities. 383 00:19:02,040 --> 00:19:03,680 12 is the correct number I believe. 384 00:19:03,860 --> 00:19:04,880 Universities and community colleges. 385 00:19:05,560 --> 00:19:07,080 So there was two days of class. 386 00:19:07,260 --> 00:19:08,120 And then two days of hands on. 387 00:19:08,120 --> 00:19:09,520 So we had a couple trucks that were there. 388 00:19:09,640 --> 00:19:11,020 The students actually got to plug in. 389 00:19:11,280 --> 00:19:13,200 And so it was kind of like the car hacking village. 390 00:19:14,040 --> 00:19:15,620 Except in a more controlled environment. 391 00:19:16,780 --> 00:19:18,240 And with a little bit of hands on. 392 00:19:19,100 --> 00:19:19,740 Class learning. 393 00:19:19,860 --> 00:19:20,760 And that kind of a thing as well. 394 00:19:21,280 --> 00:19:22,080 And none of these. 395 00:19:22,960 --> 00:19:24,280 Well I won't say none. 396 00:19:24,400 --> 00:19:26,440 But most of the students had never done any hardware hacking. 397 00:19:26,820 --> 00:19:28,760 Had never had any exposure or anything like that. 398 00:19:28,840 --> 00:19:29,620 To any of this stuff. 399 00:19:29,960 --> 00:19:32,100 And so they got to come in and play with things. 400 00:19:32,220 --> 00:19:32,860 They had a bunch of. 401 00:19:32,860 --> 00:19:33,740 They had like multimeters. 402 00:19:34,380 --> 00:19:35,180 Soldering irons. 403 00:19:36,140 --> 00:19:36,720 Chip readers. 404 00:19:36,860 --> 00:19:37,540 That kind of thing there. 405 00:19:37,600 --> 00:19:38,960 Available for them to use. 406 00:19:39,260 --> 00:19:40,260 And it was a really cool event. 407 00:19:41,000 --> 00:19:43,460 But if you know anything about the trucking industry. 408 00:19:45,500 --> 00:19:46,640 It's an interesting culture. 409 00:19:46,920 --> 00:19:48,780 And they didn't want to talk about this event. 410 00:19:48,880 --> 00:19:49,840 In the public very much. 411 00:19:50,020 --> 00:19:50,740 Which I think is unfortunate. 412 00:19:51,040 --> 00:19:51,800 Because it's really cool. 413 00:19:52,400 --> 00:19:55,620 And they're sort of going forward in terms of cyber security. 414 00:19:55,700 --> 00:19:56,300 Thinking about it. 415 00:19:56,340 --> 00:19:57,620 Trying to encourage people to look at stuff. 416 00:20:02,860 --> 00:20:03,780 And see if it was authorized or not. 417 00:20:04,300 --> 00:20:06,740 But there was this article in the Detroit Free Press about it. 418 00:20:07,680 --> 00:20:08,920 And it was a really cool event. 419 00:20:09,460 --> 00:20:09,820 But the. 420 00:20:09,960 --> 00:20:12,900 So the students tore apart this particular one. 421 00:20:12,980 --> 00:20:13,700 That I'm talking about here. 422 00:20:15,500 --> 00:20:16,200 Extracted the. 423 00:20:16,500 --> 00:20:18,180 So this is in one day actually. 424 00:20:18,360 --> 00:20:19,440 So for only one day. 425 00:20:19,520 --> 00:20:21,500 That they spent down looking at it. 426 00:20:21,600 --> 00:20:23,100 And I'll give a shout out to Grim. 427 00:20:23,580 --> 00:20:25,540 Mitch from Grim was one of the instructors. 428 00:20:25,800 --> 00:20:27,060 Who sort of walked them through. 429 00:20:27,400 --> 00:20:30,400 And encouraged them as they were learning about this. 430 00:20:31,020 --> 00:20:32,040 So shout out to them. 431 00:20:32,860 --> 00:20:33,680 This is what they did. 432 00:20:33,780 --> 00:20:35,560 They extracted the firmware over single wire debug. 