1
00:00:02,120 --> 00:00:09,280
So we just presented on the main stage a framework for interfacing with the vehicular ad-hoc network,

2
00:00:09,540 --> 00:00:13,920
rather for, oh, true, I'm sure we get one of these guys.

3
00:00:18,600 --> 00:00:25,140
We just presented a framework built on the mainline Linux kernel for interfacing with connected vehicles.

4
00:00:25,140 --> 00:00:33,960
So this concept of V2V, V2X, using, by making modifications to the drivers for cheap, accessible,

5
00:00:34,120 --> 00:00:41,280
consumer-off-the-shelf hardware such that you can do this now with a $20 Wi-Fi card rather than a $5,000 DSRC radio.

6
00:00:42,860 --> 00:00:44,860
We're going to jump around the slides here a little bit more.

7
00:00:46,240 --> 00:00:51,360
We're going to skip a lot of the sort of high-level theoretical things.

8
00:00:51,940 --> 00:00:54,480
The concept of V2X, just to reiterate a little bit,

9
00:00:54,540 --> 00:00:55,120
for those of you who don't know,

10
00:00:55,120 --> 00:00:55,940
for those of you who weren't at the talk,

11
00:00:56,840 --> 00:01:03,500
the rapid, high-throughput exchange of safety information between participants of this vehicular ad-hoc network

12
00:01:03,500 --> 00:01:10,840
to enable enhanced safety and behavioral optimization functions within a highly dense traffic environment.

13
00:01:11,140 --> 00:01:16,700
So what this means is cars and infrastructure points are exchanging state information constantly

14
00:01:16,700 --> 00:01:18,860
in order to optimize things like traffic flow.

15
00:01:20,380 --> 00:01:21,220
There you go.

16
00:01:21,340 --> 00:01:21,860
Sure.

17
00:01:23,960 --> 00:01:32,840
So some of the critical features or aspects of this stuff is to, you know,

18
00:01:33,720 --> 00:01:41,040
I mean, first and foremost, it's safety, to actually allow the cars to provide information to each other

19
00:01:41,040 --> 00:01:42,760
that they can't get through the normal sensors.

20
00:01:42,900 --> 00:01:48,120
So, you know, you can't see inside the car, you can't see inside the engine and, you know, the ECUs and all that stuff.

21
00:01:48,220 --> 00:01:51,580
So they have to encode that into, you know, over-the-air radio,

22
00:01:51,580 --> 00:01:54,680
video message so that other cars in the vicinity can actually decode it

23
00:01:54,680 --> 00:01:56,920
and get an understanding of where the network status is

24
00:01:56,920 --> 00:02:02,400
and kind of route their traffic around that and, you know, coordinate.

25
00:02:06,260 --> 00:02:11,280
So, you know, it has major impacts on every aspect of the transportation network

26
00:02:11,280 --> 00:02:15,960
and really this reaches out into most every aspect of society as we know it.

27
00:02:16,020 --> 00:02:21,240
The transportation infrastructure and especially the connected transportation infrastructure will touch,

28
00:02:21,580 --> 00:02:28,080
you know, all the other sectors of critical infrastructure systems from energy and power distribution

29
00:02:28,080 --> 00:02:30,920
to financial to medical, et cetera.

30
00:02:31,100 --> 00:02:37,440
So the impact of having these connected vehicle technologies is that you enable unprecedented levels

31
00:02:37,440 --> 00:02:44,360
of safety functions that are simply not possible with the sensor networks on board one specific platform.

32
00:02:45,880 --> 00:02:50,600
It has, let's see, we're going to skip around a little bit.

33
00:02:51,700 --> 00:02:55,900
There are already some deployed technologies using V2X, so these are rolling out already

34
00:02:55,900 --> 00:02:59,300
in commercial automobiles for the last couple of years, like cooperative cruise control.

35
00:02:59,620 --> 00:03:04,000
You see a little picture of here where the members of the network, you know,

36
00:03:04,000 --> 00:03:11,900
exchange state information and do some math in order to, you know, reduce the amount of stress and braking

37
00:03:11,900 --> 00:03:18,020
and to really smooth out the behavioral flow of these vehicles.

38
00:03:18,240 --> 00:03:20,260
We have, you know, collision avoidance.

39
00:03:20,540 --> 00:03:21,560
Advanced driver safety.

40
00:03:21,560 --> 00:03:21,780
Driver assistance.

41
00:03:23,740 --> 00:03:29,400
Automated ticketing and tolling is sort of to be implemented almost unquestionably in the future.

42
00:03:30,400 --> 00:03:34,120
This we might not like so much, but it is unavoidable.

43
00:03:35,600 --> 00:03:36,840
So you want to take this one?

44
00:03:37,040 --> 00:03:37,240
Sure.

