Welcome to the Car Hacking Village Turbo Talks with Sameer and Vlad, abusing smart cars
with QR codes. Welcome everyone, my name is Sameer, I'm the Senior Director, Security
Consulting for Spartan Security Labs and along with me I have Vlad. Hello, my name is Vlad
Gusimelski, Senior Security Consultant at Spartan Federal. Sameer and I work on doing
security assessments on various devices, smart vehicles, scale systems, wide scale distributed
networks, satellite systems, that sort of thing. Applications, mobile and anything in
between. So let's get started, we have for today's agenda we are talking about abusing
smart cars with QR codes and for you we'll talk about history of QR codes. QR codes have
been around for over two decades. How did they come about? How did they come about?
How QR code got ventured into the automotive space? What are they being currently used
for in automotive industry? Especially with smart cars, what are some of the security
challenges around it? And some of the trivia questions that we are going to have, so please
listen in carefully. You are going to win a t-shirt that I'm wearing, Do Good, Know
Evil. We are not going to give it in the talk, so whoever wins, please collect it with
Tej. He's sitting there.
He's sitting right in the end. You can see his hand right there. So let's get started.
So history of QR codes. As I said, right, I mean, it's been there for over two decades.
It was born in Japan with a two-people team, Mashiro Hirohara and one more team member.
Denso Corporation was sort of the owner for that. It gained its popularity in 2002 when
it started getting used for general purposes for ticketing systems.
For advertising, for various other things. Steven, I'll end.
So previously when the QR codes were used, people were using dedicated readers for them, just
like the kind that you see in the store for scanning prices on various products. As smartphones
became more popular, it was not possible to capture with your phone's camera and decode it. So
it really opened up the market for us. Then there was the technology, the technology that we are
for everyone. Home users were now able to open up hyperlinks that are instructions with
their smart phone. They're able to follow directions, check in at various locations, do
their own inventory control. Alright, that brings us to our first trivia question. Which
automaker first started using QR codes and when? Alright, when? Alright, you get half
of a t-shirt. Anyone else wants to take a stab at it? Ninety-nine? Ninety-four? Alright,
you get the other half of the t-shirt. Yes, so you're right. Toyota started using them in
1994 for actually tracking the parts and the cars that they were making. So please make sure
that you get your half and half t-shirt from Tej. Current use of QR codes and QR codes
in the transportation industry is sort of like now widespread, right? They are using for,
just as I said, right, tracking cars and its parts, for inventory control, for fleet tracking.
Also, Michigan Department of Transportation has recently started using them for signal
repairs. So the image that you see is actual image where instead of having a big log that
they used to store in the signal repair box itself, now instead of that they take their
smart devices, scan the QR code, and then through that they are able to gain all the
information that they need to have for repairing the system. It's being also used widely in
automotive sales. It's sort of like replicating the good salespeople because you can actually
scan a QR code and get a consistent message about what this vehicle is, what are its
capabilities, engine, et cetera, et cetera. And marketing and promotions have
been around for ages, bloody or not. So, next question. So, can anybody tell me if a QR code
can be hacked? Yes. Do you want to elaborate a little bit on it?
So that's not hacking. That's like fabricating.
. So you get a negative t-shirt, so you put it together?
. Yes, gentleman in the back.
. If QR codes are linked to a URL trooper, which most of them are,
you can tamper with the URL trooper, read right? .
Absolutely. You do get a shirt.
. So the URL answer is no. I mean, you do have to physically tamper the black
and white, to kind of make it . So...
. Please get it.
you get a full t-shirt. So now that it cannot be hacked, what is the real problem? I think
the next few images will tell you what the real problem is. When we start really using
them for telling directions to smart cars and autonomous vehicles. And this is happening
in California. California Department of Transportation is the first one to actually start rolling
out QR codes on the side of the roads. That's because it's the number one location in the
United States right now where autonomous and semi-autonomous vehicles are on the roads. Right
now they're using them to signal construction zones ahead. They're starting to roll out speed
limit signs in the form of QR codes. So anyone want to take like a guess on what are other
problems that can happen in a smart car?
