1 00:00:00,700 --> 00:00:11,660 Hello everyone. There's a lot of people from Latin America. We're speaking in Spanish. 2 00:00:12,060 --> 00:00:19,400 Yeah, yeah. Don't worry, don't worry. It's okay, it's okay. Well, my name is Claudio 3 00:00:19,400 --> 00:00:25,520 Caraciolo. I am from Argentina. With me is Sheila Berta. She's from Argentina, too. Both 4 00:00:25,520 --> 00:00:29,980 working in Telefónica in a unit called Telefónica. And we're going to talk a little bit about 5 00:00:30,000 --> 00:00:36,820 the 11 Paths. It's a unit from Telefónica. This is our first talk in English, so be patient 6 00:00:36,820 --> 00:00:46,420 with us. Or drink something. I don't know. It's the same for me. Yeah? This talk is about 7 00:00:46,420 --> 00:00:58,360 Devicho. Devicho is a hardware backdoor. And we also construct and software to do this 8 00:00:58,360 --> 00:00:59,580 backdoor functionality. 9 00:01:02,600 --> 00:01:12,480 So to start talking about this, we have to talk about why we are working about a backdoor in a 10 00:01:12,480 --> 00:01:24,780 canvas. Yes? And the real question is why not? Why we can do, why we can backdoor our computer, 11 00:01:24,980 --> 00:01:29,980 we can modify our computer, our server, our phones. But if we don't have the software, we can't 12 00:01:30,000 --> 00:01:36,960 modify our computer, and why not we can do the same with our car? Yes? And just, we are 13 00:01:36,960 --> 00:01:45,460 curiously people like you, like all of you. So the real reason is because we can. This is the 14 00:01:45,460 --> 00:01:54,220 project. So the first thing that we need to talk with you is about safety. Because car hacking is 15 00:01:54,220 --> 00:01:59,980 not the same like computer hacking because it's dangerous. You can modify a car and you can modify a car. 16 00:02:00,000 --> 00:02:09,060 find something in the GAN message that can activate the break or the gas pedal or just some 17 00:02:09,060 --> 00:02:19,740 function in the shine and you can break something or you can cause injury in someone. So you 18 00:02:19,740 --> 00:02:29,980 have to be careful. Thank you. Thank you very much. Thank you very much. Thank you very 19 00:02:30,000 --> 00:02:45,480 much. You have to be careful with this because there is not so important how trained are you 20 00:02:45,480 --> 00:02:58,680 because accidents occur, yeah? So you can see that in this sample, for example. Okay. So 21 00:03:07,420 --> 00:03:24,760 let's see. He is worried about safety. Okay. When we talk about car hacking, most of 22 00:03:24,760 --> 00:03:29,980 you think about the connector cars, the motor cars, yeah? Because the motor cars are 23 00:03:30,660 --> 00:03:42,500 cars that we can find in our country. Okay. It's not working. You have a lot of thing of 24 00:03:42,500 --> 00:03:53,540 connectivity. For example, you have the TPM. That's true. That's true. It's my car. In the 25 00:03:53,540 --> 00:03:59,780 connected car you have GPS, you have Bluetooth, you have Wi-Fi, you have the TPM model for 26 00:04:00,000 --> 00:04:06,560 pressurize, for pressure. You have SIM, SIM cards to control your car. You have a lot of 27 00:04:06,560 --> 00:04:16,900 interface to do something with the car. Even USB or some, some storage, yeah? Like SID. So 28 00:04:16,900 --> 00:04:22,560 you have a lot of thing to do or to play. But what, what happened with the canvas with the 29 00:04:22,560 --> 00:04:29,820 network or the real network of your car? We want to work with this type of network because in 30 00:04:30,000 --> 00:04:38,740 our country is not so common find this type of car. Okay. This type of car, see? Yeah. It's not 31 00:04:38,740 --> 00:04:51,580 so common. So we want to play with this and find, and find, and find one, one way to access 32 00:04:51,580 --> 00:04:59,680 the network of the car and to control it remotely. Yeah? This is the, the process that we work. So 33 00:05:00,000 --> 00:05:11,200 for most of you maybe CAN bus is not so common so we need to