45
00:03:38,180 --> 00:03:46,480
So our approach to kind of developing these things is to create an open source software solution

46
00:03:46,480 --> 00:03:49,940
that allows you to use commodity hardware, particularly, you know,

47
00:03:49,960 --> 00:03:51,540
specifically the Atheros 9K.

48
00:03:51,540 --> 00:03:58,820
You know, the 9K chipset on Linux to actually do this 5.8 to 5.9 gigahertz transmission in OCV mode

49
00:03:58,820 --> 00:04:06,320
and, you know, do V2V to allow people, to allow anyone to develop their own systems, to test,

50
00:04:06,400 --> 00:04:12,460
to validate, and to kind of further development of the V2V systems and vehicular ad hoc networks

51
00:04:12,460 --> 00:04:18,860
in general so that the future standards can build upon, you know, the cooperative data collection

52
00:04:18,860 --> 00:04:21,520
that anyone can, you know, build on.

53
00:04:21,540 --> 00:04:22,200
So that's kind of what we're trying to buy into essentially.

54
00:04:26,140 --> 00:04:31,200
So I have a particular taste for this because I spent about two years before I brought him on it.

55
00:04:31,220 --> 00:04:35,620
It was one year digging around the depths, the soulless chasm that is Linux kernel trying

56
00:04:35,620 --> 00:04:38,120
to understand the attempts of integration so far.

57
00:04:38,320 --> 00:04:45,600
And what we come to realize is that pretty much every group that has gone out to develop an open source

58
00:04:45,600 --> 00:04:49,640
framework for doing V2V has failed, has orphaned the project partway through, or gone closed source

59
00:04:49,640 --> 00:04:50,960
and produced an incomplete.

60
00:04:51,540 --> 00:04:56,420
And now obsolete implementation that is being considered for deployment.

61
00:04:56,640 --> 00:04:57,600
It's simply unacceptable.

62
00:04:58,060 --> 00:05:05,580
So what we've done is modify the mainline Linux kernel and, you know, a set of standard Linux

63
00:05:05,580 --> 00:05:14,180
networking drivers that enable you to interface with VANet using a $20 Wi-Fi card and any computer

64
00:05:14,180 --> 00:05:15,080
that runs Linux.

65
00:05:18,100 --> 00:05:19,540
So, right.

66
00:05:20,260 --> 00:05:21,320
Lessons learned.

67
00:05:21,540 --> 00:05:23,760
Everybody sucks, sharing is caring, except for herpes.

68
00:05:24,380 --> 00:05:31,800
Standards committees are, need some serious assistance developing these kinds of, you know,

69
00:05:31,800 --> 00:05:37,880
highly complex safety systems that require the participation of the security community.

70
00:05:38,580 --> 00:05:43,280
Hence, this goes back to motivation for developing this framework, giving every member of the

71
00:05:43,280 --> 00:05:47,260
security community, every person here and worldwide the ability to sit down and start

72
00:05:47,260 --> 00:05:50,120
developing applications and understanding fundamentally,

73
00:05:50,120 --> 00:05:54,620
without, you know, doing an analysis of the protocols and the standards.

74
00:05:55,560 --> 00:05:56,080
What?

75
00:05:56,300 --> 00:05:57,560
I got a question.

76
00:05:57,960 --> 00:05:59,260
Would you answer the question right?

77
00:06:00,640 --> 00:06:03,480
I'm probably, is it a really good question?

78
00:06:03,580 --> 00:06:06,120
Because otherwise, can I wait?

79
00:06:06,520 --> 00:06:09,520
Or if it's a really good question, I mean, yeah, come on up.

80
00:06:10,300 --> 00:06:12,180
I mean, everybody's .

81
00:06:16,260 --> 00:06:16,780
Yes.

82
00:06:17,360 --> 00:06:19,360
Is it easy, open participation?

83
00:06:23,900 --> 00:06:30,200
Well, because the standards committees aren't really being engaged by, by a whole lot of

84
00:06:30,200 --> 00:06:30,780
the security community.

85
00:06:30,980 --> 00:06:36,700
I mean, I know, so I know those that, in fact, were part of the committee for, for the distribution

86
00:06:37,260 --> 00:06:44,140
that's developing the security layer, very much incomplete, very much lacking, in fact,

87
00:06:44,180 --> 00:06:48,720
so right, V to V systems are being deployed without any existence of a functional 16092

88
00:06:48,720 --> 00:06:48,980
layer.

89
00:06:48,980 --> 00:06:51,780
That, to me, says that these people need some help developing them, right?

90
00:06:53,100 --> 00:06:54,160
And that's, and that's a...

91
00:06:54,160 --> 00:06:54,640
Is it an example?

92
00:06:55,080 --> 00:06:58,540
Is it an example because there is a standard out there and there are not any?

93
00:06:59,200 --> 00:07:03,320
Well, the, the standard is, is incomplete and still under revision as it is today.

94
00:07:03,660 --> 00:07:08,400
So, I mean, you know, one, one of the examples, one of the examples in 16092 that raised some

95
00:07:08,400 --> 00:07:11,760
concern for me was the actual generation of certificates, right?