433 00:20:36,100 --> 00:20:38,080 Because the debug interface is wide open on this. 434 00:20:38,140 --> 00:20:39,160 As it ships out from the factory. 435 00:20:40,780 --> 00:20:41,760 There's lack of encryption. 436 00:20:41,960 --> 00:20:43,880 In any of the firmware or communications. 437 00:20:44,560 --> 00:20:46,500 They were able to do basic dynamic analysis. 438 00:20:46,940 --> 00:20:47,740 Using GDB. 439 00:20:48,680 --> 00:20:50,420 But ultimately the student opinion. 440 00:20:50,600 --> 00:20:51,700 Of the device security. 441 00:20:52,660 --> 00:20:54,520 Is low to nonexistent. 442 00:20:56,220 --> 00:20:56,660 Unfortunately. 443 00:20:57,220 --> 00:20:58,920 But so the reason that I said. 444 00:20:59,000 --> 00:21:00,000 I was going to tell you something cool about this. 445 00:21:00,000 --> 00:21:01,100 I think this sort of ties into here. 446 00:21:01,260 --> 00:21:02,560 Because this is between. 447 00:21:02,940 --> 00:21:04,820 I think it's around 150 bucks for this thing. 448 00:21:05,300 --> 00:21:07,000 But there are other like tool kits. 449 00:21:07,140 --> 00:21:07,880 To help you do. 450 00:21:08,120 --> 00:21:09,660 To get into truck hacking. 451 00:21:09,800 --> 00:21:12,060 Or interfaces to communicate on the bus of the truck. 452 00:21:12,680 --> 00:21:14,820 And some of those go for thousands of dollars. 453 00:21:15,700 --> 00:21:17,580 But if you just buy one of these. 454 00:21:17,940 --> 00:21:19,660 Then you've got bluetooth access. 455 00:21:20,000 --> 00:21:22,060 To the truck bus. 456 00:21:23,640 --> 00:21:24,220 For pretty cheap. 457 00:21:24,500 --> 00:21:24,940 Really. 458 00:21:25,040 --> 00:21:26,440 When I'm working on it. 459 00:21:26,520 --> 00:21:28,620 I prefer a beagle bone with a canvas cape. 460 00:21:30,000 --> 00:21:31,100 And controlling stuff that way. 461 00:21:31,200 --> 00:21:33,300 But this is really a great alternative. 462 00:21:33,420 --> 00:21:33,920 Because it's open. 463 00:21:33,980 --> 00:21:35,160 You can flash your own firmware to it. 464 00:21:35,240 --> 00:21:37,760 It's really straightforward to get your own thing on there. 465 00:21:37,860 --> 00:21:38,620 So if you buy one of these. 466 00:21:38,840 --> 00:21:41,000 It can become your truck hacking interface. 467 00:21:41,500 --> 00:21:43,760 Instead of buying some expensive thing otherwise. 468 00:21:43,940 --> 00:21:45,000 Or if you don't want to mess with wires. 469 00:21:45,280 --> 00:21:46,940 And getting connectors and stuff like that. 470 00:21:47,040 --> 00:21:47,900 If you're doing a beagle bone. 471 00:21:48,100 --> 00:21:50,140 Then this is a great compact package. 472 00:21:50,740 --> 00:21:51,480 For all of that. 473 00:21:53,040 --> 00:21:54,720 So I'm not sure that I would recommend it. 474 00:21:54,760 --> 00:21:55,260 As an ELD. 475 00:22:00,000 --> 00:22:00,480 Conclusions. 476 00:22:00,540 --> 00:22:01,360 Security overview. 477 00:22:02,380 --> 00:22:02,900 Again. 478 00:22:03,000 --> 00:22:04,300 The bar is fairly low. 479 00:22:05,660 --> 00:22:08,080 And everything was basically par for the course. 480 00:22:08,520 --> 00:22:10,100 Devices were shipping with debug enabled. 481 00:22:11,020 --> 00:22:12,820 The firmware was easily accessible. 