Cool. We're going to start going now. So my name is Justin. I work for Delphi Automotive
who's sponsoring the Car Hacking Village. I run the red team testing lab there. So my team who
you'll see around here is the ones that are going to be doing demos and doing a lot of this
stuff for us. But we hack our own modules to help our engineers secure them better. So to get
into this a little bit, starting off at the Car Hacking Village we do have a CTF there this
year. It's really, really cool. They got lots of different interfaces, lots of different
systems to hack into. The first place prize is this truck over here. So if you guys want to play
around you can win a truck. Another prize that we're going to be giving away is this antenna
that we're going to be demoing for you guys. So you can see it right here. This is a GPS
helical directional antenna. We'll go into the making of that as well in a little bit. So to
yeah, going back to our day job. So we're a Delphi Cyber Security
testing team. We do pen testing for the company, process and tool development as well as
research and development. This is what our facility looks like. We've got a bunch of garage
bays we can pull cars into and a pretty big facility to do testing on modules. So now moving
into the outline, we're going to talk about different test interfaces on the wireless side as
well as tool kits for it. Just to help you guys out in case you may not have tested or done
this stuff before. So we'll just kind of give you the rundown of what we're using and what
works for us. Then we're going to do a demo on key fob analysis. We're going to do a demo on key fob
analysis. So we're going to use GNU radio and a HackRF to do some analysis on key fob to show you
how to pull those out of the air and do a deep dive into those. And then we're going to go into
building directional antenna, which is this guy over here in the front, Brian, who's the
mastermind behind that. And then we're going to get into the demo of actually directionally
pointing GPS over here and showing you how that antenna works. Alright, so now this stuff I'll run
through quick because you guys probably know a lot of this. This is just the typical Wi-Fi
standards. So I just wanted to throw this in here so you had it all. And then we're going to go
to the next one. Here's some tools that you guys can use for Wi-Fi. We don't do too much Wi-Fi
stuff in cars. I mean, pretty much most of them have WPA2. So unless you can bypass a password,
which they're getting a little bit better. The car companies are slowly getting better at
making good passwords on WPA2. But that's really the only weakness that we're seeing. So yeah,
we'll go to the next one, which is going to be Bluetooth. Bluetooth was a lot more vulnerable in
the older versions. So any older cars that have older versions of Bluetooth in it are
extremely vulnerable to those types of attacks. Here's some more specs on that. It's another RF
spectrum that sits in the 2.4 gigahertz range. The Bluetooth version 5 is really nice because
it's bumping up the speed like crazy. And mainly the, whoops, mainly the distance, which is
nice. Just because all these different devices people are making in their houses, you can go a
lot more farther in your house. But then for us, if we want to do drive-bys, we can also get
into their stuff. So here's some tools that we use for Bluetooth testing. We've got Bluetooth
testing. The Ubertooth one is really helpful. And then we just use this adapter. It's really
easy. We can transmit on this. We can do whatever we want with this device. Some Bluetooth devices
won't allow you to. Um, so now moving into cellular. There's three different areas that we
focus on in cellular. This is just giving you a rundown of spectrums. So whenever we're trying
to dig into a new technology or understand it more, this is the type of data we compile to start
digging and understanding what tools we want to buy. Um, and then we start reaching out to
vendors or coming to events like this and buying all the hacker tools. So when you're getting into
a cellular related stuff or any, uh, wireless stuff on cars, um, it's recommended to look for
this type of content on any of the modules. Mainly something with the FCC ID or even an IMEI
number. It's going to let you know there's a cell network in here and it's transmitting some
kind of RF somewhere. So this is how we quickly can move on to understanding what's coming out of
this module. So now looking into the tools that we use. We're, um, trying to find what works
best for us. So we buy a lot of industry based tools. Like this guy up here, he's got a lot of