96
00:07:11,820 --> 00:07:14,720
I think that they were supposed to be refreshed every day, right?

97
00:07:14,820 --> 00:07:18,800
I mean, that, that was the current, that was the scheme, I believe.

98
00:07:27,180 --> 00:07:27,580
No?

99
00:07:27,580 --> 00:07:30,500
So, I mean, no.

100
00:07:30,780 --> 00:07:34,780
But, but look, look, let's, let's talk about this after we've got about 20 minutes left.

101
00:07:35,760 --> 00:07:38,880
I'd be happy to have this discussion with you and we, and we can come over some of the

102
00:07:38,880 --> 00:07:40,220
distributions of the, of the committee.

103
00:07:41,140 --> 00:07:45,340
I just want to make a question about all this information and they're just simply not

104
00:07:45,340 --> 00:07:46,560
necessarily true.

105
00:07:46,920 --> 00:07:48,560
So, I, I, I, I, I, I, I, I, I, I, I, I, I, I, I, I, I, I, I, I, I, I, I, I, I, I, I, I,

106
00:07:53,100 --> 00:07:53,840
I, I, I, I, I, I, I, I, I, I, I, I, I, I, I, I, I, I, I, I.

107
00:07:53,840 --> 00:07:56,220
Hey, hey, hey, check your privilege.

108
00:07:57,140 --> 00:07:58,980
So, we're going to do stack overview, right?

109
00:07:59,060 --> 00:08:04,340
We go from the physical layer 802.11p, actually I think we'll go back a couple of, a couple

110
00:08:04,340 --> 00:08:04,520
of years.

111
00:08:05,300 --> 00:08:10,300
So the physical layer is comprised by and, and the MAC layer bySEE-802.11p, the management

112
00:08:10,300 --> 00:08:16,360
plane bySEE-1609, and the application layer bySEE J2735.

113
00:08:16,680 --> 00:08:18,540
So, just to give a quick overview, so after SE, next steps is governments and organizations

114
00:08:18,560 --> 00:08:28,620
go over these quickly, 802.11p, so multicast ad hoc mesh networking mode that specifies no use

115
00:08:28,620 --> 00:08:35,560
of authentication, encryption or association. Over 5.8 to 5.9 gigahertz ITS bands, ITS

116
00:08:35,560 --> 00:08:39,860
intelligent transportation systems. They use 5 and 10 megahertz with subcarriers within these

117
00:08:39,860 --> 00:08:45,480
channels. And this modulation scheme called OFDM, which is a standard, you know, standard

118
00:08:45,480 --> 00:08:53,440
Wi-Fi modulation scheme. Okay. So, all right, moving on to 1609. So we have the definitions

119
00:08:53,440 --> 00:08:59,340
for the security services in 02, or in 0.2, the networking services and the message, you

120
00:08:59,340 --> 00:09:04,300
know, the sort of encoding dictionaries in 0.3. 0.4 is the multi-channel operation. And

121
00:09:04,300 --> 00:09:09,440
0.12, I believe, is the identifier allocations for provider service IDs, which are kind of

122
00:09:09,440 --> 00:09:15,460
unique strings issued by IEEE to identify particular service types. All right. And then

123
00:09:19,480 --> 00:09:25,780
J2735 is the application layer, grammar, message dictionary that specifies the safety messages

124
00:09:25,780 --> 00:09:32,280
that will be used, you know, in interoperable V to V systems. So basic safety message is the one

125
00:09:32,280 --> 00:09:38,580
that has been most developed so far. Messages that will be continuously transmitted at periodic

126
00:09:38,580 --> 00:09:43,320
intervals between all members of the VA net that includes state information, things like the

127
00:09:43,320 --> 00:09:45,460
dimensionality, the heading, location, and the type of information that's being sent. And then, you know, the

128
00:09:45,480 --> 00:09:49,540
configuration of the car such that you can perform, you know, behavioral optimization, dispatch,

129
00:09:49,740 --> 00:10:01,660
reactionary, reactionary actions to the vehicle bus to augment the behavior. So they have been under

130
00:10:01,660 --> 00:10:07,660
development since 2005, 2006. The, you know, NHTSA has been drafting documentation, I think, since

131
00:10:07,660 --> 00:10:15,140
about 2004 on this. There's been a lot of talk. There's been many major overhauls to the standards without really, without a

132
00:10:15,480 --> 00:10:23,760
full deployment of a fully complete and compliant implementation, still today. So the development is

133
00:10:23,760 --> 00:10:35,560
very much still in flux. Some major changes to the standards. The actual message encodings have

134
00:10:36,440 --> 00:10:39,960
encountered some slight modifications. But significant enough that the actual parsers

135
00:10:39,960 --> 00:10:45,460
wouldn't work between, you know, going from, I believe, WSB 1 and 2 to 3, I believe. One is the

136
00:10:45,460 --> 00:10:52,700
And the message dictionaries in J2735 have changed dramatically in the actual entire scheme.