482 00:22:13,400 --> 00:22:14,920 You can just grab it straight off the chip. 483 00:22:15,420 --> 00:22:17,080 There's lots of use of banned functions. 484 00:22:17,120 --> 00:22:17,800 Within the firmware. 485 00:22:19,080 --> 00:22:20,760 General insecure coding practices. 486 00:22:21,160 --> 00:22:22,140 That kind of a thing. 487 00:22:23,080 --> 00:22:26,820 Which is unfortunately expected at this point. 488 00:22:27,700 --> 00:22:29,580 And I think anybody in hardware hacking. 489 00:22:29,580 --> 00:22:30,340 Or IOT. 490 00:22:30,460 --> 00:22:32,820 Or anybody who does any embedded security. 491 00:22:33,240 --> 00:22:33,880 Sort of. 492 00:22:33,880 --> 00:22:35,120 That's a pretty common thing. 493 00:22:35,720 --> 00:22:38,300 But it's a little bit unfortunate. 494 00:22:39,100 --> 00:22:40,220 When we talk about. 495 00:22:40,520 --> 00:22:41,420 Because there are. 496 00:22:42,400 --> 00:22:43,460 Well I'll talk about it. 497 00:22:43,520 --> 00:22:44,500 But there are companies who. 498 00:22:46,040 --> 00:22:47,600 Were sort of in this business. 499 00:22:47,720 --> 00:22:49,640 Before the ELD mandate came out. 500 00:22:49,840 --> 00:22:52,300 And then like everybody entered the thing. 501 00:22:52,380 --> 00:22:53,600 And then they kind of get lost in the noise. 502 00:22:53,700 --> 00:22:55,660 Even though they're making significant effort. 503 00:22:55,660 --> 00:22:57,020 And spending money on cyber security. 504 00:22:57,580 --> 00:22:58,500 We'll talk about that. 505 00:22:58,580 --> 00:23:00,480 When we get to impact at the end. 506 00:23:01,640 --> 00:23:03,320 But what is the potential impact. 507 00:23:03,660 --> 00:23:05,220 If we've got a vulnerable device here. 508 00:23:05,780 --> 00:23:07,980 We know that it uses insecure coding practices. 509 00:23:08,600 --> 00:23:09,980 And if we can access this. 510 00:23:10,140 --> 00:23:10,840 From the internet. 511 00:23:11,000 --> 00:23:11,600 Or from Bluetooth. 512 00:23:12,680 --> 00:23:15,040 Whether you consider Bluetooth remote attack. 513 00:23:15,100 --> 00:23:15,740 Or physical attack. 514 00:23:16,000 --> 00:23:17,840 Given the short range is up to you. 515 00:23:18,060 --> 00:23:19,980 I think some people are on either side of that. 516 00:23:20,260 --> 00:23:23,420 But if you've got a remotely exploitable device. 517 00:23:23,820 --> 00:23:25,520 And you're plugging it directly into the truck. 518 00:23:26,400 --> 00:23:27,700 That does matter. 519 00:23:28,140 --> 00:23:28,960 And for. 520 00:23:29,160 --> 00:23:30,960 The trucking companies. 521 00:23:32,020 --> 00:23:32,900 Are doing. 522 00:23:33,880 --> 00:23:35,780 Work to try and isolate this threat. 523 00:23:36,800 --> 00:23:37,860 Because one of the things. 524 00:23:37,920 --> 00:23:39,240 That you can do on the buses is. 525 00:23:39,940 --> 00:23:40,380 Oh. 526 00:23:40,500 --> 00:23:42,140 I meant to mention this at the beginning. 527 00:23:42,280 --> 00:23:44,980 But if you've ever done any OEM car hacking. 528 00:23:45,180 --> 00:23:46,860 You know how the IDs are different. 529 00:23:47,160 --> 00:23:49,240 With a GM versus a Ford versus whatever. 530 00:23:49,760 --> 00:23:51,280 In trucking it's all standardized. 531 00:23:52,140 --> 00:23:53,560 So you don't have to do. 532 00:23:53,620 --> 00:23:54,900 Any of the reverse engineering. 