1
00:00:00,000 --> 00:00:06,520
Welcome to the Car Hacking Village Turbo Talks with Sameer and Vlad, abusing smart cars

2
00:00:06,520 --> 00:00:14,020
with QR codes. Welcome everyone, my name is Sameer, I'm the Senior Director, Security

3
00:00:14,020 --> 00:00:19,800
Consulting for Spartan Security Labs and along with me I have Vlad. Hello, my name is Vlad

4
00:00:19,800 --> 00:00:28,440
Gusimelski, Senior Security Consultant at Spartan Federal. Sameer and I work on doing

5
00:00:28,440 --> 00:00:35,380
security assessments on various devices, smart vehicles, scale systems, wide scale distributed

6
00:00:35,380 --> 00:00:42,240
networks, satellite systems, that sort of thing. Applications, mobile and anything in

7
00:00:42,240 --> 00:00:49,120
between. So let's get started, we have for today's agenda we are talking about abusing

8
00:00:49,120 --> 00:00:56,120
smart cars with QR codes and for you we'll talk about history of QR codes. QR codes have

9
00:00:56,120 --> 00:00:58,420
been around for over two decades. How did they come about? How did they come about?

10
00:00:58,440 --> 00:01:03,380
How QR code got ventured into the automotive space? What are they being currently used

11
00:01:03,380 --> 00:01:08,700
for in automotive industry? Especially with smart cars, what are some of the security

12
00:01:08,700 --> 00:01:14,920
challenges around it? And some of the trivia questions that we are going to have, so please

13
00:01:14,920 --> 00:01:21,120
listen in carefully. You are going to win a t-shirt that I'm wearing, Do Good, Know

14
00:01:21,120 --> 00:01:27,200
Evil. We are not going to give it in the talk, so whoever wins, please collect it with

15
00:01:27,200 --> 00:01:28,420
Tej. He's sitting there.

16
00:01:28,420 --> 00:01:31,900
He's sitting right in the end. You can see his hand right there. So let's get started.

17
00:01:34,540 --> 00:01:39,660
So history of QR codes. As I said, right, I mean, it's been there for over two decades.

18
00:01:39,860 --> 00:01:45,880
It was born in Japan with a two-people team, Mashiro Hirohara and one more team member.

19
00:01:46,440 --> 00:01:53,780
Denso Corporation was sort of the owner for that. It gained its popularity in 2002 when

20
00:01:53,780 --> 00:01:58,120
it started getting used for general purposes for ticketing systems.

21
00:01:58,420 --> 00:02:02,580
For advertising, for various other things. Steven, I'll end.

22
00:02:07,000 --> 00:02:12,620
So previously when the QR codes were used, people were using dedicated readers for them, just

23
00:02:12,620 --> 00:02:18,980
like the kind that you see in the store for scanning prices on various products. As smartphones

24
00:02:19,480 --> 00:02:25,960
became more popular, it was not possible to capture with your phone's camera and decode it. So

25
00:02:25,960 --> 00:02:28,400
it really opened up the market for us. Then there was the technology, the technology that we are

26
00:02:28,400 --> 00:02:35,060
for everyone. Home users were now able to open up hyperlinks that are instructions with

27
00:02:35,060 --> 00:02:40,640
their smart phone. They're able to follow directions, check in at various locations, do

28
00:02:40,640 --> 00:02:48,060
their own inventory control. Alright, that brings us to our first trivia question. Which

29
00:02:48,060 --> 00:02:55,480
automaker first started using QR codes and when? Alright, when? Alright, you get half

30
00:02:55,480 --> 00:03:05,200
of a t-shirt. Anyone else wants to take a stab at it? Ninety-nine? Ninety-four? Alright,

31
00:03:05,340 --> 00:03:11,860
you get the other half of the t-shirt. Yes, so you're right. Toyota started using them in

32
00:03:13,380 --> 00:03:20,080
1994 for actually tracking the parts and the cars that they were making. So please make sure

33
00:03:20,080 --> 00:03:25,460
that you get your half and half t-shirt from Tej. Current use of QR codes and QR codes

34
00:03:25,460 --> 00:03:30,920
in the transportation industry is sort of like now widespread, right? They are using for,

35
00:03:31,040 --> 00:03:35,840
just as I said, right, tracking cars and its parts, for inventory control, for fleet tracking.