137
00:10:52,920 --> 00:10:56,280
The encoding scheme has changed so they're completely inter...

138
00:10:56,980 --> 00:11:03,300
Originally using this thing called DER and then to BER and then to UPER. So three

139
00:11:03,300 --> 00:11:08,280
completely different, semi-related but incompatible encoding formats that change

140
00:11:08,280 --> 00:11:11,700
sequentially through each major revision of the standard. So you have ASN1 specifications

141
00:11:11,700 --> 00:11:16,320
that are entirely incompatible and in fact the most recent one that was published doesn't

142
00:11:16,320 --> 00:11:23,540
actually compile and also uses type systems that are non-standard in ASN1 processing

143
00:11:23,540 --> 00:11:30,000
utilities. So basically I even went so far as to buy the spec which is something I try to

144
00:11:30,560 --> 00:11:34,640
never do and what do you know it doesn't actually compile and you can't actually use it or

145
00:11:34,640 --> 00:11:41,680
parse it. So what we did is take this cobble work that of a broken standard and

146
00:11:41,700 --> 00:11:50,440
implement some of it in C so it's digestible and functional and we'll show that in a little bit

147
00:11:50,440 --> 00:11:58,140
here. You know there's some question in our heads about the development of the standards so

148
00:11:58,140 --> 00:12:06,380
there's been a lot of ambiguity that's being introduced. There's things like the message CRCs,

149
00:12:06,440 --> 00:12:11,260
the verification codes were removed in the most recent revision of J2735 from the

150
00:12:11,700 --> 00:12:18,160
roadside alerts from the emergency vehicle alerts. The rest were the same but you take out the error

151
00:12:18,160 --> 00:12:26,700
checking code. It's kind of weird, right? After 15 years of reservation for these for the ITS bands for use in

152
00:12:26,700 --> 00:12:32,280
intelligent transportation systems now suddenly they're up for sale to the to the telecom talking

153
00:12:32,280 --> 00:12:41,680
about being used for LTE. And we just described the overhauls of ASN1 and 2 a non-standard format. And then

154
00:12:41,700 --> 00:12:46,200
furthermore there's just a lot of ambiguity that existed previously in the standards.

155
00:12:47,100 --> 00:12:55,780
Shall talk subtly. Oh yeah, sure. So I mean these aren't necessarily design flaws, these are just issues that can

156
00:12:55,780 --> 00:13:04,620
potentially lead to some implementation fuzziness. The way that the information elements are packed,

157
00:13:04,760 --> 00:13:11,680
the variable length and the specification in a couple of places, you know, wastes like a byte encoding the length. But the

158
00:13:11,700 --> 00:13:16,040
other places there's actually a bit of ambiguity as to whether or not there should even be a byte there to

159
00:13:16,040 --> 00:13:20,540
begin with as to whether, you know, indicating whether a certain block would be there or not. And that

160
00:13:20,540 --> 00:13:27,400
just, it leads to some issues that could go further down in the pipeline. Not in the standards, not on the

161
00:13:27,400 --> 00:13:32,180
standards level but on the level of implementation where you could have someone develop buggy

162
00:13:32,180 --> 00:13:41,620
implementations that cause issues and, you know, that's undesirable definitely. So I want to get into the code

163
00:13:41,700 --> 00:13:48,080
here since we're pretty short on time and just went over a lot of this. But this is important real

164
00:13:48,080 --> 00:13:53,220
quick. I mean big attack surfaces, so right, the nature of the VANet is that it's accessible from a single

165
00:13:53,220 --> 00:13:58,240
endpoint. From one compromising, one endpoint you can propagate a message over the entire network in

166
00:13:58,240 --> 00:14:05,540
this distributed mesh networking fashion such that you can say store information on a vehicle that does

167
00:14:05,540 --> 00:14:11,500
not get distributed until it goes, say, across like a certain border. And you can

168
00:14:11,500 --> 00:14:17,000
propagate it further. You know, within the, you know, still being compatible with the

169
00:14:17,000 --> 00:14:22,660
standards. So not only, it's not just malformed DSRC messages, it's compliant, compatible DSRC

170
00:14:22,660 --> 00:14:30,700
messages that you can store, you know, deliverables in and propagate at an arbitrary point throughout

171
00:14:30,700 --> 00:14:35,200
the entire network. You can perform privilege escalation in the public key infrastructure to

172
00:14:35,200 --> 00:14:41,380
hijack, say, something like an emergency vehicles certificate, you know, cause cars to move out of the

173
00:14:41,380 --> 00:14:48,900
road or, you know, execute something like a platooning service to disable vehicles. And, you

174
00:14:48,900 --> 00:14:53,000
know, probably the most obvious one maybe we should have started with is it acts as an entry point

175
00:14:53,000 --> 00:14:59,600
to isolated systems. So the DSRC radio is hooked into the vehicle control bus and, right, so if you

176
00:14:59,600 --> 00:15:04,880
can send reactionary actions based on, you know, proximal network activity, that means that you

177
00:15:04,880 --> 00:15:11,360
can also send malicious actions based on your desires, right. So, you know, it's a little bit of a

178
00:15:11,380 --> 00:15:16,900
game changer. There's, there's active and passive adversaries. Um, can, can you wait ten

179
00:15:16,900 --> 00:15:28,260
minutes, pretty please? Pretty please. So I, I've spent two years, hey, check your privilege buddy.