533 00:23:55,660 --> 00:23:56,860 There's very little of the reverse engineering. 534 00:23:56,980 --> 00:23:58,240 To figure out what ID does what. 535 00:23:58,700 --> 00:24:01,060 So there's a straight up document that will tell you. 536 00:24:01,100 --> 00:24:02,560 If you want to request torque. 537 00:24:03,480 --> 00:24:05,000 This is the message that you send. 538 00:24:05,500 --> 00:24:07,280 So that makes it easier when. 539 00:24:08,240 --> 00:24:09,360 When crafting payloads. 540 00:24:09,400 --> 00:24:10,320 To potentially exploit it. 541 00:24:10,500 --> 00:24:11,940 And so when you're talking about the. 542 00:24:12,220 --> 00:24:13,700 If you're a heavy truck manufacturer. 543 00:24:13,960 --> 00:24:16,400 You want to probably isolate that if possible. 544 00:24:16,700 --> 00:24:19,480 Not allow a device that's plugged into the diagnostics port. 545 00:24:19,600 --> 00:24:20,480 To be able to send that message. 546 00:24:20,740 --> 00:24:21,740 But the problem is. 547 00:24:21,740 --> 00:24:22,880 That there are. 548 00:24:23,780 --> 00:24:24,820 Things that plug in. 549 00:24:24,980 --> 00:24:27,240 That legitimately need to send that message. 550 00:24:27,740 --> 00:24:28,560 That are interesting. 551 00:24:29,460 --> 00:24:31,600 And this isn't just the trucking industry. 552 00:24:31,800 --> 00:24:33,460 When you talk about emergency response vehicles. 553 00:24:33,640 --> 00:24:35,620 I used to work as a volunteer firefighter. 554 00:24:35,820 --> 00:24:37,240 And we would be. 555 00:24:37,800 --> 00:24:39,560 In the city department with the engines. 556 00:24:39,860 --> 00:24:41,300 And you're going to be sending those. 557 00:24:41,360 --> 00:24:43,420 Request torque messages when you need to use your pump. 558 00:24:43,740 --> 00:24:45,720 And spray your hose. 559 00:24:45,780 --> 00:24:46,340 To fight a fire. 560 00:24:46,400 --> 00:24:47,240 You've got to torque up the engine. 561 00:24:47,240 --> 00:24:49,300 So it's some of that same kind of thing. 562 00:24:49,640 --> 00:24:52,300 As we're getting into more sophisticated trucks. 563 00:24:52,440 --> 00:24:54,160 And we're getting more drive by wire. 564 00:24:54,460 --> 00:24:54,900 Autonomous. 565 00:24:54,900 --> 00:24:55,460 That kind of a thing. 566 00:24:55,600 --> 00:24:57,040 It's going to be more significant. 567 00:24:57,380 --> 00:24:58,880 And we need to make sure that we're isolating these out. 568 00:25:00,580 --> 00:25:02,480 But heavy trucking is critical infrastructure. 569 00:25:02,740 --> 00:25:05,160 So in my opinion. 570 00:25:05,200 --> 00:25:06,440 It's a little bit more significant. 571 00:25:06,800 --> 00:25:08,300 And you approach the problem slightly differently. 572 00:25:08,420 --> 00:25:09,700 Than your average passenger vehicle. 573 00:25:10,140 --> 00:25:12,820 Even though passenger vehicles are also super cool. 574 00:25:12,960 --> 00:25:13,900 Because you're talking about. 575 00:25:14,920 --> 00:25:16,320 Multi thousand pound robots. 576 00:25:17,240 --> 00:25:18,720 That are under control of an attacker. 577 00:25:18,900 --> 00:25:19,680 Which is significant. 578 00:25:19,920 --> 00:25:22,300 Because when we start to get to the physical side. 579 00:25:22,840 --> 00:25:24,700 Where cyber security meets physical. 580 00:25:25,060 --> 00:25:26,300 And you do the cyber physical. 