36
00:03:37,320 --> 00:03:42,940
Also, Michigan Department of Transportation has recently started using them for signal

37
00:03:42,940 --> 00:03:48,920
repairs. So the image that you see is actual image where instead of having a big log that

38
00:03:48,920 --> 00:03:55,300
they used to store in the signal repair box itself, now instead of that they take their

39
00:03:55,460 --> 00:04:01,560
smart devices, scan the QR code, and then through that they are able to gain all the

40
00:04:01,560 --> 00:04:08,280
information that they need to have for repairing the system. It's being also used widely in

41
00:04:08,280 --> 00:04:13,800
automotive sales. It's sort of like replicating the good salespeople because you can actually

42
00:04:13,800 --> 00:04:20,660
scan a QR code and get a consistent message about what this vehicle is, what are its

43
00:04:20,660 --> 00:04:25,400
capabilities, engine, et cetera, et cetera. And marketing and promotions have

44
00:04:25,460 --> 00:04:34,180
been around for ages, bloody or not. So, next question. So, can anybody tell me if a QR code

45
00:04:34,180 --> 00:04:39,780
can be hacked? Yes. Do you want to elaborate a little bit on it?

46
00:04:52,760 --> 00:04:55,380
So that's not hacking. That's like fabricating.

47
00:04:55,920 --> 00:04:58,780
. So you get a negative t-shirt, so you put it together?

48
00:04:59,060 --> 00:05:00,680
. Yes, gentleman in the back.

49
00:05:00,880 --> 00:05:05,860
. If QR codes are linked to a URL trooper, which most of them are,

50
00:05:06,040 --> 00:05:09,720
you can tamper with the URL trooper, read right? .

51
00:05:11,180 --> 00:05:12,620
Absolutely. You do get a shirt.

52
00:05:13,220 --> 00:05:20,320
. So the URL answer is no. I mean, you do have to physically tamper the black

53
00:05:20,320 --> 00:05:24,360
and white, to kind of make it . So...

54
00:05:24,360 --> 00:05:25,220
. Please get it.

55
00:05:25,220 --> 00:05:36,180
you get a full t-shirt. So now that it cannot be hacked, what is the real problem? I think

56
00:05:36,180 --> 00:05:41,200
the next few images will tell you what the real problem is. When we start really using

57
00:05:41,200 --> 00:05:49,300
them for telling directions to smart cars and autonomous vehicles. And this is happening

58
00:05:49,300 --> 00:05:54,020
in California. California Department of Transportation is the first one to actually start rolling

59
00:05:54,020 --> 00:06:00,460
out QR codes on the side of the roads. That's because it's the number one location in the

60
00:06:00,460 --> 00:06:06,500
United States right now where autonomous and semi-autonomous vehicles are on the roads. Right

61
00:06:06,500 --> 00:06:11,640
now they're using them to signal construction zones ahead. They're starting to roll out speed

62
00:06:11,640 --> 00:06:21,600
limit signs in the form of QR codes. So anyone want to take like a guess on what are other

63
00:06:21,600 --> 00:06:23,980
problems that can happen in a smart car?

64
00:06:24,020 --> 00:06:53,740
Are there more t-shirts to give away? All right I'll make it easy for you. So the first thing is right. I mean you could have a QR code that maliciously directs you to a link that gets you, that gets a malware onto your moving vehicle or for a particular component. Then there are issues with physical manipulations. If in the night someone

65
00:06:54,320 --> 00:06:58,840
switches the QR code from stop sign to speed at 50 miles an

66
00:06:58,840 --> 00:07:01,700
hour, that could be an issue. So you could cause a lot of

67
00:07:01,700 --> 00:07:06,180
havoc. And then some intentional and unintentional removal of the

68
00:07:06,180 --> 00:07:09,960
code. If the next generation cars are going to rely on QR

69
00:07:09,960 --> 00:07:15,300
codes for V2X communication, then you have an issue. Because

70
00:07:15,820 --> 00:07:21,400
if there are lighting issues, if it's unable to read the sign, if

71
00:07:21,400 --> 00:07:25,220
there's too much bright light, if there's raining or other

72
00:07:25,740 --> 00:07:29,980
environmental factors, that could be an issue unless it's

73
00:07:29,980 --> 00:07:33,040
been coupled with other technologies like GPS and

74
00:07:33,040 --> 00:07:39,880
others. That's right. So for example, when you do V2V, V2X

75
00:07:39,880 --> 00:07:42,720
communication, you're using a radio signal. The signal could be

76
00:07:42,720 --> 00:07:46,560
monitored. There are actually ground listening stations that

77
00:07:46,560 --> 00:07:49,300
would observe that communication and notice if

78
00:07:49,300 --> 00:07:51,380
something is happening that possibly shouldn't.