stuff. This is from Roden Schwartz. It's a cell site simulator. So this will actually put up a
cell tower for you. You put a SIM card in your phone or whatever you need to and now you can see
all the data streams and everything that's going back and forth from that phone. So it's really
helpful for us when we're trying to test apps and cars that people are building to understand if
they're actually communicating to the server securely and what type of data they're sending
back and forth. Um, and then for putting up base stations, um, on a cheaper way, you can use a
BladeRF with YatesBTS or this USRP device with YatesBTS as well. Those are a little bit more
cheaper routes to go. And you can have a lot more customizability with those. Um, next is
moving on to KeyFob, which we're going to show you the demo on. This is something that was
introduced in 1980 by Ford. Um, there's two main frequencies which is 3.5 megahertz and
4, 33.92 megahertz. Um, the distance is 5 to 20 meters and the security on this is mainly rolling
codes and challenge response. A couple years ago you guys may have seen a guy named Sammy Camcar
create a device that was, uh, you know, you know, uh, uh, uh, uh, uh, uh, uh, uh, uh, uh, uh, uh,
able to bypass or, you know, leverage rolling codes to be able to get into people's cars. Um,
there's also passive key entry systems which are running stuff in the, uh, kilohertz range. So
when you walk up to your car and you want to unlock it with just your button, uh, or the
handle on the car, that's usually using something in the kilohertz range. And that's called
passive key entry. So here's some tools that we use for, uh, the KeyFob stuff. Uh, we mainly are
using the hacker refs, but the spectrum analyzer is really helpful to see those packets coming
across. Um, and then we also use the yardstick one because that goes down to the lower
kilohertz. So now moving on to GPS which we'll show you in a demo on that as well. This is
something that was created by the United States in the 70s. Um, there's a few different bands. The
ones that are mainly public are L1 and L2. Uh, if you want to lock down GPS properly, use both
radios in your devices. Most people don't. I know Apple doesn't and we can talk about that in a
little bit. We can show you what happens with that because they don't. Um, we pretty much can
put anybody's phone wherever we want if you're only using one band because your phone's only
relying on that band so it's not getting another source to say, hey, you're not actually here, you
should be here. Um, so we'll show you what, how that can be messed with. Um, some different
tools we're using for this. You can use a hacker ref. Uh, they're kind of hard because you've
got to stack a bunch because you have to do transmitting and receiving. Um, and then we
mainly use the blade ref, um, which we have set up here connected to this
antenna. So we'll show you that in a moment. And then the next one, the last one, which is a
fun one, which you guys may not have heard of yet. This is something that's coming in cars. It's
kind of scary from my perspective because of what they're trying to do with it, but it is
something that's needed. Cars do need to talk. If we're going to have autonomous cars down the
road, they do have to talk to each other in some manner. So this is currently the automotive
solution for that. It's called vehicle to everything. Um, it runs just above, uh, the 5
gigahertz range and it has a protocol of 802.11p, which is a protocol that allows you to
use it. It's very similar to all the wifi standards. It's really not that much different. The
biggest thing is, uh, it's got this IEEE 1609 application layer on top of it. And then here's
some tools that we use for that. Um, if you're looking into development tools, so these are
just the hacker type tools besides this one, but another development tool you can look to is
something called CODA Wireless or MK5. Um, that'll allow you to actually transmit and do some
V2X based stuff. And another one from the auto industry is pretty big. It's Vector Canoe.
They're really expensive, so hopefully in the near future some hackers will release some tools
that are a lot cheaper for you guys. Alright, now we can move into this, uh, key fob analysis if
you're ready, Dave. Right here. Right here. Hi, everybody. My name is Dave Conant. I work for
Adelphi along with Justin, and I'm sort of the radiest hacker in the world. I work for
Adelphi and I'm a video guy, I guess, uh, over there. Okay, so is my screen popping up here? No?
How do I... Oh, there we go. That's interesting. Well, if you can't do it, you can do it.