Are there more t-shirts to give away? All right I'll make it easy for you. So the first thing is right. I mean you could have a QR code that maliciously directs you to a link that gets you, that gets a malware onto your moving vehicle or for a particular component. Then there are issues with physical manipulations. If in the night someone
switches the QR code from stop sign to speed at 50 miles an
hour, that could be an issue. So you could cause a lot of
havoc. And then some intentional and unintentional removal of the
code. If the next generation cars are going to rely on QR
codes for V2X communication, then you have an issue. Because
if there are lighting issues, if it's unable to read the sign, if
there's too much bright light, if there's raining or other
environmental factors, that could be an issue unless it's
been coupled with other technologies like GPS and
others. That's right. So for example, when you do V2V, V2X
communication, you're using a radio signal. The signal could be
monitored. There are actually ground listening stations that
would observe that communication and notice if
something is happening that possibly shouldn't.
As a police officer drives down the road, they can physically look
at the signs and they will know if something is missing. But if
it's a QR code sign, since it's not human readable, a human can't
actually immediately recognize if the sign has changed or has
been tampered with. Even if somebody walks up with a sharpie
marker and draws on it, it'll A, modify the sign or B, make it
unreadable. And somebody driving by at 70 miles an hour will not
be able to tell the difference.
Now, this is one of my favorites. So I did mention speed
limit signs. If somebody were to swap out speed limit signs for
25 miles an hour school zone and 75 miles an hour on the highway,
they're both valid signs. But by transposing them in different
locations, you're impacting the school zone as well as the
highway for the smart vehicles that would actually be designed.
And of course, you would look like an idiot to the normal
vehicles going down the highway because your autonomous vehicle
will all of a sudden slow down or is barreling through the
school zone. Other fun signs to move around are the one-way
signs, traffic keep left, keep right, or if you're trying to
merge into the 287 north or south, and the human readable
sign is very clear. Where's the QR code that's telling your smart
vehicle to get in the wrong lane? Obscuring QR codes,
right? That brings a lot of issues. So, like, if there's a
mud splash on the QR code, you cannot read it. If you're
driving, if there's stickers someone put in graffiti. Graffiti
artists love to draw on signs that are on the side of the road
or overhead. That could be an issue because then it becomes
unreadable. There are lighting issues, as I talked earlier.
Rain or snow can affect the visibility of those signs and
the readability of those signs. And then also, other
environmental factors like sun damage, they can get faded over
time. Those are some of the valid use cases.
And then, obviously, the thieves. Like the guy, this one,
he likes holding these bolts for some obvious reasons.
Uh, yeah. So, as we were looking for an image for the
slide, the first thing that struck me as I found this
image is, oh, man, I don't have one of those signs yet. And
having lived near High Street, you wouldn't believe the number
of times that that sign disappeared. And if that's, if
that sign is removed, this is what you're expecting.
So, the kind of things you typically wouldn't think of as a
human driver, a sign for a boat ramp or a, uh, a sign warning you
to stop, uh, is not necessary for a human driver because you
see that there's a, a boat ramp. Uh, whereas a semi-autonomous
vehicle can proceed going down the road because it's a nice
paved road, nice, uh, gradual decline, and a parking spot at
the very bottom. Malicious links. We talked about the
smart car. We did talk about, like, how a smart car can get
itself, uh, into a situation where a malicious code can be
downloaded on it. It could be a malware or something. So, it
scans a QR code, QR code then directs it to a malware site,
and then, uh, malware gets dumped onto the vehicle. So,
that's, again, a possibility, uh, with the QR codes as an
issue. Exactly. So, as we mentioned earlier, uh, we have
not seen any successful implementation, implementations
of an actual buffer overflow within the QR code. But the
gentleman in the back, uh, left, uh, correctly pointed out, uh, if
you tamper with external things the QR code actually points you
at, whether it's a URL shortener or another resource, you can
actually then push across, uh, malicious code, you know, via
that avenue. And as Vlad mentioned earlier, right? I
mean, these changes are not really noticeable by human
eyes. So, it's, it's a machine readable code only. So, if, if a
stop sign gets, uh, changed by the yield sign, you would not be
able to tell unless, uh, you are Q, you have a QR code reader.