do a quick review about how CAN bus 34 00:05:11,200 --> 00:05:20,640 works. This talk is not about CAN bus so it's just a quick review. CAN bus or the Controlled 35 00:05:20,640 --> 00:05:29,980 Area Network is an old standard. Yes, it's an old standard. The CAN bus or the Controlled 36 00:05:30,000 --> 00:05:40,620 Area Network is about 15 years. So in that moment security was an issue. So CAN bus was 37 00:05:40,620 --> 00:05:51,500 designed to work in some environment with a lot of noise, with a lot of, yes, noise is the 38 00:05:51,500 --> 00:05:58,380 correct word because you have an engine. So you have a lot of noise in the interface itself. 39 00:06:00,000 --> 00:06:14,840 So CAN bus was designed to be faster, to be efficiently but not secure. In that moment all 40 00:06:14,840 --> 00:06:24,540 networks with CAN bus was not only for cars. You can find some network with CAN bus or with CAN 41 00:06:24,540 --> 00:06:29,980 protocol in industrial environment. Yeah and like the people before here. And you can find some 42 00:06:32,000 --> 00:06:41,900 But when we talk about Canvas, we have to, for a car, we have to talk about a standard from 43 00:06:41,900 --> 00:06:50,960 1996 that was the introduction of this connector in our cars. Yes, this connector is the 44 00:06:52,380 --> 00:06:59,640 ODB2 ports. It's not very clear, but it's a connector. This connector you can find in your 45 00:06:59,640 --> 00:07:08,160 car, in the cabin of your car. And it's used to diagnostic or for diagnostic purpose. And this 46 00:07:08,160 --> 00:07:20,300 is standard that was included in that date. You have a lot of things that every manufacturer in 47 00:07:20,300 --> 00:07:29,620 your car can decide for what they will be using. There is some specific manufacturer that 48 00:07:29,640 --> 00:07:39,140 will have specific pins like signal rounding or can high and can low. That are standards. But you 49 00:07:39,140 --> 00:07:46,140 have a lot of things, a lot of pins, that you can use or not. It's decided for the manufacturer. 50 00:07:47,160 --> 00:07:57,680 Okay. This is the war part. And it's difficult but it's necessary to understand. I hope super right. 51 00:07:57,680 --> 00:08:00,860 Okay, when we're talking about CAM, 52 00:08:01,020 --> 00:08:02,920 we have to talking about CAM bus. 53 00:08:03,540 --> 00:08:07,140 That's why CAM network is based on a bus to bus ship. 54 00:08:07,820 --> 00:08:11,260 Each node could be a sensor or a vehicle EQ, 55 00:08:11,880 --> 00:08:14,100 and the information transmitted on the bus 56 00:08:14,420 --> 00:08:17,180 can be used by several nodes at the same time. 57 00:08:21,020 --> 00:08:24,740 As CAM was developed for use in automated environment 58 00:08:24,740 --> 00:08:27,200 where there is a lot of noise, 59 00:08:27,420 --> 00:08:30,860 it uses a system known as differential voltage 60 00:08:31,620 --> 00:08:35,580 and that allows it to gain immunity against interference. 61 00:08:36,920 --> 00:08:41,180 In this system, there is a transmitter 62 00:08:41,180 --> 00:08:43,220 that transmits a signal in duplicate, 63 00:08:43,480 --> 00:08:47,100 one with positive value and the other one with negative value. 64 00:08:47,640 --> 00:08:49,820 These are CAM high and CAM low signals. 65 00:08:50,400 --> 00:08:54,280 If the receiver receives two signals that are not equal, 66 00:08:54,280 --> 00:08:57,580 it discards it, assuming that it's noise on the bus. 67 00:08:59,360 --> 00:09:03,820 Moreover, CAM protocol has something known as inverted logic 68 00:09:04,700 --> 00:09:08,640 where we have a dominant state, which is zero, 69 00:09:08,780 --> 00:09:11,800 and a recessive state, which is one. 70 00:09:12,600 --> 00:09:16,300 So, it influences a bit in the frame format. 71 00:09:17,560 --> 00:09:20,200 In that graph, we can see a standard CAM frame. 