Can't see it, I'm gonna have a hard time demoing it. There we go. Alright, so who's used GANOO
Radio before? Anybody in here? Has anybody... For the people who haven't used it, have you heard
GANOO Radio? Okay, so if you haven't used GANOO Radio, or you've heard of it, uh, I'm going to
explain just the basics of what this thing does. It's a, it's a useful tool that we use in the lab,
that we use to isolate different wireless signals. So Justin spoke about GPS, you know, DSRC,
but at the end of the day, in the radio frequency spectrum, you know, vehicles themselves, they
have, like, 15 different radios on them. Your phone probably has, like, six or seven. You
know, you've got Bluetooth, Wi-Fi, but then what about the non-standard wireless? So, you
know, I've got my key fob here for my truck, for example. Now, this thing doesn't speak
Wi-Fi. It doesn't speak GPS. So how do we deal with signals when we don't really have, you
know, like, a Wi-Fi adapter to, like, just let us authenticate to it? Basically, from the blue,
reverse engineering random wireless signals and looking at the binary data inside of them. So I
want to show you two tools that we use in the lab to isolate these signals and how we can decode
the actual binary data off of that so we can actually send and communicate with these basic
devices.
It's actually, generally speaking, easier to talk to these guys than something like using
Wi-Fi. It's much less complicated. So, for example, with your key fob, it's just a series of
bits, and if the car hears the right series of bits, there's no handshake. It just says, oh, I
like those bits. I'm going to open up the car. It's that simple. So as long as you know that
code or how to generate that code, then you can talk to it. So actually being able to read the
code off of the air if you don't know what the wireless signal looks like is a very useful
skill to have in general. DEF CON, we've seen talks that guys talk to satellites using these
techniques. You can talk to cars. Anything that transmits a wireless signal that you can talk to.
So I'm using a HackRF. I think the range on this thing in frequency terms is, it goes up to 6
gigahertz and down to 10 megahertz? 1 megahertz? 1 megahertz. That's a huge range. This is
actually a monumental invention, software defined radio in general. Having this kind of power to be
able to transmit and receive on that wide a frequency range is something that 10 years ago even
would have cost millions of dollars in equipment and would have been military classified type
technology. So please get one and learn how to use them. They're very awesome. All right. So I'm
opening up basically a utility called GQRX. GQRX, if you install a new radio along with this,
you're going to be covered. So I'm going to move this guy over here. GQRX, this guy right here is a
spectrum analyzer. Everybody knows what that is? It's our eyes and ears on the frequency, the
frequency realm. This lets us see our wireless signals. This guy and most spectrum analyzers cost
between at least $10,000 up to $500,000 to $1 million. Just to give you an idea of what it's
like just to see a spectrum range that we're talking about here. HackRF costs I think $200 or
$300 and it can see almost the same range as this guy. This guy is still better. It's more
accurate. But the HackRF is good enough for us hackers. And GQRX, I want to show you, basically
does the same thing that our $200,000 spectrum analyzer over here does. And you can actually see
they look very similar. And I'm going to use GQRX to move down and find my key fob signal to show
you guys what that looks like. I happen to know that it's 315 megahertz and everything, all your
devices, they come with an FCC ID if they're being sold commercially. So they will tell you what
the frequency is on the FCC's website. Super useful website to look up all kinds of parameters
that we're going to use in GNU radio to decode this signal. So you can see here when I press my
little button for my HackRF, there's a little bumpity bump coming. That's a frequency shift key
coming from my key fob. I do want to show you as well, so we're looking at, I think, what is this?
20 megahertz in bandwidth or 16 megahertz, I can't remember. I do want to show you an important
and difficult part in dealing with GNU radio is setting up the filtering. And I want to show you
just what filtering looks like in GQRX. When you click around, you can see that little band
there. It's actually filtering all the signals out around it. And if I had my audio on, it would
actually play the sound for the signal that you're receiving. So you're narrowing in and zeroing
in on that signal that you're looking for despite capturing 20 megahertz worth of bandwidth.