79
00:07:52,680 --> 00:07:57,040
As a police officer drives down the road, they can physically look

80
00:07:57,040 --> 00:08:00,180
at the signs and they will know if something is missing. But if

81
00:08:00,180 --> 00:08:04,560
it's a QR code sign, since it's not human readable, a human can't

82
00:08:04,560 --> 00:08:07,920
actually immediately recognize if the sign has changed or has

83
00:08:07,920 --> 00:08:10,680
been tampered with. Even if somebody walks up with a sharpie

84
00:08:10,680 --> 00:08:14,620
marker and draws on it, it'll A, modify the sign or B, make it

85
00:08:14,620 --> 00:08:17,500
unreadable. And somebody driving by at 70 miles an hour will not

86
00:08:17,500 --> 00:08:18,400
be able to tell the difference.

87
00:08:23,780 --> 00:08:28,140
Now, this is one of my favorites. So I did mention speed

88
00:08:28,140 --> 00:08:32,020
limit signs. If somebody were to swap out speed limit signs for

89
00:08:32,020 --> 00:08:35,240
25 miles an hour school zone and 75 miles an hour on the highway,

90
00:08:35,440 --> 00:08:38,240
they're both valid signs. But by transposing them in different

91
00:08:38,240 --> 00:08:41,280
locations, you're impacting the school zone as well as the

92
00:08:41,280 --> 00:08:43,900
highway for the smart vehicles that would actually be designed.

93
00:08:44,400 --> 00:08:46,420
And of course, you would look like an idiot to the normal

94
00:08:46,420 --> 00:08:48,880
vehicles going down the highway because your autonomous vehicle

95
00:08:48,880 --> 00:08:51,380
will all of a sudden slow down or is barreling through the

96
00:08:51,400 --> 00:08:56,460
school zone. Other fun signs to move around are the one-way

97
00:08:56,460 --> 00:09:00,140
signs, traffic keep left, keep right, or if you're trying to

98
00:09:00,140 --> 00:09:03,640
merge into the 287 north or south, and the human readable

99
00:09:03,640 --> 00:09:07,340
sign is very clear. Where's the QR code that's telling your smart

100
00:09:07,340 --> 00:09:15,940
vehicle to get in the wrong lane? Obscuring QR codes,

101
00:09:16,020 --> 00:09:18,980
right? That brings a lot of issues. So, like, if there's a

102
00:09:18,980 --> 00:09:21,380
mud splash on the QR code, you cannot read it. If you're

103
00:09:21,400 --> 00:09:24,500
driving, if there's stickers someone put in graffiti. Graffiti

104
00:09:24,500 --> 00:09:30,040
artists love to draw on signs that are on the side of the road

105
00:09:30,040 --> 00:09:33,180
or overhead. That could be an issue because then it becomes

106
00:09:33,180 --> 00:09:36,300
unreadable. There are lighting issues, as I talked earlier.

107
00:09:37,020 --> 00:09:41,000
Rain or snow can affect the visibility of those signs and

108
00:09:41,000 --> 00:09:43,700
the readability of those signs. And then also, other

109
00:09:43,700 --> 00:09:47,340
environmental factors like sun damage, they can get faded over

110
00:09:47,340 --> 00:09:51,060
time. Those are some of the valid use cases.

111
00:09:51,400 --> 00:09:54,240
And then, obviously, the thieves. Like the guy, this one,

112
00:09:54,300 --> 00:09:57,920
he likes holding these bolts for some obvious reasons.