581 00:25:26,560 --> 00:25:27,860 If anybody's got bingo cards. 582 00:25:28,060 --> 00:25:29,900 I can just ramble through them right now. 583 00:25:30,900 --> 00:25:33,980 And we'll make sure that you get your blackout things. 584 00:25:34,080 --> 00:25:34,400 Or whatever. 585 00:25:34,980 --> 00:25:36,000 Because you can win your prize. 586 00:25:36,420 --> 00:25:38,120 But the cyber physical aspect to it. 587 00:25:38,200 --> 00:25:39,340 Is significant and important. 588 00:25:39,840 --> 00:25:43,000 And that's what makes this hacking a little bit different. 589 00:25:43,240 --> 00:25:44,760 Than some of the others. 590 00:25:46,080 --> 00:25:46,520 So. 591 00:25:47,240 --> 00:25:48,860 The impact. 592 00:25:49,000 --> 00:25:50,100 Is potentially significant. 593 00:25:50,760 --> 00:25:51,720 As an example. 594 00:25:52,000 --> 00:25:54,020 If there is a slow down. 595 00:25:54,200 --> 00:25:55,580 In the mountain pass in Denver. 596 00:25:56,080 --> 00:25:57,920 That gets felt by the carriers. 597 00:25:57,980 --> 00:25:59,120 All the way back to the east coast. 598 00:25:59,360 --> 00:26:01,080 So you've got delays all the way. 599 00:26:01,300 --> 00:26:03,660 All the way back across half the United States. 600 00:26:04,340 --> 00:26:06,260 Because of how tight. 601 00:26:06,820 --> 00:26:07,540 Everything is. 602 00:26:07,640 --> 00:26:09,740 And how significant that can be. 603 00:26:10,500 --> 00:26:10,980 So. 604 00:26:12,220 --> 00:26:14,520 Has anybody read the Damon by Daniel Suarez? 605 00:26:16,680 --> 00:26:17,160 Oh. 606 00:26:17,240 --> 00:26:17,740 Man nobody. 607 00:26:17,920 --> 00:26:18,740 That's an awesome book. 608 00:26:18,860 --> 00:26:19,840 You should read that book. 609 00:26:20,600 --> 00:26:23,440 It was written probably like 10 years ago or so. 610 00:26:23,580 --> 00:26:23,880 I think. 611 00:26:24,280 --> 00:26:25,140 But one of the. 612 00:26:26,220 --> 00:26:27,040 It's really great. 613 00:26:27,140 --> 00:26:28,940 Because it starts talking about autonomous cars. 614 00:26:29,620 --> 00:26:31,460 And if they're under control. 615 00:26:31,600 --> 00:26:32,540 And they become part of a fleet. 616 00:26:33,040 --> 00:26:34,360 Then it is a cyber physical. 617 00:26:34,700 --> 00:26:35,720 Sort of where. 618 00:26:37,220 --> 00:26:39,180 That can be controlled in the physical world. 619 00:26:39,280 --> 00:26:39,960 Plus like he's. 620 00:26:40,820 --> 00:26:42,580 Like any good cyber punk. 621 00:26:43,060 --> 00:26:44,720 Like there's also autonomous motorcycles. 622 00:26:45,000 --> 00:26:47,120 And then they put katanas on the motorcycles. 623 00:26:47,400 --> 00:26:48,240 So they drive around. 624 00:26:48,500 --> 00:26:49,540 It's totally awesome. 625 00:26:51,080 --> 00:26:52,260 I recommend that book. 626 00:26:52,300 --> 00:26:52,580 It's great. 627 00:26:52,660 --> 00:26:53,240 There's also a sequel. 628 00:26:53,780 --> 00:26:54,900 But yeah. 629 00:26:55,020 --> 00:26:55,660 As mentioned. 630 00:26:55,840 --> 00:26:56,900 A problem in Denver can affect it. 631 00:26:57,040 --> 00:26:59,220 And then the other thing that I think is interesting. 632 00:26:59,400 --> 00:27:01,820 Is ELDs are in my opinion. 633 00:27:01,820 --> 00:27:03,240 Easier to spoof than a log book. 634 00:27:03,560 --> 00:27:06,280 Maybe it's just because of my own morality. 