So I think my computer locked up. Yeah, okay. Well, that's okay. I was going to close GQRX
anyway and switch to GNU radio. The important thing to understand is when we're going to decode
this signal in GNU radio and get the binary bits out of there, there's basically four steps and
essentially we have to capture the signal from a source. That's obvious. And then we need to
filter all the junk.
And then we need to filter all the junk around it out from the signal. And there's an entire
series. You should watch Michael Osmond's SDR series if you haven't already. He's the guy who
created the HackRF. And he's got an entire educational video series. And he's got an entire
one dedicated, an entire hour dedicated to filtering. It's a science and an art. There's a
lot that goes into it. There's many different kinds of filters, high pass, low pass, band pass,
X-flating, fur filters, blah, blah, blah. Learn them all, what they do, what they do, what they do,
they're not that tough, but they're a little intimidating to get to at first. It's very
important to zero in on your signal with those filters though. Okay. So once you've zeroed in on
your filter and on your signal with your filter, the next step that you have to do is demodulate
it. Demodulating is going to come in a couple different flavors. There's frequency
demodulation and amplitude demodulation. So when you're playing around in GQRX, it will
behoove you to figure out and identify with your eye or your ear whether you're dealing with a
frequency shift key signal or an amplitude shift key signal. Amplitude sounds like Morse code or
it's changing in volume. A frequency shift key is going to have differing tones that you'll hear
and it'll sound more like music or dubstep or something like that. So once you identify that,
you can pick your frequency shift keying or your amplitude shift keying. So I've prepared new
radio blocks here. Let's see if this works. Is it? Okay. So I'm going to go ahead and turn this
on. No, it doesn't. What's that? Oh, there we go. Wait for it for a second. Okay. I have to be
fast here. So my program that I've written here, GNU radio, oh, whoa. It uses flowcharts to
define your actual software. In the background of each one of these flowcharts, there's actually a
Python script that gets executed. And you can see here, this is what I was talking about. I'm
using the Osmocom source, which is my HackRF. I set the frequency to 315 megahertz because I know
that that's where my signal is. And I set my sample rate to be about 4 megahertz. That means
I'm capturing 4 megahertz of bandwidth around the signal. That's a lot of bandwidth. The actual
bandwidth of this signal is like 200 kilohertz. It's not that wide. That's why I pass it into a
filter. I'm not going to explain all of these details. I'm just going to go ahead and run this.
You can see it's a lot of different parameters. But basically, I'm zeroing in on the signal with
this. So it's kind of offset from 315 megahertz. It's not quite exactly. It's like 314.9. You can
figure that out from the FCC website. So I'm offsetting it to zero in on the signal. And then I
am shrinking down that 4 megahertz of bandwidth just to capture this signal alone and none of the
junk that's flying around it, especially here at DEF CON. I'm then piping the signal into a
frequency sync.
Which is exactly the same thing as the spectrum analyzer that we see here. So we can actually see
the signal that we're capturing and confirm that we're getting it. De-modulating the signal. And
now this is the secret sauce to get the binary data out of it. So at this point, this is nice,
you'll actually be zeroed in on a signal. You can hear it. You can record it. You can save it. And
you can import it into other analysis tools like Baudline and Spectrum or even Audacity, your
favorite music editing program, is able to read this. So you can actually see the signal and then you can
see the data coming out of here. So you can just put that into a file sync right there. But if you
just want to pull the bits out, you put it into a clock recovery block. The only thing you need to
know to use this block is your baud rate of the signal. And you can look at that visually or you
can look it up on the FCC. My key is I think 115,000 symbols per second. And once I know that,
then I put it into a binary slicer that slices it into bits. And I save it to a file on the TempFS.
I'm going to show you what that looks like when it runs right now. And I know there's a lot of
information. I have a ton of resources for you folks that you can like walk through chapter by
chapter. There's a lot of authors out there that have done this exact same thing. And they explain
everything in far more detail than I can here today. All right. So I'm going to run the program.
Hopefully it'll work. I'm going to click okay. That's fine. So I'm going to run the program.