72 00:09:20,920 --> 00:09:23,040 The green part is the arbitration fields 73 00:09:23,040 --> 00:09:23,920 that contains 74 00:09:23,920 --> 00:09:25,140 the frame's ID. 75 00:09:26,440 --> 00:09:32,380 One important here is that those IDs with mostly zeros 76 00:09:32,650 --> 00:09:34,600 will have higher priority on the bus. 77 00:09:35,170 --> 00:09:39,180 So, that's why CAM frames associated with the engine 78 00:09:39,180 --> 00:09:43,200 has the lowest ID, so the higher priority on the CAM bus. 79 00:09:44,390 --> 00:09:47,740 And after that, we have the data length in yellow 80 00:09:47,740 --> 00:09:50,600 and the data itself in red 81 00:09:50,600 --> 00:09:53,160 that can contain a maximum of eight bytes. 82 00:09:54,320 --> 00:09:59,800 And, as we can observe, there aren't source or destination addresses, 83 00:10:00,240 --> 00:10:02,000 neither source or destination ports, 84 00:10:02,260 --> 00:10:05,440 like protocols we know better, such as TCP, IP. 85 00:10:05,940 --> 00:10:09,600 So, a CAM node has to check the arbitration fields 86 00:10:09,600 --> 00:10:12,580 to know if it should take the frame's data. 87 00:10:13,040 --> 00:10:13,180 Yep. 88 00:10:13,740 --> 00:10:16,420 And I guess my English is not good enough 89 00:10:16,420 --> 00:10:20,660 to explain this clearly, so you can go to Wikipedia as well. 90 00:10:23,960 --> 00:10:27,060 Okay, this is how a CAM frame looks like. 91 00:10:27,980 --> 00:10:32,040 We have to know that a CAM frame does not indicate 92 00:10:32,040 --> 00:10:34,800 anywhere what kind of information is scary. 93 00:10:35,180 --> 00:10:38,940 For example, a CAM frame that is scary information 94 00:10:39,290 --> 00:10:42,640 about RPM, does not indicate anywhere 95 00:10:42,640 --> 00:10:44,800 that it's information is about RPM. 96 00:10:45,340 --> 00:10:49,840 So, that's why to find out what kind of information 97 00:10:49,840 --> 00:10:53,440 each frame is scary, we have to do a reversing process. 98 00:10:53,920 --> 00:10:57,800 Yep, for that, there is a lot of different tools. 99 00:10:59,420 --> 00:11:04,420 This is an oscilloscope, and it's the lowest level tool 100 00:11:04,420 --> 00:11:06,240 we can find to analyze count signals. 101 00:11:06,640 --> 00:11:07,460 Don't use it. 102 00:11:08,340 --> 00:11:09,500 Don't use it, yeah, yeah. 103 00:11:09,580 --> 00:11:13,260 In our case, we have a count model that allows us 104 00:11:13,260 --> 00:11:16,760 to see the hexadecimal representation of such signals. 105 00:11:17,100 --> 00:11:21,380 Yep, but yeah, it's too fast to see, it's impossible. 106 00:11:23,920 --> 00:11:26,780 On the other hand, we have the higher level tools 107 00:11:27,200 --> 00:11:30,560 that allow us to see count frames in a nice way, 108 00:11:30,720 --> 00:11:35,400 and we can analyze them so much easy, in an easy way, yep. 109 00:11:35,720 --> 00:11:39,000 Anyway, it's still too hard, so. 110 00:11:39,620 --> 00:11:41,300 We have an example here. 111 00:11:41,640 --> 00:11:47,220 We are doing in a VW Fox, yeah. 112 00:11:48,400 --> 00:11:52,080 We just start the light, and this is what's occurring 113 00:11:52,080 --> 00:11:53,820 in the sniffing. 114 00:11:53,920 --> 00:11:58,500 Yeah, so if you see this, it is, again, 115 00:12:03,900 --> 00:12:07,360 just, you can see that the only action that I do 116 00:12:07,360 --> 00:12:10,000 is start the light, is put the lighting on, yeah, 117 00:12:10,100 --> 00:12:13,300 but there is a lot of frames of the data 118 00:12:14,740 --> 00:12:16,400 traveling in the canvas. 119 00:12:16,720 --> 00:12:20,900 That is why it's very difficult to do this one, 120 00:12:20,980 --> 00:12:23,900 because in your house, when you're putting on, you know, 121 00:12:23,900 --> 00:12:29,900 the light, yeah, the light, it's just one command. 