So, that's, that also brings issues with both intentional and
unintentional, uh, attacks. Because someone who's trying to
actually just be on the side of the road, try to service them,
and switch one with the others, that could create a, create a
havoc. So, one of the best things that we've seen, uh, is, uh,
one of the best attack to, uh, one of the best attack factors is
the human. Uh, if you've ever seen the fine paving job the
Department of Public Works sometimes does, and, uh, the way
they put up signs, you know, imagine if they're putting up
Q, uh, QR code signs. Uh, it's very conceivable to actually see
them putting up the wrong sign, because they were pretty sure
they were holding the right sign. They'll put it up on the
side of the road and move, uh, move down to the next mile
marker.
All right. Next one, I, I know it's your favorite, but I don't
think you want to talk about it.
Uh, one of the funniest things
I found, uh, somebody who was doing a little bit of
experimentation with, uh, uh, camera systems on semi-autonomous
vehicles. So, this is actually not a self-driving car, but this
is a car that has lane assist technology, and it was turned
on. And they had a little bit of fun with, uh, salt. And they
actually made a solid line, a dotted line around the vehicle,
and the vehicle refused to drive out. So, they essentially made a
smart trap.
You've probably seen it previously in the movies, in
the voodoo acts that spray salt on the vehicle.
And, uh, you can just, uh, you can just, uh, you can just, uh,
roll it around and, and things go away. I, I use it for driving
ants and killing them around my house. So, but you can also do
that for smart cars.
So, now, that brings us to kind of, like, uh, towards the end of
it, which is the solutions. There aren't really very many
solutions, because first of all, the technology and its
implementation in the automotive space is very new. And, uh, you
could, one could do, like, a unique signs, uh, signing of, uh,
the QR codes.
To say, hey, only autonomous car or self, uh, self-driving cars can
actually read it for its, uh, authenticity. The other things
that you could also do is, like, cryptographic validation.
Uh, so essentially, for example, uh, California Department of
Transportation, uh, can create a signing key and sign their
signs. And then somebody would have to either produce an
identical sign, uh, which would kill off one of the attack
vectors. Uh, I think the most interesting one is actually GPS
location. And that's encoding the correct GPS location of that
sign within the QR code. So then your smart car would actually, uh,
compare its current GPS location, uh, have, uh, a bit of wiggle
room, uh, uh, and interpret the sign as valid or invalid. But then,
of course, you would have to depend on the trust within the
GPS system and the fact that there's no GPS spoofing, uh,
happening around you. Uh, or the fact that GPS is actually
reliable in your area. Uh, and, of course, attackers could also
manufacture their own signs. Once, uh, once you have, uh, an
information, once a standard informant is known, it's only a
matter of time until, uh, the attackers advance as well.
Alright. So does anyone know what is a SR code? Alright.
What's the full form of QR code? Quick response. SR code is a slow
response code. So when you add cryptographic, uh, overheads to
it, it can make a QR code into an SR code and it will look like
this.
Alright. So, uh, onto, again trivia questions.
Who can name a few ways that QR codes can be manipulated? Yes?
Right. Who remembers the first wide-scale, uh, marketing
deployment of QR codes. Yes. Actually it was a federal agency. Here's a hint. They were
putting up pictures of zombies asking are you prepared. So a certain agency that's
interested in people making sure that they actually have preparedness kits at home and
that they know how to deal with a pandemic outbreak was putting up posters and QR codes on
New York City bus stops. And then some enterprising individuals started putting up QR
codes, perfectly covering up the QR code that was put up. And we actually did, yes, a question
in the back.
Yeah, an essentially negative space attack. Yes. That would absolutely work. But these
individuals were actually putting up links to a malicious website and to spam websites. And
it was really boring. People were sitting there at the bus stop would take pictures of it and
follow those links. Can you answer any questions? Yes. So what kind of concept do you have
to prove that manipulating your QR codes actually is a good idea?
So we've been playing with a few HUD units. We've been able to observe crashes with malicious
codes we've been able to craft up. We have not been able to get code execution. I don't
think anybody else has been. But the fact that we can get a system to lock up and reboot
is an indicator that there's definitely avenues to be explored there.
Do you know, like, an autonomous vehicle, an NFT one, reading QR codes right now?