635 00:27:09,960 --> 00:27:10,460 I like people. 636 00:27:10,740 --> 00:27:12,800 I feel like I'm generally a good guy. 637 00:27:12,980 --> 00:27:14,180 And I don't want to lie to your face. 638 00:27:14,260 --> 00:27:14,940 So if an officer says. 639 00:27:15,120 --> 00:27:16,220 Hey how much did you drive? 640 00:27:16,360 --> 00:27:17,540 I'm going to probably tell him the truth. 641 00:27:17,900 --> 00:27:19,460 But I'll lie to a computer all day long. 642 00:27:19,840 --> 00:27:21,500 Because computers are evil. 643 00:27:22,480 --> 00:27:24,140 And Skynet is going to take us over. 644 00:27:24,200 --> 00:27:24,780 And kill us all. 645 00:27:25,940 --> 00:27:28,000 And Elon Musk and I agree on that point. 646 00:27:29,780 --> 00:27:30,460 Not exactly. 647 00:27:30,660 --> 00:27:33,300 But it's much easier to lie to a computer. 648 00:27:33,640 --> 00:27:34,760 Than it is to a person. 649 00:27:34,760 --> 00:27:36,420 And when you're talking about insurance fraud. 650 00:27:36,520 --> 00:27:38,100 Or fraud related to this. 651 00:27:38,760 --> 00:27:40,340 When I started getting into the progressive. 652 00:27:40,720 --> 00:27:42,620 I was able to piggyback off of a lot of research. 653 00:27:42,660 --> 00:27:43,760 Done by the community. 654 00:27:44,240 --> 00:27:45,980 For the insurance fraud purposes. 655 00:27:46,760 --> 00:27:47,520 They were saying. 656 00:27:47,740 --> 00:27:48,880 We plugged our dongle in. 657 00:27:49,000 --> 00:27:51,700 And oh we only drive to church on Sunday and back. 658 00:27:51,780 --> 00:27:53,200 And we never go over 25 miles an hour. 659 00:27:53,800 --> 00:27:55,900 And that was what they were doing with the insurance dongles. 660 00:27:56,080 --> 00:27:57,960 And so they had identified. 661 00:27:58,060 --> 00:27:59,640 How some of the components have worked. 662 00:27:59,840 --> 00:28:02,000 And I think that same thing sort of applies to this. 663 00:28:02,000 --> 00:28:04,740 If you're talking about trying to actually solve the problem. 664 00:28:04,980 --> 00:28:05,780 With regulation. 665 00:28:06,000 --> 00:28:07,960 I'm not sure that this does it. 666 00:28:08,020 --> 00:28:10,840 Because non-repudiation is a hard problem. 667 00:28:10,920 --> 00:28:11,900 It's a problem that we can solve. 668 00:28:12,140 --> 00:28:13,800 But that's sort of related to security. 669 00:28:14,160 --> 00:28:15,380 And this doesn't have any of that stuff. 670 00:28:15,720 --> 00:28:17,340 So how do you actually solve that problem? 671 00:28:17,440 --> 00:28:18,380 It's difficult. 672 00:28:20,000 --> 00:28:20,940 So in summary. 673 00:28:21,060 --> 00:28:24,140 The flash card I guess for the insecure by law talk. 674 00:28:24,500 --> 00:28:26,420 Is that we've got electronic logging devices. 675 00:28:26,560 --> 00:28:27,740 That replace driver log books. 676 00:28:28,140 --> 00:28:29,600 Mandated by the United States government. 677 00:28:30,280 --> 00:28:31,980 The devices are heavily commoditized. 678 00:28:32,000 --> 00:28:33,240 And fail to follow. 679 00:28:33,680 --> 00:28:35,640 Cyber security best practices in general. 680 00:28:36,260 --> 00:28:37,660 And the impact to the U.S. 681 00:28:37,700 --> 00:28:38,960 Critical infrastructure is real. 682 00:28:39,220 --> 00:28:41,580 We have to care about this massive increase. 