All right. There's my signal. And now I'm just going to exit because I've captured what I need.
So I save that to temp test. I'm going to go ahead and just dump that with a hexadecimal viewer.
And bingo. So you can see the pattern there in the bits.
It's basically all ones. It's a preamble for the signal saying, hey, you're about to receive some
interesting data. And right after that you can see that there's the code right here. Now
something I didn't show you in my block, that if you actually want to use this in the field, is
there's something called a... There's a way that you can set the access code. So hey, look for
the ones in a row and only capture the bits that come after that. It's useful so you don't get this
this file that I showed you that has all of the repeating signal here. It'll just grab the
signal that you're interested in. But just for the purposes of this demo I wanted to show you
the preamble and the code, the preamble and the code, the preamble and the code. And that is
literally the key fob signal for my truck. So if somebody wanted to take a picture of those ones
and zeros and could find my truck in the parking lot, you could redigitize the signal over the
air and break into my truck. And that would be that. Anybody else want to try pressing their
unlock key and let me record it and tell me where the make and model and where it's parked? No?
It's really cool stuff. That's all I have for you today for my demo. But that's how you decode a
binary signal arbitrarily broadcasted over the air. You reverse the entire process to broadcast
it out. And please learn how to use GNU Radio GQRX and buy yourself a HackRF to get into this
stuff. And thank you very much. I'll pass it back to Justin. Thanks Dave. We got to flip
laptops. I got to flip the laptop.
I got to flip the laptop again. Open. Yeah, pull the HDMI. Sorry, one second while we switch the
demo stuff up. Alright, now we're going to get into the making of the antenna over there.
Whenever the screen wants to load. Yeah, one moment. HDMI. Sorry guys. Alright, here we go.
Nope. No source found.
Sorry, I, it's, I have it set up to duplicate. Looks like it's not really going in.
Looks like it wasn't going in. Yeah, there it goes. You're right. Huh.
So we're going to try and unplug, try to get it to read effect. Oh, hold it. Yeah, oh shit.
Sorry guys.
Got to love technology. Yeah.
And that way you've got to watch it.
.
.
.
.
.
. . Oh yeah, I look, I see you already or how did you get in their technology
. . . . I got it on spaghetti here.
Just the normal thing. Yeah, it's just the source
. .
No, it's HDMI. Sure, we can try it. All right. Never mind. We'll try this. If not,
then I'll try this little dongle. There we go. Sweetness. Sorry about the delay, guys.
All right. So now we're going to get into building a helical antenna. So this is going to be
presented by Brian Gillespie. This guy is a bad ass physics guy. He knows a lot of stuff in
physics. And now he's becoming a hacker. So here you go. Here's Brian. All right. Thank you,
Justin. Are you going to index the slides since you took? Okay. So I'm going to just review some
of the fundamentals of the radio physics ways as most of you probably know. But I'm going to
tell you what we need to understand with building things like this and doing things that Dave's
doing and other people. So the quick review. So here's our whole spectrum that we have. You
know, increasing wavelength. We have the lower frequency. And then we have higher frequency,
smaller wavelengths. And if you see where I've got that arrow pointed, radio frequencies are
typically frequencies above 1 gigahertz or 10 to the 10th of a second. And then we have the
9 hertz. And they travel at the speed of light. And so we'll go to the next slide here. So
they travel in a straight line and they are reflect. So when you're above that frequency
range, they'll bounce off things like the walls. When you have the lower frequencies, you can
have environmental effects on them. But for what we're doing, you know, the travel's at the
speed of light. And it's important to remember our wave equation here where we have, you know, the
frequency . . . Or it's not there. Okay. So when you're down the tube and you're over that wave, you're not able to see the lights. That's not
The frequency times the wavelength gives us the speed.
So that's going to be helpful when I build the antenna.
And forward.
So helical antenna.
This is what the main part of the talk here is.
So you've got your center support here, which is this B here.
And you can see that in the antenna over there, the coaxial feed line.