122 00:12:30,080 --> 00:12:33,520 You put it on, and the light is on, that's all, that's all. 123 00:12:33,900 --> 00:12:36,080 There is no magic, but in the car, 124 00:12:36,220 --> 00:12:39,440 when you activate the light in your car, 125 00:12:40,020 --> 00:12:43,580 the canvas is, the model, I'm sorry, for the light, 126 00:12:43,620 --> 00:12:48,740 is sending every time, every second, a lot of frames, 127 00:12:48,940 --> 00:12:53,740 send with the message, lights on, lights on, lights on, 128 00:12:53,900 --> 00:12:56,580 lights on, yeah, not just once, yeah? 129 00:12:56,880 --> 00:13:01,180 So, when you activate this one, you can see, 130 00:13:01,740 --> 00:13:05,940 for my horrible explanation, that there is a line 131 00:13:05,940 --> 00:13:10,480 with one change every time, but it's not the case, 132 00:13:10,640 --> 00:13:13,200 because when you activate the light in your car, 133 00:13:13,340 --> 00:13:15,560 you have that message constantly, 134 00:13:16,620 --> 00:13:18,460 but you have another message. 135 00:13:18,600 --> 00:13:18,920 Why? 136 00:13:19,120 --> 00:13:21,140 Because when you start the light in your car, 137 00:13:21,820 --> 00:13:23,520 not only the light in the car, 138 00:13:23,520 --> 00:13:27,240 if it's on, because you have the activation 139 00:13:27,240 --> 00:13:28,800 of the panel of the instrument, 140 00:13:29,100 --> 00:13:32,800 where you have the icon of the light, 141 00:13:32,920 --> 00:13:36,400 and you have other lights in your panel that's putting on, 142 00:13:36,560 --> 00:13:40,460 and maybe other function, depending of the car. 143 00:13:40,800 --> 00:13:44,640 So, in this car, that is an old, well, okay, 144 00:13:45,180 --> 00:13:46,360 it's an old car, 145 00:13:49,060 --> 00:13:52,520 and it's a mechanical action, 146 00:13:53,520 --> 00:13:56,220 and you have a, we have a lot of message, 147 00:13:56,320 --> 00:13:59,240 but think about what happened with a new car. 148 00:13:59,400 --> 00:14:03,200 For example, an Honda Civic, and Honda Civic from this year. 149 00:14:03,340 --> 00:14:07,580 We have a video about what happened when you put the key 150 00:14:07,580 --> 00:14:09,680 in the ignition mode. 151 00:14:12,920 --> 00:14:14,100 It's the fucking Matrix. 152 00:14:18,860 --> 00:14:21,040 So, the real question is that. 153 00:14:21,220 --> 00:14:22,060 Is this one. 154 00:14:22,060 --> 00:14:29,820 how we can find the cam frame we want. It's a bit difficult. So nowadays there are several 155 00:14:29,820 --> 00:14:36,500 tools to analyze cam last. Here in the car hacking village or in the vendor's area we can 156 00:14:36,500 --> 00:14:44,800 find some of them. Cam spike, cam loop, cam tag, cam analyzer from microchip or even we can 157 00:14:44,800 --> 00:14:51,840 use socket cam with open hardware tool as well. With the canal tilt for Linux. Yeah. Yeah. 158 00:14:52,540 --> 00:15:00,780 And in our case we began using cam loop and cam analyzer from microchip. Usually these tools 159 00:15:00,780 --> 00:15:08,360 allow us to inject cam frames on the bus as well. But the frequency with which this tool makes 160 00:15:08,360 --> 00:15:14,780 the transmissions may not be fast enough to cam bus. Yeah. So we decided to use this tool to 161 00:15:14,800 --> 00:15:24,540 test the cam frame. That's when that happens. So, yeah. As I can say each node is 162 00:15:24,540 --> 00:15:32,940 concurrently is current state. So constantly it's current state. So in, in this case the light 163 00:15:32,940 --> 00:15:38,900 module is saying that the lights are off. While we are injecting every 100 milliseconds that 164 00:15:38,900 --> 00:15:44,720 the lights are on. So this is what produces the flicker effect. So you can see that we 165 00:15:44,720 --> 00:15:53,120 need more speed to inject that payload. So eh, with software it's not so easy. So we, we 166 00:15:53,120 --> 00:16:04,000 build an, an, our back door to do this eh, with the uh, ODV2 ports. So that is why we start 167 00:16:04,000 --> 00:16:09,900 working in that project. And we present this one in the co-party the last year. And for this 168 00:16:09,900 --> 00:16:14,700 moment. For this project. A lot of people don't understand this. And it's, it's kind of the cold 169 00:16:14,700 --> 00:16:25,080 people ask us about how it is possible to someone put in your car