113
00:09:59,880 --> 00:10:02,080
Uh, yeah. So, as we were looking for an image for the

114
00:10:02,080 --> 00:10:04,540
slide, the first thing that struck me as I found this

115
00:10:04,540 --> 00:10:10,580
image is, oh, man, I don't have one of those signs yet. And

116
00:10:10,580 --> 00:10:12,880
having lived near High Street, you wouldn't believe the number

117
00:10:12,880 --> 00:10:18,440
of times that that sign disappeared. And if that's, if

118
00:10:18,440 --> 00:10:20,540
that sign is removed, this is what you're expecting.

119
00:10:23,420 --> 00:10:25,900
So, the kind of things you typically wouldn't think of as a

120
00:10:25,900 --> 00:10:30,880
human driver, a sign for a boat ramp or a, uh, a sign warning you

121
00:10:30,880 --> 00:10:33,820
to stop, uh, is not necessary for a human driver because you

122
00:10:33,820 --> 00:10:36,940
see that there's a, a boat ramp. Uh, whereas a semi-autonomous

123
00:10:36,940 --> 00:10:39,840
vehicle can proceed going down the road because it's a nice

124
00:10:39,840 --> 00:10:45,420
paved road, nice, uh, gradual decline, and a parking spot at

125
00:10:45,420 --> 00:10:51,380
the very bottom. Malicious links. We talked about the

126
00:10:51,400 --> 00:10:54,460
smart car. We did talk about, like, how a smart car can get

127
00:10:54,460 --> 00:10:57,980
itself, uh, into a situation where a malicious code can be

128
00:10:57,980 --> 00:11:00,760
downloaded on it. It could be a malware or something. So, it

129
00:11:00,760 --> 00:11:05,140
scans a QR code, QR code then directs it to a malware site,

130
00:11:05,380 --> 00:11:09,080
and then, uh, malware gets dumped onto the vehicle. So,

131
00:11:09,120 --> 00:11:13,180
that's, again, a possibility, uh, with the QR codes as an

132
00:11:13,180 --> 00:11:17,580
issue. Exactly. So, as we mentioned earlier, uh, we have

133
00:11:17,580 --> 00:11:21,020
not seen any successful implementation, implementations

134
00:11:21,400 --> 00:11:23,940
of an actual buffer overflow within the QR code. But the

135
00:11:23,940 --> 00:11:27,040
gentleman in the back, uh, left, uh, correctly pointed out, uh, if

136
00:11:27,040 --> 00:11:30,000
you tamper with external things the QR code actually points you

137
00:11:30,000 --> 00:11:33,560
at, whether it's a URL shortener or another resource, you can

138
00:11:33,560 --> 00:11:36,800
actually then push across, uh, malicious code, you know, via

139
00:11:36,800 --> 00:11:48,100
that avenue. And as Vlad mentioned earlier, right? I

140
00:11:48,100 --> 00:11:51,380
mean, these changes are not really noticeable by human

141
00:11:51,400 --> 00:11:55,460
eyes. So, it's, it's a machine readable code only. So, if, if a

142
00:11:55,460 --> 00:11:59,620
stop sign gets, uh, changed by the yield sign, you would not be

143
00:11:59,620 --> 00:12:03,720
able to tell unless, uh, you are Q, you have a QR code reader.

144
00:12:03,860 --> 00:12:07,600
So, that's, that also brings issues with both intentional and

145
00:12:08,260 --> 00:12:11,540
unintentional, uh, attacks. Because someone who's trying to

146
00:12:11,540 --> 00:12:15,360
actually just be on the side of the road, try to service them,

147
00:12:15,420 --> 00:12:18,940
and switch one with the others, that could create a, create a

148
00:12:18,940 --> 00:12:21,380
havoc. So, one of the best things that we've seen, uh, is, uh,

149
00:12:21,400 --> 00:12:24,020
one of the best attack to, uh, one of the best attack factors is

150
00:12:24,020 --> 00:12:26,880
the human. Uh, if you've ever seen the fine paving job the

151
00:12:26,880 --> 00:12:29,440
Department of Public Works sometimes does, and, uh, the way

152
00:12:29,440 --> 00:12:32,540
they put up signs, you know, imagine if they're putting up

153
00:12:32,540 --> 00:12:35,900
Q, uh, QR code signs. Uh, it's very conceivable to actually see

154
00:12:35,900 --> 00:12:38,900
them putting up the wrong sign, because they were pretty sure

155
00:12:38,900 --> 00:12:40,720
they were holding the right sign. They'll put it up on the

156
00:12:40,720 --> 00:12:43,700
side of the road and move, uh, move down to the next mile

157
00:12:43,700 --> 00:12:44,000
marker.