And then you have the insulating supports because we don't want any connectivity anywhere else.
You've got the reflector ground plane.
And then you've got your coaxial that feeds your signal in.
Or if you want to receive, then it goes the other way.
So there's two modes that these helical antennas can operate in.
And that's the normal mode, where the helix pitch and diameter are small compared to the wavelength.
And are omnidirectional.
And then the axial mode type, N-fire, which is what that antenna over here is,
is the diameter and the pitch are comparable to the wavelength.
And you'll see that when I'm going to show up here next, or coming up.
So this is just kind of a visual of what it looks like from some simulations
between an omnidirectional type antenna, which just kind of radiates out and spreads out.
Where the N-fire directional, which is the helical, which means we can point it at things, is this one here.
So.
Here's a little more animation here for us, just to show what happens when we have a helical antenna.
And that is, depending on which way the helix is oriented, the waves will spin one way, or the vectors here,
will show the polarization, and will be right-handed or left-handed.
And so that's based on how this, which way that's turned.
Now I don't know, you took the animation out, it looks like.
That's okay.
But you can see.
Down here, as it comes out, these waves are spinning around.
That's the representation up here, and that's the N-fire for that.
Okay.
So this gets to the heart of the manner here of how to make the antenna.
So I found this nice website up here that did most of the calculations for us.
So plug in the frequency, how many turns you want,
and then it pops out all this information that we need to build the antenna.
So this is the general schematics that I had to take and interpret to,
you know, build that antenna that's sitting over there so that we can use it for our work
and looking at what happens when we, GPS is pointed at something that has it
and what impact it's going to have for us.
All right.
Whoops.
Okay.
So real quick, take some tools to build that and some design work from the previous slide
to make all these parts here.
So this is our bridge-up-art mill that I was using.
I was in the process of putting in the holes.
All these holes are spaced on fractions of wavelength from that slide I showed you before.
So that tells me what the spacing needs to be here.
And then from there, you need to use the lathe to make some of the other round parts,
basically the items you need.
And one thing to remember that an antenna is just a wire.
So all that is is just a wire configured a certain way to get the frequency we need for this application
and some plastic, some aluminum, and other tools.
All right.
So there's the, oops, backwards.
There's the antenna.
And I think we're ready for the demo.
So this is some things we're doing in the lab here.
So you can see we're getting the signal.
We've got a blade RF.
Nick over there has got us all set up.
Some of you, he's been broadcasting that for the whole time.
So depending on your device, it could show you that it might be 1,000 feet above Moscow.
So if he points it over here, let me get it out of the way.
You should see the signal get stronger as he points it over here.
And that's the purpose of it.
But now if you put your hand in front of it.
Now, see, it's bouncing off the wall.
Put your hand in front of it when you turn it over there, because I checked it earlier.
See, it's now, because it's reflecting off the wall, like I was mentioning,
because it behaves like light.
So it'll just bounce off the wall.
So, and that's everything.
It was a common issue we were having in the lab.
It was like we were tilted.
We're like, this thing's not working.
We're like, this thing's not working.
But then we're like, oh, yeah, reflection, light.
It's just light.
So that's why if you do, I don't know if this is going to work.
It's just going to go the whole way.
But if you do that and put your hand in front of it, it's going to put it away,
because now it can't reflect off the walls anymore.
But if you do this, now it's starting to reflect off the walls and the room and the ceiling,
just like light does.
Another thing, too, we don't have the amp plugged in on this,
so we're not giving it enough power.
We could pump this thing, or here, I'll let Nick talk about that.
Yeah, go ahead.
With proper amplification, you can cover this entire casino in whatever signal you want.
This will render all navigation GPS completely useless.
You'll be able to do that.
You'll be wherever I tell you you are.
Yeah, so pretty scary stuff, especially with autonomous cars coming down the road.
Obviously, we care about safety a lot, which is why we design stuff like this,
so we're not just putting everybody in the whole entire place in Moscow.
We're just putting everything that's directional over there.