a back door, a hardware 170 00:16:25,080 --> 00:16:34,960 back door, and you don't notice that. The answer is easy because if you, for example, left 171 00:16:34,960 --> 00:16:40,440 your car in a car wash, it's a good opportunity for someone to put something in your ODB2 172 00:16:40,440 --> 00:16:49,440 ports. Or maybe in a valid parking. There are moments when you left your car and someone can do 173 00:16:49,760 --> 00:16:59,300 that. Or maybe if you give a ride some Spive. Maybe. Or maybe if you are married with Shane's 174 00:16:59,300 --> 00:17:05,660 mom. I don't know. There is a possibility that we start working in that project that was the 175 00:17:05,660 --> 00:17:09,640 first one. Yeah. When we began, we started with a simple 176 00:17:09,640 --> 00:17:10,420 injector. Yeah. And then we started with a simple injector. And then we started with a 177 00:17:14,000 --> 00:17:22,140 pick 18F2680. Yeah. With a transceiver to convert high and low signals. And it's kind, the 178 00:17:22,140 --> 00:17:28,160 firmware that we developed in assembly can inject with a great speed on the car frame. So 179 00:17:28,160 --> 00:17:36,460 avoiding that what we saw in the previous video. And after came the malicious ideas. And we 180 00:17:36,460 --> 00:17:40,420 thought how we could control this remotely. So we added a single injector. And then we started to 181 00:17:40,420 --> 00:17:48,000 develop a software. And then we added that we added sim 80, 800L. So so that to control the 182 00:17:48,000 --> 00:17:55,480 hardware back door through SMS commas. Yeah. And that was the result. Our first proof of concept. 183 00:17:55,600 --> 00:18:03,400 And works, works fine. And after that, we thought that would be nice, would be nice to setting up 184 00:18:03,400 --> 00:18:10,400 the cam frames. And the attack commands through a PC software. So avoiding hard coding the 185 00:18:10,400 --> 00:18:12,520 they carve the gun frames and the commands 186 00:18:12,520 --> 00:18:14,340 into the firmware, so yeah. 187 00:18:14,440 --> 00:18:17,000 So we added a USB interface. 188 00:18:18,320 --> 00:18:22,160 We have to develop a new hardware, yeah. 189 00:18:23,000 --> 00:18:28,920 Where there is two modes, hack mode and a programming mode. 190 00:18:29,980 --> 00:18:34,340 We can toggle between two modes via this switch. 191 00:18:34,520 --> 00:18:37,540 Yeah, you have the programming mode and the hack mode, yeah. 192 00:18:37,540 --> 00:18:43,180 And this new hardware has, it looks a bit nice, 193 00:18:43,280 --> 00:18:46,940 just you use SMD components, yeah. 194 00:18:47,860 --> 00:18:48,640 It's this one? 195 00:18:48,760 --> 00:18:50,140 Yeah, it's this one, yeah. 196 00:18:50,400 --> 00:18:53,840 And here we can see, it's the comparison 197 00:18:53,840 --> 00:18:55,020 with a rubber ducky. 198 00:18:55,300 --> 00:18:58,240 As you can see, it's a little, little hardware, yeah. 199 00:19:00,560 --> 00:19:04,720 So we have it at this moment, at this moment. 200 00:19:05,780 --> 00:19:06,580 Let me see. 201 00:19:07,540 --> 00:19:11,720 At this moment, we think about, it was a nice project, 202 00:19:11,840 --> 00:19:13,260 but we need to improve it. 203 00:19:13,560 --> 00:19:14,080 Why? 204 00:19:14,380 --> 00:19:18,900 Because to configure this one, like Shaylee say, 205 00:19:19,120 --> 00:19:21,200 we need to know about assembler, yeah. 206 00:19:21,280 --> 00:19:24,400 You have to put that, put out the microchip, 207 00:19:25,400 --> 00:19:27,320 program it, and put it again. 208 00:19:27,660 --> 00:19:31,480 So we start working in this new interface, 209 00:19:32,500 --> 00:19:35,860 in this new design, and we, 210 00:19:37,380 --> 00:19:43,220 we need, or we want to create another piece of this project 211 00:19:43,220 --> 00:19:44,900 that was software, yeah. 212 00:19:45,000 --> 00:19:49,480 So this is the real thing about the CarBackDoorMaker. 213 00:19:49,740 --> 00:19:52,560 So for us, this is the Vicho, yeah, 214 00:19:52,640 --> 00:19:54,700 and this is the CarBackDoorMaker. 