158
00:12:45,520 --> 00:12:48,840
All right. Next one, I, I know it's your favorite, but I don't

159
00:12:48,840 --> 00:12:49,440
think you want to talk about it.

160
00:12:50,060 --> 00:12:51,320
Uh, one of the funniest things

161
00:12:51,400 --> 00:12:54,100
I found, uh, somebody who was doing a little bit of

162
00:12:54,100 --> 00:12:58,200
experimentation with, uh, uh, camera systems on semi-autonomous

163
00:12:58,200 --> 00:13:01,360
vehicles. So, this is actually not a self-driving car, but this

164
00:13:01,360 --> 00:13:04,040
is a car that has lane assist technology, and it was turned

165
00:13:04,040 --> 00:13:08,220
on. And they had a little bit of fun with, uh, salt. And they

166
00:13:08,220 --> 00:13:10,660
actually made a solid line, a dotted line around the vehicle,

167
00:13:10,800 --> 00:13:14,020
and the vehicle refused to drive out. So, they essentially made a

168
00:13:14,020 --> 00:13:14,480
smart trap.

169
00:13:16,040 --> 00:13:18,440
You've probably seen it previously in the movies, in

170
00:13:18,440 --> 00:13:21,380
the voodoo acts that spray salt on the vehicle.

171
00:13:21,380 --> 00:13:21,460
And, uh, you can just, uh, you can just, uh, you can just, uh,

172
00:13:21,460 --> 00:13:25,180
roll it around and, and things go away. I, I use it for driving

173
00:13:25,180 --> 00:13:28,680
ants and killing them around my house. So, but you can also do

174
00:13:28,680 --> 00:13:29,940
that for smart cars.

175
00:13:30,740 --> 00:13:34,180
So, now, that brings us to kind of, like, uh, towards the end of

176
00:13:34,180 --> 00:13:37,960
it, which is the solutions. There aren't really very many

177
00:13:37,960 --> 00:13:40,820
solutions, because first of all, the technology and its

178
00:13:40,820 --> 00:13:46,280
implementation in the automotive space is very new. And, uh, you

179
00:13:46,280 --> 00:13:50,440
could, one could do, like, a unique signs, uh, signing of, uh,

180
00:13:50,460 --> 00:13:51,260
the QR codes.

181
00:13:51,380 --> 00:13:56,500
To say, hey, only autonomous car or self, uh, self-driving cars can

182
00:13:56,500 --> 00:14:00,060
actually read it for its, uh, authenticity. The other things

183
00:14:00,060 --> 00:14:02,260
that you could also do is, like, cryptographic validation.

184
00:14:04,000 --> 00:14:06,860
Uh, so essentially, for example, uh, California Department of

185
00:14:06,860 --> 00:14:10,160
Transportation, uh, can create a signing key and sign their

186
00:14:10,160 --> 00:14:13,640
signs. And then somebody would have to either produce an

187
00:14:13,640 --> 00:14:16,520
identical sign, uh, which would kill off one of the attack

188
00:14:16,520 --> 00:14:20,760
vectors. Uh, I think the most interesting one is actually GPS

189
00:14:21,380 --> 00:14:24,040
location. And that's encoding the correct GPS location of that

190
00:14:24,040 --> 00:14:27,920
sign within the QR code. So then your smart car would actually, uh,

191
00:14:28,000 --> 00:14:31,580
compare its current GPS location, uh, have, uh, a bit of wiggle

192
00:14:31,580 --> 00:14:36,360
room, uh, uh, and interpret the sign as valid or invalid. But then,

193
00:14:36,380 --> 00:14:38,600
of course, you would have to depend on the trust within the

194
00:14:38,600 --> 00:14:41,680
GPS system and the fact that there's no GPS spoofing, uh,

195
00:14:41,760 --> 00:14:44,740
happening around you. Uh, or the fact that GPS is actually

196
00:14:44,740 --> 00:14:48,900
reliable in your area. Uh, and, of course, attackers could also

197
00:14:48,900 --> 00:14:51,360
manufacture their own signs. Once, uh, once you have, uh, an

198
00:14:51,380 --> 00:14:53,100
information, once a standard informant is known, it's only a

199
00:14:53,100 --> 00:14:55,780
matter of time until, uh, the attackers advance as well.