180
00:15:28,600 --> 00:15:32,220
Alright, please don't interrupt me during a talk. Please don't interrupt me during a talk.

181
00:15:41,560 --> 00:15:46,240
Can you get a goon or something? I mean, just like quiet for a minute please and I'm plenty happy to

182
00:15:46,240 --> 00:15:54,740
argue with you when this is over. Um, so, yeah, the, we're gonna go up to our solution and how you

183
00:15:54,740 --> 00:16:00,380
use it, right. So how to interface. And I mean, so this talk really is about providing interface,

184
00:16:00,780 --> 00:16:07,120
or a framework for interfacing with connected vehicles, um, using Linux. So, right, it's never

185
00:16:07,120 --> 00:16:14,780
been easier, right. Just use Linux. Um, uh, you, we modified the Linux networking subsystems,

186
00:16:14,780 --> 00:16:24,280
MAG 802.11, CFG 802.11, um, to support 802.11p and then, uh, developed, uh, 60, developed a

187
00:16:24,280 --> 00:16:28,940
kernel driver which we're, which is being integrated into the mainline kernel for the, all

188
00:16:28,940 --> 00:16:36,340
the 1609, um, you know, data elements and, and members such that you'll be able to use a J2735

189
00:16:37,120 --> 00:16:44,540
networking utility, much like IW, which we provide to dispatch, um, DSRC messages from the

190
00:16:45,080 --> 00:16:52,200
standard Linux wireless interface. Uh, where we start is, so, bottom of the stack, modify the

191
00:16:52,200 --> 00:16:56,340
regulatory domain, add definitions for the intelligent transportation systems channels to

192
00:16:56,340 --> 00:17:01,300
the, uh, Atheros wireless drivers or, you know, to the, to the arbitrary wireless driver right

193
00:17:01,300 --> 00:17:06,740
now. Um, while it is built into the mainline Linux kernel, uh, manufacturers of hardware, a

194
00:17:06,740 --> 00:17:10,980
specific, specify a specific regulatory domain that hardware can operate in. So you have to make a

195
00:17:10,980 --> 00:17:16,760
few slight modifications to each wireless driver, um, which are rather analogous, uh, and,

196
00:17:16,880 --> 00:17:21,300
and, and pretty much equivalent, we, it, it looks the same in the RTL, um, and will release

197
00:17:21,300 --> 00:17:28,360
support for a wide set of standard drivers. Um, you modify the regulatory domain in the kernel

198
00:17:28,360 --> 00:17:32,820
and in the user space utilities, so in the net wireless interface and also, uh, in the

199
00:17:32,820 --> 00:17:36,720
CRDA and wireless RegDB at the, uh, at the user space layer. Uh, we, uh, created a pretty, uh,

200
00:17:36,720 --> 00:17:42,380
And then modify the regulatory domain of the wireless driver, as shown in the second picture there.

201
00:17:43,140 --> 00:17:47,900
And then you define the filtering mechanisms for the 802.11p frames.

202
00:17:48,260 --> 00:17:57,660
So it is defined that 802.11p frames that are compatible are data, QS, and action,

203
00:17:57,780 --> 00:17:59,740
and specifically the types that are listed here.

204
00:17:59,900 --> 00:18:02,980
And you just enforce the use of multicast addressing.

205
00:18:02,980 --> 00:18:11,940
So all messages that are transmitted from 802.11p need to use this broadcast BSS ID, wildcard BSS ID,

206
00:18:12,500 --> 00:18:13,800
six octets of all Fs.

207
00:18:14,140 --> 00:18:20,940
And then in order to implement this in user space, we made some simple modifications to the IW utility,

208
00:18:21,160 --> 00:18:24,440
which I'm sure everyone here who has used Linux is quite familiar with.

209
00:18:26,320 --> 00:18:32,220
You add a definition to join and leave the OCB channels.

210
00:18:32,400 --> 00:18:32,680
Yes.

211
00:18:32,980 --> 00:18:36,580
You add compatibility for 5 and 10 megahertz with sub-carriers within the channels.

212
00:18:37,600 --> 00:18:42,540
And then you can run this command, which we'll provide an example of in our GitHub repo.

213
00:18:43,480 --> 00:18:46,020
I mean, it's that command right up there.