683 00:28:42,020 --> 00:28:43,040 In attack surface. 684 00:28:43,960 --> 00:28:45,160 With commoditized hardware. 685 00:28:45,880 --> 00:28:47,480 And like I mentioned before. 686 00:28:47,720 --> 00:28:48,360 It's sort of unfortunate. 687 00:28:48,620 --> 00:28:50,580 Because there are companies who are spending effort. 688 00:28:50,860 --> 00:28:52,000 To make this better. 689 00:28:52,140 --> 00:28:53,160 Telematics companies. 690 00:28:53,320 --> 00:28:54,520 Who have been maybe doing this for a while. 691 00:28:55,360 --> 00:28:58,780 But they sort of get lost in the noise. 692 00:28:58,880 --> 00:29:01,540 I mean there were 70 things. 693 00:29:02,000 --> 00:29:03,160 And you can make pages of different devices. 694 00:29:03,360 --> 00:29:04,740 And if you're just trying to find one. 695 00:29:05,540 --> 00:29:06,280 That's what you're going to. 696 00:29:06,420 --> 00:29:07,840 You're just going to grab the first one you see. 697 00:29:08,100 --> 00:29:10,780 So I really don't ever do this in talks. 698 00:29:10,920 --> 00:29:13,260 But I would like to do a brief exercise. 699 00:29:14,240 --> 00:29:15,500 Where we're going to do a show of hands. 700 00:29:15,680 --> 00:29:16,060 I apologize. 701 00:29:16,880 --> 00:29:19,240 So when we're also thinking about the impact of this. 702 00:29:19,420 --> 00:29:21,240 Where it's three days before. 703 00:29:22,020 --> 00:29:23,520 Let's use Walmart as an example. 704 00:29:23,620 --> 00:29:25,060 Where Walmart shelves are starting to get empty. 705 00:29:26,300 --> 00:29:27,240 I'd like a show of hands. 706 00:29:27,320 --> 00:29:27,720 One or another. 707 00:29:27,720 --> 00:29:29,700 First if you think that Walmart. 708 00:29:29,820 --> 00:29:31,320 Will be the one that the average consumer. 709 00:29:31,680 --> 00:29:32,780 Blames for the problem. 710 00:29:33,100 --> 00:29:34,580 Or even if in the news says. 711 00:29:34,760 --> 00:29:36,520 Like we've got a heavy trucking cyber vulnerability. 712 00:29:37,160 --> 00:29:39,200 We don't have our goods aren't shipping appropriately. 713 00:29:39,620 --> 00:29:40,600 Whether it's just a DOS. 714 00:29:40,720 --> 00:29:41,900 And they're not shipping. 715 00:29:43,720 --> 00:29:46,220 Will the average consumer blame Walmart. 716 00:29:46,360 --> 00:29:48,840 Or the trucking industry insecurity. 717 00:29:49,300 --> 00:29:50,640 So for a show of hands. 718 00:29:50,700 --> 00:29:52,640 On people who think that the average consumer. 719 00:29:53,220 --> 00:29:55,680 Won't make that abstract leap. 720 00:29:55,840 --> 00:29:57,580 From the thing that they see in the face. 721 00:29:57,600 --> 00:29:57,700 And they're not going to. 722 00:29:57,720 --> 00:29:59,140 To the trucking. 723 00:29:59,160 --> 00:30:00,640 Who thinks that Walmart will be blamed. 724 00:30:00,700 --> 00:30:02,260 Instead of the trucks. 725 00:30:03,000 --> 00:30:04,380 Okay and who's on the. 726 00:30:04,760 --> 00:30:07,140 People will blame the trucks instead. 727 00:30:08,180 --> 00:30:09,820 Alright so it very clearly. 728 00:30:10,180 --> 00:30:10,980 Very clearly. 729 00:30:11,060 --> 00:30:13,500 The lot of you think that. 730 00:30:13,820 --> 00:30:15,720 If we have a problem with the infrastructure. 731 00:30:15,800 --> 00:30:16,600 The transportation infrastructure. 