200
00:14:56,120 --> 00:15:02,960
Alright. So does anyone know what is a SR code? Alright.

201
00:15:03,820 --> 00:15:11,920
What's the full form of QR code? Quick response. SR code is a slow

202
00:15:11,920 --> 00:15:15,760
response code. So when you add cryptographic, uh, overheads to

203
00:15:15,760 --> 00:15:19,560
it, it can make a QR code into an SR code and it will look like

204
00:15:19,560 --> 00:15:19,860
this.

205
00:15:21,380 --> 00:15:25,020
Alright. So, uh, onto, again trivia questions.

206
00:15:28,620 --> 00:15:35,640
Who can name a few ways that QR codes can be manipulated? Yes?

207
00:15:40,780 --> 00:15:50,460
Right. Who remembers the first wide-scale, uh, marketing

208
00:15:50,460 --> 00:16:04,040
deployment of QR codes. Yes. Actually it was a federal agency. Here's a hint. They were

209
00:16:04,040 --> 00:16:17,240
putting up pictures of zombies asking are you prepared. So a certain agency that's

210
00:16:17,240 --> 00:16:21,920
interested in people making sure that they actually have preparedness kits at home and

211
00:16:21,920 --> 00:16:29,220
that they know how to deal with a pandemic outbreak was putting up posters and QR codes on

212
00:16:29,220 --> 00:16:33,640
New York City bus stops. And then some enterprising individuals started putting up QR

213
00:16:33,640 --> 00:16:42,320
codes, perfectly covering up the QR code that was put up. And we actually did, yes, a question

214
00:16:42,320 --> 00:16:42,600
in the back.

215
00:16:48,540 --> 00:16:54,300
Yeah, an essentially negative space attack. Yes. That would absolutely work. But these

216
00:16:54,300 --> 00:16:59,020
individuals were actually putting up links to a malicious website and to spam websites. And

217
00:16:59,020 --> 00:17:01,840
it was really boring. People were sitting there at the bus stop would take pictures of it and

218
00:17:01,840 --> 00:17:13,860
follow those links. Can you answer any questions? Yes. So what kind of concept do you have

219
00:17:13,860 --> 00:17:17,220
to prove that manipulating your QR codes actually is a good idea?

220
00:17:19,340 --> 00:17:24,820
So we've been playing with a few HUD units. We've been able to observe crashes with malicious

221
00:17:24,820 --> 00:17:28,920
codes we've been able to craft up. We have not been able to get code execution. I don't

222
00:17:28,920 --> 00:17:32,700
think anybody else has been. But the fact that we can get a system to lock up and reboot

223
00:17:33,320 --> 00:17:36,560
is an indicator that there's definitely avenues to be explored there.

224
00:17:37,120 --> 00:17:41,780
Do you know, like, an autonomous vehicle, an NFT one, reading QR codes right now?

225
00:17:44,140 --> 00:17:47,220
That's why the talk is kind of like futuristic looking, because it's kind of like a

226
00:17:47,240 --> 00:17:53,400
smart car, right? Because we have seen the smart cars trying to use it. There was actually a news

227
00:17:53,400 --> 00:17:59,020
article on it which was the reason why we did this talk. This was almost like a month or two months

228
00:17:59,020 --> 00:18:02,820
ago. That's alright. So what happened is the California Department of Transportation said

229
00:18:02,820 --> 00:18:06,960
they're going to roll out the system. So any autonomous vehicles that have cameras on board,

230
00:18:07,080 --> 00:18:10,440
it's just a matter of firmware update. No manufacturers are doing it because signs haven't

231
00:18:10,440 --> 00:18:14,980
shown up yet. But as they start churning it up next few months, next few years, you're going to

232
00:18:14,980 --> 00:18:17,220
see firmware updates coming out specifically for the new vehicles. So the California Department of

233
00:18:17,240 --> 00:18:21,840
Transportation is going to be able to read them. We do have an advanced head unit that can read them right now.