215 00:19:54,900 --> 00:19:55,120 Why? 216 00:19:55,280 --> 00:19:58,080 Because in this program, you don't need to know 217 00:19:58,080 --> 00:20:01,180 anything about assembler, anything about programming, 218 00:20:01,340 --> 00:20:03,720 just you know to need the correct frame 219 00:20:03,720 --> 00:20:05,340 that you want to inject, yeah. 220 00:20:05,860 --> 00:20:08,580 Put it right in the memory, and it's solved. 221 00:20:08,880 --> 00:20:11,560 So this is the other part of this project. 222 00:20:11,880 --> 00:20:14,820 And when we start creating this, 223 00:20:15,320 --> 00:20:19,140 we work in this setup, in this basic setup, 224 00:20:19,420 --> 00:20:23,620 when you can see the ID, the Identificator, 225 00:20:23,840 --> 00:20:27,380 and I think that Shaylee told you, 226 00:20:27,460 --> 00:20:32,340 but when the ID is lower, there is high, 227 00:20:32,460 --> 00:20:34,260 there is higher, thank you. 228 00:20:34,260 --> 00:20:35,260 Higher priority on the investment. 229 00:20:35,260 --> 00:20:37,800 Higher priority on the investment. 230 00:20:37,960 --> 00:20:42,460 So because the lower ID is the engine function, yeah. 231 00:20:44,020 --> 00:20:46,340 This is the length of the frame, 232 00:20:46,480 --> 00:20:51,200 and this are the data in the eight bytes. 233 00:20:52,660 --> 00:20:58,280 This is the first part, and we have the SMS control. 234 00:20:58,640 --> 00:21:03,540 So when we create this one, if you read a message, 235 00:21:03,740 --> 00:21:04,640 a frame message, 236 00:21:05,260 --> 00:21:06,940 and the cam that start the light, 237 00:21:07,100 --> 00:21:10,060 you can put that correct frame here. 238 00:21:10,260 --> 00:21:16,820 You can say, with SMS, you will control it, yeah. 239 00:21:16,940 --> 00:21:19,580 And just press right, and that's all. 240 00:21:20,420 --> 00:21:25,200 But when we construct this, when we will this application, 241 00:21:25,680 --> 00:21:29,200 we start thinking about another function, yeah. 242 00:21:29,680 --> 00:21:33,280 And we start working in the advanced setups. 243 00:21:35,260 --> 00:21:37,980 So, I think the best thing is the possibility 244 00:21:37,980 --> 00:21:40,820 to introduce your phone number. 245 00:21:40,960 --> 00:21:43,960 So, if you put this one in your car, 246 00:21:44,160 --> 00:21:48,900 and you put here your phone number, 247 00:21:49,020 --> 00:21:52,620 so only you can control this feature, yeah? 248 00:21:52,700 --> 00:21:53,960 And anyone can. 249 00:21:54,840 --> 00:22:01,520 And the second thing is to run automatically this payload. 250 00:22:01,760 --> 00:22:02,080 How? 251 00:22:02,300 --> 00:22:05,240 For example, if you, in youremos, this payload, right? 252 00:22:05,240 --> 00:22:16,840 car, you are driving your car and throw for a specific location with a GPS, I can tell to 253 00:22:16,840 --> 00:22:23,560 the program, to the bicho, that start automatically the payload for example for activating 254 00:22:23,560 --> 00:22:32,560 the brakes or for starting the light or for controlling the fuel, everything. The same, we 255 00:22:32,560 --> 00:22:43,160 work the same with the, with a specific frame. So, if you are working, you are driving your 256 00:22:43,160 --> 00:22:50,720 car and you, for example, start the light, I can tell you to the bicho that when you start the 257 00:22:50,720 --> 00:23:02,540 light, the car stops. The machine stops. Or the brakes stop. I don't know. So, I can tell 258 00:23:02,560 --> 00:23:05,000 you, if you want to see this one. 259 00:23:32,680 --> 00:23:41,940 For example, this is the bicho in the programming mode. Yeah? With this deep switch down, it's 260 00:23:41,940 --> 00:23:51,820 in programming mode. You can see that we have a green light. Yeah. But if I start the program, 261 00:23:59,460 --> 00:24:02,540 if I start the program, the bicho will stop. So, I can tell you that the bicho will stop. 262 00:24:02,560 --> 00:24:15,180 And I just put the