It's a safer way of doing tests like this.
You don't really want to get FCC calls.
So doing stuff like this and having the proper facility to do this stuff in is also really helpful.
The lab we do all this testing in is pretty much,
it's pretty much a Faraday cage.
We don't have cell inside the building.
We can't get anything in or out,
so we know the tests that we're doing inside are not affecting systems externally from our lab.
So yeah, that's about it.
If you guys want to get into cars, we'll be here the whole entire time during DEF CON.
We're a part of the CTF, so we have some stuff over there you guys can hack into,
try to find some flags, and maybe win that Jeep, or that truck, or this antenna.
So yeah, thank you guys for coming out, and enjoy the CON.
We've got a question for you.
We're doing questions now.
I realize we do have some extra time.
He said...
It was about, without using both L1 and L2 to lock down your GPS signal,
how do you push someone into Moscow?
So if you're using both L1 and L2,
that would stop an attack like this from a SCID if they were doing one radio.
You can sync two radios, broadcast L1 and L2 for the correct position,
but it requires manual math or a very well-written program.
What you would see with both receivers is you would see that L2 is getting where you would expect,
where L1 is not.
And L2, if they broadcast, there's no open source GitHub project for that yet,
but I'm going to post it.
You would be able to tell also by the difference in timing.
So we need less than five parts per million accuracy, or precision,
to be able to get this to be received by your phones or any other consumer-grade device.
It is very unlikely for someone to be able to do the wiring correctly,
to get that kind of accuracy to be consistent through two radios at the exact same time.
So that's a good stop for this type of attack.
Great question. Any other questions?
We'll go with you in the red first.
So with this attack, the question was, could we impact timing?
The answer is yes.
Whatever time I broadcast, you kind of need to know more about the packet that gets broadcasted,
from the satellite.
But basically, it's its latitude, longitude, and its time of broadcast.
And then your radio takes in all those signals it picks up and says,
ah, I see the time of flight was so-and-so, therefore I'm here.
So if I were to broadcast consistently a different time, yes, you would receive it and trust it.
It's a very weird phenomenon, but people do it.
They use their GPS as timers.
With your RSA certificates,
time is usually a factor in that,
and you can completely set the seed value for a lot of these embedded controllers,
because they'll generate the same certificate given the same time.
So if you know what it was once,
you can just tell it it's the same time over and over again,
and all of a sudden you're able to get the same certificate all the time.
Which means now you can man the middle, even if they rotate their certs.
Funky little CS problems become very big security holes.
Any other questions?
Cool.
Just generally, when you take a look at a car,
what do you start going after?
So that's a good question.
We don't directly focus on the full vehicle yet.
We're mainly focused on modules.
So if you guys don't know what Delphi does,
they create a lot of the safety systems in your cars,
as well as infotainment systems in your vehicles.
So right now our focus is strictly on protecting our parts.
Down the road we do want to have offerings to our customers,
OEMs, where we could do full vehicle assessments for them.
But right now it's strictly on the module side.
I did a talk a few months ago at SANS that kind of laid out a lot of this stuff.
I can get you that link, and there's a presentation in there
that'll show you more details of what we did for that.
Yep?
Are you focusing on the MDRC or the interface to the OEM?
We do, yes.
And we also focus,
sorry, the question was are we only focusing on like our ECUs
or the interfaces that are coming in from other stuff?
And the answer is absolutely the stuff that's coming from other systems.
And that's why even the wireless stuff,
you know, when stuff's coming over wireless, we're testing that.
We don't only look inside our systems.
We look on the interfaces and anything that's connecting to the systems.
A lot of that's hard to test when you only have the module
because you don't know how everything's going to be talking to it.
So that's why we're trying to build our systems up
to eventually do full vehicle assessments.
So, good question.
.
Yeah, yeah.
.
Oh, cool.
We'll talk later.
Any other questions?
All right.
If you guys have any, just ask.
Or if not, just stop by our booth.
Thanks again.