732 00:30:17,040 --> 00:30:18,180 That is going to be the end unit. 733 00:30:18,280 --> 00:30:19,760 That is the one who sort of. 734 00:30:20,580 --> 00:30:21,800 Catches the blame for it. 735 00:30:22,220 --> 00:30:25,720 They definitely won't blame this. 736 00:30:26,820 --> 00:30:27,420 You are. 737 00:30:27,720 --> 00:30:28,420 You are right. 738 00:30:28,560 --> 00:30:30,000 I think I agree. 739 00:30:30,180 --> 00:30:31,300 Does anybody think they'll blame this. 740 00:30:31,420 --> 00:30:32,660 If this is what caused it. 741 00:30:32,920 --> 00:30:33,280 Yeah. 742 00:30:35,240 --> 00:30:36,720 They'll blame Russia. 743 00:30:36,940 --> 00:30:38,520 They'll blame whoever they're told to blame. 744 00:30:38,580 --> 00:30:38,900 Probably. 745 00:30:39,580 --> 00:30:40,740 Is what will actually happen. 746 00:30:40,980 --> 00:30:42,380 Which is sort of an unfortunate thing. 747 00:30:42,480 --> 00:30:43,800 And we can rant about that for a long time. 748 00:30:44,280 --> 00:30:45,100 But when it comes to this. 749 00:30:45,200 --> 00:30:46,040 Yeah so that's an interesting. 750 00:30:46,340 --> 00:30:47,040 Yeah that's interesting. 751 00:30:47,040 --> 00:30:48,720 Is they're probably. 752 00:30:48,820 --> 00:30:50,120 Pretty much definitely not going to blame this. 753 00:30:50,540 --> 00:30:52,900 It's going to be the carriers OEMs. 754 00:30:53,300 --> 00:30:55,400 Possibly or more likely. 755 00:30:55,460 --> 00:30:56,980 The end thing that's in somebody's face. 756 00:30:57,160 --> 00:30:58,160 Because the average person doesn't care. 757 00:30:58,740 --> 00:31:01,300 They're going to do what they first see. 758 00:31:01,460 --> 00:31:02,620 And get that problem solved. 759 00:31:02,820 --> 00:31:03,460 And out of their face. 760 00:31:04,420 --> 00:31:06,940 That's on whatever hits the evening news the most. 761 00:31:07,260 --> 00:31:08,420 Yeah that's true. 762 00:31:08,600 --> 00:31:09,160 That's true. 763 00:31:09,200 --> 00:31:10,960 That's what most heavily influences. 764 00:31:11,040 --> 00:31:14,320 If you get enough that says Walmart. 765 00:31:14,560 --> 00:31:15,340 They're going to blame Walmart. 766 00:31:17,040 --> 00:31:18,420 That goes into some kind of detail. 767 00:31:18,700 --> 00:31:20,080 Where it ends up on like. 768 00:31:20,540 --> 00:31:23,000 One of the longer news programs. 769 00:31:23,200 --> 00:31:24,740 Like say 60 minutes or something. 770 00:31:24,960 --> 00:31:26,700 That people watch to a fair extent. 771 00:31:27,080 --> 00:31:28,720 Then they might be able to make that abstract leap. 772 00:31:30,040 --> 00:31:30,840 Knowledgeable understanding. 773 00:31:31,580 --> 00:31:33,160 Yeah I think that's an interesting discussion. 774 00:31:33,320 --> 00:31:35,040 In terms of human psyche. 775 00:31:35,900 --> 00:31:36,940 And how they approach problems. 776 00:31:37,020 --> 00:31:37,320 And what not. 777 00:31:37,460 --> 00:31:39,600 But I don't pretend to be a psychologist in any way. 778 00:31:40,280 --> 00:31:42,440 I work with deterministic things like. 779 00:31:43,760 --> 00:31:44,160 Computers. 780 00:31:44,500 --> 00:31:46,140 Because they're easier. 781 00:31:47,580 --> 00:31:48,500 So yeah. 782 00:31:48,700 --> 00:31:50,060 Thanks for coming very much. 783 00:31:50,080 --> 00:31:51,460 And I appreciate it.