connect. Yeah. This light is red now. Yeah. So, this is telling me that 263 00:24:15,180 --> 00:24:21,600 there is a communication between the software and the hardware. Yeah. So, if I know the 264 00:24:21,600 --> 00:24:32,540 correct frame, I just put it here. So, I can tell you that the bicho will stop. So, I can tell 265 00:24:38,620 --> 00:24:44,820 you that the bicho will stop. And the correct SMS that I want to use to control this one. Which 266 00:24:45,380 --> 00:24:53,760 four letter can I use? Which I want. So, I can use four letter in that case. That's all. For 267 00:24:53,760 --> 00:25:02,540 example. And it's okay. Yeah. Here, I can tell you that the bicho will stop. So, I can tell you 268 00:25:02,560 --> 00:25:18,340 my phone number. And if I press right, that's all. The model is ready to hack. Yeah? So, I just 269 00:25:18,340 --> 00:25:27,740 disconnect this here. Put this one. Put this in app to hack it more and connect this in the 270 00:25:27,740 --> 00:25:29,780 other region. That's all. Yeah. 271 00:25:35,980 --> 00:25:36,460 Thanks for listening. 272 00:25:36,460 --> 00:25:39,160 They are friends. Thank you. 273 00:25:47,220 --> 00:25:57,400 But at this point, we have another problem. Because to do this one, we need to know the 274 00:25:57,400 --> 00:26:02,300 correct frame. So, we have another problem. Yeah. I have to sniff my car every time. 275 00:26:02,560 --> 00:26:06,960 or but I have another problem that my car for example have a 276 00:26:06,960 --> 00:26:10,700 specific message can I leave to control the light, the brakes, 277 00:26:10,940 --> 00:26:17,420 the speed, everything and your car I'm sure use another CAN 278 00:26:17,420 --> 00:26:20,860 message. Because it's not standard that message. Every 279 00:26:20,860 --> 00:26:27,460 manufacturer has implemented his own CAN message. Even in the 280 00:26:27,460 --> 00:26:35,920 same manufacturer, every model had different CAN frames. So we 281 00:26:35,920 --> 00:26:42,860 start working in another thing that is the open CAN database. 282 00:26:43,220 --> 00:26:48,700 Yeah and open CAN database is a shared database just to share 283 00:26:49,330 --> 00:26:52,780 information about the CAN message. If you read with some 284 00:26:52,780 --> 00:26:57,420 sniffer a CAN message for your car you can come here, put 285 00:26:57,420 --> 00:27:06,780 put outcome frame and that's all. Complete this information. So if you don't find your 286 00:27:06,780 --> 00:27:11,800 card you can add a new card and if you don't have the vector you can add a new vector and 287 00:27:11,800 --> 00:27:21,240 it's totally open and free for you too. So at this moment we have a hardware, we have a 288 00:27:21,240 --> 00:27:29,760 software and an open card database so you have a lot of fun. And everything is free. That's 289 00:27:29,760 --> 00:27:42,360 the beautiful of this one. You can see an example of this one. With this video. We send a 290 00:27:42,360 --> 00:27:51,220 message with light on and now a message with stop the light. And the light is off. So that's 291 00:28:00,360 --> 00:28:16,540 it. If you are thinking that is that's all, the correct answer is yes. It is. For now. For 292 00:28:16,540 --> 00:28:21,220 now. This project is not over. So thank you very much. 293 00:28:21,240 --> 00:28:29,700 And to finish this I want to thank some people that support us for Nicoleno for our English. 294 00:28:29,940 --> 00:28:40,820 Yeah, it's his fault. Eva and Chris for the design of the web page. For the design. And 295 00:28:40,820 --> 00:28:48,000 Mondalan for his support with sharing canvas for the database. Yeah, that's all. So thank you 296 00:28:48,000 --> 00:28:50,540 very much. And if you have questions, we are here. 297 00:28:51,240 --> 00:28:52,480 Thank you very much. 298 00:28:58,000 --> 00:28:58,880 . 299 00:29:03,280 --> 00:29:04,160 . 300 00:29:04,160 --> 00:29:04,360 . 301 00:29:04,360 --> 00:29:05,160 . 302 00:29:05,160 --> 00:29:05,640 . 303 00:29:07,160 --> 00:29:08,040 . 