214
00:18:46,100 --> 00:18:52,240
And the result is that you're able to successfully join a 5 gigahertz channel in OCB mode

215
00:18:52,240 --> 00:18:57,360
using exclusive use of the channel and 10 megahertz sub-carrier.

216
00:18:57,500 --> 00:19:00,240
So this is 802.11p implemented.

217
00:19:01,300 --> 00:19:02,960
Next, we're going to talk about...

218
00:19:02,980 --> 00:19:11,060
So the implementation of WAV is mostly to do with the actual message encoding all the way up from the short message

219
00:19:11,060 --> 00:19:13,040
and, you know, the constituent fields in there.

220
00:19:13,340 --> 00:19:20,980
And that's primarily to do with actually just making really big parsers or really big parser and a really big encoder

221
00:19:20,980 --> 00:19:27,480
and encoder and decoder to actually allow you to turn these structures into a byte stream

222
00:19:27,480 --> 00:19:31,500
that goes and inject it into the wireless interface to go over the air.

223
00:19:32,980 --> 00:19:35,560
And then along with that, there's also the channel switching capabilities

224
00:19:35,560 --> 00:19:39,100
that need to be done to switch between the service and the control channel,

225
00:19:39,680 --> 00:19:44,440
which are handled through IW, just dispatching an IW set chan, right?

226
00:19:45,380 --> 00:19:51,420
And then some user space links that allow you to use stuff like PCAP inject

227
00:19:51,420 --> 00:19:56,240
to just send it off to the wireless interface directly and handle it all in user space

228
00:19:56,240 --> 00:19:57,860
and not worry about any kernel messiness.

229
00:19:59,120 --> 00:19:59,740
Still you.

230
00:20:00,540 --> 00:20:02,280
Let's go to the structs real quick.

231
00:20:02,420 --> 00:20:02,780
Okay.

232
00:20:02,980 --> 00:20:05,620
So here is the WAV short message struct.

233
00:20:05,860 --> 00:20:07,460
I mean, this is a pretty simple definition, right?

234
00:20:07,600 --> 00:20:09,340
So you have subtype, version, TPID.

235
00:20:10,880 --> 00:20:14,760
You know, then we have the nheader information element extension,

236
00:20:15,820 --> 00:20:23,360
which is just a block of extra information regarding, like, things like location and heading

237
00:20:24,080 --> 00:20:28,520
or RF information, like transmission power, data rate, that kind of thing.

238
00:20:28,720 --> 00:20:32,480
Moving on is the actual information element block, which contains these optional fields

239
00:20:32,480 --> 00:20:36,860
for the RF parameters, the routing, you know, external DNSs,

240
00:20:36,900 --> 00:20:40,460
and various services that are provided potentially by the actual peer.

241
00:20:42,240 --> 00:20:45,220
Here are the sort of ancillary structs that are filled in there.

242
00:20:45,460 --> 00:20:47,860
We got the routing advertisements, service advertisements,

243
00:20:48,060 --> 00:20:50,700
and then the channel information and service information.

244
00:20:51,000 --> 00:20:56,480
I mean, these are all just, they encode the, I mean, more particular information

245
00:20:56,480 --> 00:21:01,260
for the advanced functions provided in the higher layer services that are built on top of this.

246
00:21:02,480 --> 00:21:02,740
Yeah.

247
00:21:05,180 --> 00:21:10,680
So then J2735 is analogously easy to implement.

248
00:21:10,880 --> 00:21:18,720
So we pulled some specification from the broken ASN1 files, J2735 provided.

249
00:21:20,480 --> 00:21:23,960
So here's the struct, say, for one of the messages, the basic safety message,

250
00:21:24,160 --> 00:21:26,420
which is the one that most compatibility has been added for.

251
00:21:27,300 --> 00:21:32,380
We fill each of the fields up with data elements that are within the accepted range,

252
00:21:32,480 --> 00:21:33,800
as specified by the standard.

253
00:21:33,980 --> 00:21:37,720
And then we take one of the structs that Nick just described.

254
00:21:37,940 --> 00:21:44,920
We fill it up with data and pack the basic safety message just into the data field,

255
00:21:45,180 --> 00:21:49,200
serialize it using an encoding function that we wrote,

256
00:21:50,760 --> 00:21:54,220
and then dispatch it to the wireless interface using PCAP inject.

257
00:21:54,460 --> 00:21:57,380
And we can see, when we pull it up in Wireshark,

258
00:21:57,440 --> 00:21:59,500
it recognizes that a wave short message was transmitted.

259
00:21:59,900 --> 00:22:02,460
The Wireshark plug-in for 1609 doesn't click.

260
00:22:02,460 --> 00:22:09,500
It's incomplete and doesn't recognize all the types of packets and stuff yet.

261
00:22:09,620 --> 00:22:14,720
But we provide means to do this, to do testing and injection.