That's why the talk is kind of like futuristic looking, because it's kind of like a
smart car, right? Because we have seen the smart cars trying to use it. There was actually a news
article on it which was the reason why we did this talk. This was almost like a month or two months
ago. That's alright. So what happened is the California Department of Transportation said
they're going to roll out the system. So any autonomous vehicles that have cameras on board,
it's just a matter of firmware update. No manufacturers are doing it because signs haven't
shown up yet. But as they start churning it up next few months, next few years, you're going to
see firmware updates coming out specifically for the new vehicles. So the California Department of
Transportation is going to be able to read them. We do have an advanced head unit that can read them right now.
But I do want to say that I don't believe that it's going to only depend on just the QR code scanning.
They probably would be smarter than that, not to rely on that.
We really hope.
So not specific to automators, but when Google had this huge drive of putting up QR codes,
there were a lot of cases regarding people's moved QR codes to redirect people to malware.
That is correct.
You work for me, so you don't get it.
I have a question. Do you have people who question this, the problems with it, because people can be
altering signs, causing humans to make mistakes, like they could cover up a stop sign.
They could be doing some of these same sort of similar attacks, but fooling humans instead of AI.
So we do see that.
Especially in the United States.
Especially in inner cities. It's very popular.
Thank you.
In inner cities, where people may not necessarily be friendly to police officers,
it's very common to take a street sign and turn it at 90 degrees, so that somebody trying to orient themselves
or somebody trying to respond would get the street cross-section wrong.
Or they're going down one street, and the street they're going down changes.
So now imagine being able to use two autonomous vehicles that are supposedly immune to this.
But if you're going down the road, and you see this.
You see that somebody was really bored and shot at a stop sign, and it has some buckshot holes.
You still know it's a stop sign.
But if you're missing an eighth of a QR code, the error correction will not make up for it.
You simply have a sign that's unreadable to you.
And it could be a construction zone ahead sign.
It could be a 70 mile an hour sign.
Or it could be a stop sign.
That leads me to another, sorry, just a follow-up question.
Not at all.
Please.
There's a lot of complexity.
Most of the time.
There are a lot of QR codes that you see.
But it seems like for simple messages like stop, if that's all it's trying to convey,
why not have something more resilient to those kinds of either intentional or unintentional?
And that's why I commented earlier, right?
When the autonomous vehicles become a reality, which is very close,
I don't think they will rely solely on the QR code.
And that's my hope.
Because again, I mean, we just shared several examples and use cases where it could fail.
If it just relies on a QR code scan.
Exactly.
So what happened is once we saw the California Department of Transportation announcement,
we were able to grab the specs.
We were able to grab some of the sample signs.
I had used with some of the first firmware that is supposed to be able to read it.
And that's all we had to go on because that's available right now.
It's in the proposal phase.
And hopefully it's going to go through a few revisions.
Before it actually becomes mainstream.
This is a curiosity question.
It's not a trivia question.
Has anyone been able to or doing any research in doing a man-in-the-middle attack with QR codes?
Doing a remote attack with a man-in-the-middle?
In the room?
Do you mean like man-in-the-middle like you put a TV screen in front of a QR code or something like that?
Something where you are...
You can sort of be able to intercept the image before it gets read by the device.
Yeah.
So that's another one thing that they could do to at least minimize the human, what you call the physical tampering.
Yeah.
So digital QR coding will prevent one problem.
But then it opens up...
Yeah.
It opens up other issues because, again, with the digital image projections, then there's lighting issues.
There's like depth issues of the colors and other things.
So there's other factors that needs to be taken into consideration.
So the funniest thing that I've been able to play with is those of you that remember those little badges that you had as little kids with googly eyes where depending which hand you look at, it's a different image.
It's actually possible to print out QR codes.
So if you're in the left lane or the right lane, you're seeing a different QR code.
And they actually appear to be read really, really well.
The fact that you have a prism facing out actually means that you're getting less interference from the rain and snow and less grime on it.
So they actually become less readable than real flat QR codes.
Any other questions?
Thank you.
All right.
So last housekeeping slide.
If you guys have any other questions that you haven't asked yet or you are a little bit shy and want to have a private conversation, you can reach out to Vlad and I at spiron.com or Vlad at spironfederal.com.
Thank you.
And then you can reach out to also Security Labs.
We will be in Car Hacking Village booth.
So if you have any other questions that you want to get answered today, do reach out at Car Hacking Village.
And thank you for attending.
And please, whoever hasn't collected their T-shirt, those two guys in the back in the pink, they should be able to get you your T-shirts.
Thanks, everyone.