234
00:18:22,240 --> 00:18:29,040
But I do want to say that I don't believe that it's going to only depend on just the QR code scanning.

235
00:18:29,300 --> 00:18:32,380
They probably would be smarter than that, not to rely on that.

236
00:18:32,420 --> 00:18:33,040
We really hope.

237
00:18:33,720 --> 00:18:39,120
So not specific to automators, but when Google had this huge drive of putting up QR codes,

238
00:18:39,380 --> 00:18:45,420
there were a lot of cases regarding people's moved QR codes to redirect people to malware.

239
00:18:45,720 --> 00:18:46,280
That is correct.

240
00:18:47,840 --> 00:18:49,460
You work for me, so you don't get it.

241
00:18:52,620 --> 00:19:02,500
I have a question. Do you have people who question this, the problems with it, because people can be

242
00:19:02,500 --> 00:19:08,600
altering signs, causing humans to make mistakes, like they could cover up a stop sign.

243
00:19:08,820 --> 00:19:14,700
They could be doing some of these same sort of similar attacks, but fooling humans instead of AI.

244
00:19:15,400 --> 00:19:16,480
So we do see that.

245
00:19:16,600 --> 00:19:17,220
Especially in the United States.

246
00:19:17,240 --> 00:19:18,660
Especially in inner cities. It's very popular.

247
00:19:18,980 --> 00:19:19,260
Thank you.

248
00:19:20,460 --> 00:19:24,460
In inner cities, where people may not necessarily be friendly to police officers,

249
00:19:24,740 --> 00:19:29,520
it's very common to take a street sign and turn it at 90 degrees, so that somebody trying to orient themselves

250
00:19:29,520 --> 00:19:32,520
or somebody trying to respond would get the street cross-section wrong.

251
00:19:32,740 --> 00:19:36,700
Or they're going down one street, and the street they're going down changes.

252
00:19:38,440 --> 00:19:42,800
So now imagine being able to use two autonomous vehicles that are supposedly immune to this.

253
00:19:44,660 --> 00:19:47,220
But if you're going down the road, and you see this.

254
00:19:47,220 --> 00:19:51,320
You see that somebody was really bored and shot at a stop sign, and it has some buckshot holes.

255
00:19:51,500 --> 00:19:52,860
You still know it's a stop sign.

256
00:19:53,120 --> 00:19:58,780
But if you're missing an eighth of a QR code, the error correction will not make up for it.

257
00:19:59,220 --> 00:20:02,260
You simply have a sign that's unreadable to you.

258
00:20:02,500 --> 00:20:05,580
And it could be a construction zone ahead sign.

259
00:20:05,760 --> 00:20:07,060
It could be a 70 mile an hour sign.

260
00:20:07,300 --> 00:20:08,180
Or it could be a stop sign.

261
00:20:10,240 --> 00:20:12,680
That leads me to another, sorry, just a follow-up question.

262
00:20:12,700 --> 00:20:13,060
Not at all.

263
00:20:13,120 --> 00:20:13,280
Please.

264
00:20:14,540 --> 00:20:15,620
There's a lot of complexity.

265
00:20:16,680 --> 00:20:17,200
Most of the time.

266
00:20:17,220 --> 00:20:18,280
There are a lot of QR codes that you see.

267
00:20:18,480 --> 00:20:23,300
But it seems like for simple messages like stop, if that's all it's trying to convey,

268
00:20:23,660 --> 00:20:31,640
why not have something more resilient to those kinds of either intentional or unintentional?

269
00:20:32,500 --> 00:20:35,320
And that's why I commented earlier, right?

270
00:20:36,300 --> 00:20:40,260
When the autonomous vehicles become a reality, which is very close,

271
00:20:40,460 --> 00:20:44,540
I don't think they will rely solely on the QR code.

272
00:20:44,620 --> 00:20:45,760
And that's my hope.

273
00:20:45,760 --> 00:20:51,920
Because again, I mean, we just shared several examples and use cases where it could fail.

274
00:20:52,020 --> 00:20:54,300
If it just relies on a QR code scan.

275
00:20:55,940 --> 00:20:56,340
Exactly.