262
00:22:15,480 --> 00:22:21,320
What you can see here is that we have successfully, using an Atheros 9K $20 Wi-Fi card,

263
00:22:21,420 --> 00:22:27,440
injected a DSRC message into the VANet spectrum.

264
00:22:28,920 --> 00:22:31,740
And the same thing you can do with other kinds of safety messages,

265
00:22:31,740 --> 00:22:33,780
emergency vehicle alerts, and roadside advertisements.

266
00:22:33,880 --> 00:22:36,600
These are just simple examples of the same thing.

267
00:22:36,940 --> 00:22:39,520
And they're just as easy to transmit and inject.

268
00:22:41,040 --> 00:22:44,500
And then when you examine the capture from Wireshark,

269
00:22:44,580 --> 00:22:46,380
you see all the data is there with all the proper padding.

270
00:22:46,800 --> 00:22:49,940
I mean, it's not really going to be too easy to see here.

271
00:22:51,080 --> 00:22:53,100
So, what can you do with this, right?

272
00:22:55,940 --> 00:22:59,260
What we have described so far is a means to, as we said,

273
00:22:59,380 --> 00:23:01,300
transmit and inject into the...

274
00:23:01,740 --> 00:23:07,160
into the wave spectrum, the intelligent transportation channels to interface with the VANet.

275
00:23:07,580 --> 00:23:11,280
So, you want to be a master, see if you can pwn like these.

276
00:23:11,500 --> 00:23:15,280
These are five sort of levels of increasing complexity.

277
00:23:15,680 --> 00:23:20,820
You can perform denial of service on, say, a single antenna.

278
00:23:21,280 --> 00:23:24,040
Well, you can perform denial of service on the PKI infrastructure.

279
00:23:24,440 --> 00:23:27,100
The example here we give is on single antenna systems

280
00:23:27,100 --> 00:23:29,980
where you can actually cause a collision attack by transmitting out of sync

281
00:23:29,980 --> 00:23:31,720
with the rest of the nearby systems.

282
00:23:31,720 --> 00:23:31,940
So, you can do that with the VAN network.

283
00:23:34,300 --> 00:23:36,720
On top of that, there are...

284
00:23:37,160 --> 00:23:42,000
I mean, so you can enumerate over, so the actual nature of the network

285
00:23:42,000 --> 00:23:45,800
is such that you can enumerate over the actual services provided

286
00:23:45,800 --> 00:23:47,980
just by observing the traffic across,

287
00:23:48,200 --> 00:23:53,620
and that allows you to characterize a great number of the architectures

288
00:23:53,620 --> 00:23:56,000
in the cars that are along the road.

289
00:23:56,140 --> 00:23:59,240
And if you can get information about the architecture-specific stuff,

290
00:23:59,420 --> 00:24:01,320
the implementation-specific stuff in the car,

291
00:24:01,720 --> 00:24:03,500
you can actually fingerprint that and say that,

292
00:24:03,560 --> 00:24:07,520
oh, wow, you know, this car is running something that I know is vulnerable

293
00:24:07,520 --> 00:24:11,020
and I want to inject and mess with it in some particular way.

294
00:24:12,760 --> 00:24:20,000
You can, as we described earlier, hijack or perform privileged escalation

295
00:24:20,000 --> 00:24:24,780
in the public key infrastructure to hijack a certificate for an emergency vehicle

296
00:24:24,780 --> 00:24:28,520
or some other kind of privileged user that's allowed to execute built-in services

297
00:24:28,520 --> 00:24:31,700
like , which drives, which makes the vehicle come to a stop on the street,

298
00:24:31,700 --> 00:24:35,980
on the side of the roadway, or, you know, et cetera.

299
00:24:36,120 --> 00:24:38,100
And if anyone would ever want to do that, right,

300
00:24:38,800 --> 00:24:41,200
you can also become a mobile toll booth.

301
00:24:43,340 --> 00:24:45,700
Sure. I mean, if, you know, the compromise,

302
00:24:46,500 --> 00:24:50,560
it requires, you know, the exploitation of these privileged users

303
00:24:50,560 --> 00:24:52,300
to actually gain access to their certificate.

304
00:24:52,500 --> 00:24:55,120
And if you're able to do that, you can swipe their privileges

305
00:24:55,120 --> 00:24:58,480
and actually start masquerading around along the road

306
00:24:58,480 --> 00:25:00,140
and do things you're not supposed to, right?

307
00:25:01,700 --> 00:25:05,240
I mean, that's the idea in terms of these exploits.

308
00:25:05,700 --> 00:25:08,980
Or, you know, not exploits, but these particular attack vectors.

309
00:25:10,560 --> 00:25:11,340
Yep, yep.

310
00:25:12,880 --> 00:25:17,820
So, and there's, you know, this also introduces other types of

311
00:25:17,820 --> 00:25:23,260
potential for exploitation of vulnerabilities that exist today.