304 00:29:08,040 --> 00:29:08,060 . 305 00:29:08,060 --> 00:29:08,220 . 306 00:29:08,220 --> 00:29:08,240 . 307 00:29:14,500 --> 00:29:15,380 . 308 00:29:15,380 --> 00:29:15,420 . 309 00:29:33,500 --> 00:29:51,220 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 310 00:29:51,220 --> 00:29:52,980 sells key locks. 311 00:29:53,280 --> 00:29:54,000 Oh, yeah. 312 00:29:54,260 --> 00:29:56,840 So if you're concerned about it, 313 00:29:56,900 --> 00:29:58,700 you buy the key lock, you put it on. 314 00:29:59,440 --> 00:29:59,960 Nice. 315 00:30:00,060 --> 00:30:00,800 Thank you very much. 316 00:30:02,140 --> 00:30:03,660 Not that far down, 317 00:30:03,780 --> 00:30:06,060 because by law you have to be able to have 318 00:30:06,060 --> 00:30:08,140 as dry carbon connected in 319 00:30:08,140 --> 00:30:10,880 without putting your head between your knees 320 00:30:10,880 --> 00:30:13,680 and your left foot in the master section. 321 00:30:14,660 --> 00:30:15,440 Thank you. 322 00:30:15,460 --> 00:30:16,080 Thank you. 323 00:30:17,980 --> 00:30:19,220 Any other questions? 324 00:30:21,960 --> 00:30:22,760 The other one. 325 00:30:23,180 --> 00:30:24,600 You're not, you're not, you can't. 326 00:30:25,520 --> 00:30:27,940 How long did it take for you to develop all this? 327 00:30:28,400 --> 00:30:29,280 How long? 328 00:30:29,400 --> 00:30:29,800 How long? 329 00:30:30,000 --> 00:30:30,420 I don't know. 330 00:30:31,800 --> 00:30:32,420 A year? 331 00:30:32,740 --> 00:30:33,660 I don't know. 332 00:30:34,080 --> 00:30:35,700 10 months, I don't know. 333 00:30:35,940 --> 00:30:36,900 Yeah, 10 months. 334 00:30:38,680 --> 00:30:41,140 It's our hobby, so it's not work. 335 00:30:41,920 --> 00:30:42,360 Yeah. 336 00:30:43,920 --> 00:30:47,080 I think all the project was not easy, 337 00:30:47,120 --> 00:30:51,200 but I think that it's difficult 338 00:30:51,220 --> 00:30:53,640 to find the correct frame. 339 00:30:53,780 --> 00:30:57,060 This is a very complicated work. 340 00:30:57,240 --> 00:30:59,560 Yeah, we had a lot of reversing processes 341 00:30:59,560 --> 00:31:01,900 to find the cam frame you want 342 00:31:01,900 --> 00:31:04,400 for the lights, for the engine, or whatever. 343 00:31:04,740 --> 00:31:07,600 So yeah, it takes a lot of time. 344 00:31:07,660 --> 00:31:10,100 That's because we do the open database. 345 00:31:10,440 --> 00:31:10,820 Yeah. 346 00:31:10,920 --> 00:31:13,020 This is to share. 347 00:31:13,420 --> 00:31:13,700 Yeah. 348 00:31:14,180 --> 00:31:14,820 So. 349 00:31:15,300 --> 00:31:15,940 Yes. 350 00:31:16,160 --> 00:31:17,860 With cellular carriers, 351 00:31:18,280 --> 00:31:20,340 is it specific cellular carriers 352 00:31:20,340 --> 00:31:22,340 when you plug in your phone number? 353 00:31:22,880 --> 00:31:23,400 So. 354 00:31:23,580 --> 00:31:23,900 No. 355 00:31:24,080 --> 00:31:24,540 Okay. 356 00:31:24,600 --> 00:31:26,640 You can put anyone. 357 00:31:26,920 --> 00:31:28,500 It's not a, it's not a problem. 358 00:31:29,060 --> 00:31:29,780 What is GSM? 359 00:31:31,100 --> 00:31:31,620 GSM. 360 00:31:31,760 --> 00:31:35,960 The GSM is for locating with the provider, yeah? 361 00:31:36,060 --> 00:31:41,060 But it's not important the sale of the chip, yeah? 362 00:31:41,440 --> 00:31:41,660 Yeah. 363 00:31:42,980 --> 00:31:46,140 I say this because in the States they have GSM 364 00:31:46,140 --> 00:31:47,400 and they have CDMA. 365 00:31:47,700 --> 00:31:48,220 Okay. 366 00:31:48,220 --> 00:31:48,480 No. 367 00:31:48,580 --> 00:31:49,200 It's GSM. 368 00:31:49,340 --> 00:31:49,520 Yeah. 369 00:31:49,900 --> 00:31:50,240 Yeah. 370 00:31:51,180 --> 00:31:51,640 I'm sorry. 371 00:31:51,800 --> 00:31:51,960 Yeah. 372 00:31:54,760 --> 00:31:55,100 Oh. 373 00:31:56,060 --> 00:31:56,800 Any other questions? 374 00:31:57,260 --> 00:31:57,600 No. 375 00:31:58,140 --> 00:31:58,480 Okay. 376 00:31:58,700 --> 00:31:59,640 Thank you very much. 377 00:31:59,700 --> 00:32:00,240 Thank you very much.