276
00:20:56,480 --> 00:20:59,920
So what happened is once we saw the California Department of Transportation announcement,

277
00:21:00,460 --> 00:21:01,900
we were able to grab the specs.

278
00:21:02,060 --> 00:21:03,580
We were able to grab some of the sample signs.

279
00:21:04,360 --> 00:21:08,620
I had used with some of the first firmware that is supposed to be able to read it.

280
00:21:08,760 --> 00:21:11,860
And that's all we had to go on because that's available right now.

281
00:21:12,020 --> 00:21:13,220
It's in the proposal phase.

282
00:21:13,500 --> 00:21:15,740
And hopefully it's going to go through a few revisions.

283
00:21:15,740 --> 00:21:18,440
Before it actually becomes mainstream.

284
00:21:20,560 --> 00:21:22,860
This is a curiosity question.

285
00:21:22,980 --> 00:21:23,860
It's not a trivia question.

286
00:21:24,160 --> 00:21:31,280
Has anyone been able to or doing any research in doing a man-in-the-middle attack with QR codes?

287
00:21:32,080 --> 00:21:34,460
Doing a remote attack with a man-in-the-middle?

288
00:21:36,180 --> 00:21:36,920
In the room?

289
00:21:39,060 --> 00:21:43,360
Do you mean like man-in-the-middle like you put a TV screen in front of a QR code or something like that?

290
00:21:44,280 --> 00:21:45,520
Something where you are...

291
00:21:45,740 --> 00:21:52,700
You can sort of be able to intercept the image before it gets read by the device.

292
00:22:00,800 --> 00:22:01,460
Yeah.

293
00:22:02,580 --> 00:22:15,160
So that's another one thing that they could do to at least minimize the human, what you call the physical tampering.

294
00:22:15,740 --> 00:22:16,000
Yeah.

295
00:22:16,120 --> 00:22:18,740
So digital QR coding will prevent one problem.

296
00:22:18,960 --> 00:22:19,820
But then it opens up...

297
00:22:19,820 --> 00:22:19,880
Yeah.

298
00:22:20,020 --> 00:22:28,920
It opens up other issues because, again, with the digital image projections, then there's lighting issues.

299
00:22:29,160 --> 00:22:32,120
There's like depth issues of the colors and other things.

300
00:22:32,220 --> 00:22:35,720
So there's other factors that needs to be taken into consideration.

301
00:22:36,120 --> 00:22:44,460
So the funniest thing that I've been able to play with is those of you that remember those little badges that you had as little kids with googly eyes where depending which hand you look at, it's a different image.

302
00:22:44,460 --> 00:22:46,820
It's actually possible to print out QR codes.

303
00:22:47,000 --> 00:22:50,160
So if you're in the left lane or the right lane, you're seeing a different QR code.

304
00:22:55,140 --> 00:22:57,460
And they actually appear to be read really, really well.

305
00:22:57,580 --> 00:23:04,820
The fact that you have a prism facing out actually means that you're getting less interference from the rain and snow and less grime on it.

306
00:23:04,920 --> 00:23:08,060
So they actually become less readable than real flat QR codes.

307
00:23:14,720 --> 00:23:15,840
Any other questions?

308
00:23:17,460 --> 00:23:17,960
Thank you.

309
00:23:22,940 --> 00:23:23,560
All right.

310
00:23:23,580 --> 00:23:24,960
So last housekeeping slide.

311
00:23:25,060 --> 00:23:37,940
If you guys have any other questions that you haven't asked yet or you are a little bit shy and want to have a private conversation, you can reach out to Vlad and I at spiron.com or Vlad at spironfederal.com.

312
00:23:37,940 --> 00:23:38,040
Thank you.

313
00:23:38,060 --> 00:23:40,480
And then you can reach out to also Security Labs.

314
00:23:40,680 --> 00:23:42,820
We will be in Car Hacking Village booth.

315
00:23:42,920 --> 00:23:48,380
So if you have any other questions that you want to get answered today, do reach out at Car Hacking Village.

316
00:23:48,580 --> 00:23:49,620
And thank you for attending.

317
00:23:50,000 --> 00:23:57,720
And please, whoever hasn't collected their T-shirt, those two guys in the back in the pink, they should be able to get you your T-shirts.

318
00:23:58,040 --> 00:23:58,640
Thanks, everyone.