312
00:25:24,280 --> 00:25:28,620
Right, you can easily, you know, the point about having, you know,

313
00:25:28,640 --> 00:25:31,680
network access from one single entry point and being able to probably get a message,

314
00:25:31,700 --> 00:25:34,480
that means you can probably get things like malware across the entire network

315
00:25:34,480 --> 00:25:35,820
from one entry point.

316
00:25:36,000 --> 00:25:40,640
And moreover, if an entry point has a vulnerability that is implementation specific,

317
00:25:40,940 --> 00:25:44,620
not even one that exists at a theoretical basis in the standards,

318
00:25:44,760 --> 00:25:50,140
that provides you the ability to compromise all other systems that are compliant,

319
00:25:50,300 --> 00:25:51,980
that might not harbor the same vulnerability.

320
00:25:53,560 --> 00:25:59,180
You can reverse engineer, wirelessly now, reverse engineer vehicular architectures

321
00:25:59,500 --> 00:26:01,460
the same way that you would reverse engineer,

322
00:26:01,700 --> 00:26:05,740
say, a vehicle control bus by performing enumeration of built-in diagnostic services

323
00:26:05,740 --> 00:26:07,700
in the DSRC protocol.

324
00:26:08,200 --> 00:26:14,280
You can, let's see, you want to talk about that?

325
00:26:14,500 --> 00:26:19,220
I mean, so, I mean, some of the nature, or the nature of this,

326
00:26:19,940 --> 00:26:22,680
of the vehicular ad hoc network, and V2X particularly,

327
00:26:22,680 --> 00:26:26,360
is that these vehicles communicate to each other, right?

328
00:26:26,440 --> 00:26:28,620
But the vehicle also bridges out to external networks,

329
00:26:28,740 --> 00:26:31,340
be it through Wi-Fi access points or LTE.

330
00:26:31,700 --> 00:26:36,820
So if the vehicle is able to be compromised by messages going across DSRC,

331
00:26:37,100 --> 00:26:41,580
then you can actually use that, you know, LTE, the card, you know,

332
00:26:41,580 --> 00:26:47,260
the cell phone chip on the card to actually pipe data up to wherever you want,

333
00:26:47,360 --> 00:26:51,280
and potentially even, you know, get data back down and plug in back doors,

334
00:26:51,380 --> 00:26:52,020
whatever the hell you want.

335
00:26:52,400 --> 00:26:53,660
I mean, that's the idea.

336
00:26:55,860 --> 00:26:56,300
Yup.

337
00:26:56,660 --> 00:26:59,480
And even more than pwning, the whole point of this,

338
00:26:59,540 --> 00:27:01,440
while it is neat to showcase,

339
00:27:01,440 --> 00:27:04,440
right, these kinds of attacks,

340
00:27:04,680 --> 00:27:10,420
it's more about providing a platform that allows everyone homogeneously

341
00:27:10,420 --> 00:27:13,440
to participate in the development of these standards

342
00:27:13,960 --> 00:27:15,920
and of these future architectures.

343
00:27:16,260 --> 00:27:20,180
The state of them today very much reflects the need for participation

344
00:27:20,180 --> 00:27:23,720
by the security community to develop these to a point

345
00:27:23,720 --> 00:27:27,780
where they are resilient and robust and ready for deployment

346
00:27:27,780 --> 00:27:30,760
in safety critical infrastructure systems that are going to involve

347
00:27:30,760 --> 00:27:34,620
more network traffic than we've ever seen before in this kind of system.

348
00:27:36,340 --> 00:27:38,200
So you get to participate.

349
00:27:38,440 --> 00:27:41,100
This code, we've released our framework on GitHub,

350
00:27:41,180 --> 00:27:44,140
and we're going to continue development and contribution to it

351
00:27:44,140 --> 00:27:47,500
to extend support to a wide range of wireless drivers

352
00:27:47,500 --> 00:27:54,040
and to continue developing the J2735 interface

353
00:27:54,040 --> 00:27:56,260
as the standards become developed further

354
00:27:56,260 --> 00:27:59,220
and eventually integrate 1609

355
00:27:59,220 --> 00:28:00,740
when the full framework is ready.

356
00:28:00,760 --> 00:28:02,340
So the whole family is complete and ready.

357
00:28:02,580 --> 00:28:07,560
So unfortunately we don't have more time to do,

358
00:28:07,620 --> 00:28:09,500
we'll be doing some stuff over in the Karakin Village.

359
00:28:09,580 --> 00:28:11,360
You can come and ask us questions and we can show you stuff.

360
00:28:12,220 --> 00:28:13,420
I want to thank these guys,

361
00:28:13,660 --> 00:28:15,540
especially that one there in the middle

362
00:28:15,540 --> 00:28:19,160
for helping us get through this over the last couple of years.

363
00:28:19,380 --> 00:28:20,520
So here's the GitHub link.

364
00:28:20,820 --> 00:28:21,640
Here's some references.

365
00:28:21,760 --> 00:28:23,020
And thank you very much.