Hello everyone. There's a lot of people from Latin America. We're speaking in Spanish.
Yeah, yeah. Don't worry, don't worry. It's okay, it's okay. Well, my name is Claudio
Caraciolo. I am from Argentina. With me is Sheila Berta. She's from Argentina, too. Both
working in Telefónica in a unit called Telefónica. And we're going to talk a little bit about
the 11 Paths. It's a unit from Telefónica. This is our first talk in English, so be patient
with us. Or drink something. I don't know. It's the same for me. Yeah? This talk is about
Devicho. Devicho is a hardware backdoor. And we also construct and software to do this
backdoor functionality.
So to start talking about this, we have to talk about why we are working about a backdoor in a
canvas. Yes? And the real question is why not? Why we can do, why we can backdoor our computer,
we can modify our computer, our server, our phones. But if we don't have the software, we can't
modify our computer, and why not we can do the same with our car? Yes? And just, we are
curiously people like you, like all of you. So the real reason is because we can. This is the
project. So the first thing that we need to talk with you is about safety. Because car hacking is
not the same like computer hacking because it's dangerous. You can modify a car and you can modify a car.
find something in the GAN message that can activate the break or the gas pedal or just some
function in the shine and you can break something or you can cause injury in someone. So you
have to be careful. Thank you. Thank you very much. Thank you very much. Thank you very
much. You have to be careful with this because there is not so important how trained are you
because accidents occur, yeah? So you can see that in this sample, for example. Okay. So
let's see. He is worried about safety. Okay. When we talk about car hacking, most of
you think about the connector cars, the motor cars, yeah? Because the motor cars are
cars that we can find in our country. Okay. It's not working. You have a lot of thing of
connectivity. For example, you have the TPM. That's true. That's true. It's my car. In the
connected car you have GPS, you have Bluetooth, you have Wi-Fi, you have the TPM model for
pressurize, for pressure. You have SIM, SIM cards to control your car. You have a lot of
interface to do something with the car. Even USB or some, some storage, yeah? Like SID. So
you have a lot of thing to do or to play. But what, what happened with the canvas with the
network or the real network of your car? We want to work with this type of network because in
our country is not so common find this type of car. Okay. This type of car, see? Yeah. It's not
so common. So we want to play with this and find, and find, and find one, one way to access
the network of the car and to control it remotely. Yeah? This is the, the process that we work. So
for most of you maybe CAN bus is not so common so we need to do a quick review about how CAN bus
works. This talk is not about CAN bus so it's just a quick review. CAN bus or the Controlled
Area Network is an old standard. Yes, it's an old standard. The CAN bus or the Controlled
Area Network is about 15 years. So in that moment security was an issue. So CAN bus was
designed to work in some environment with a lot of noise, with a lot of, yes, noise is the
correct word because you have an engine. So you have a lot of noise in the interface itself.
So CAN bus was designed to be faster, to be efficiently but not secure. In that moment all
networks with CAN bus was not only for cars. You can find some network with CAN bus or with CAN
protocol in industrial environment. Yeah and like the people before here. And you can find some
But when we talk about Canvas, we have to, for a car, we have to talk about a standard from
1996 that was the introduction of this connector in our cars. Yes, this connector is the
ODB2 ports. It's not very clear, but it's a connector. This connector you can find in your
car, in the cabin of your car. And it's used to diagnostic or for diagnostic purpose. And this
is standard that was included in that date. You have a lot of things that every manufacturer in
your car can decide for what they will be using. There is some specific manufacturer that
will have specific pins like signal rounding or can high and can low. That are standards. But you
have a lot of things, a lot of pins, that you can use or not. It's decided for the manufacturer.
Okay. This is the war part. And it's difficult but it's necessary to understand. I hope super right.
Okay, when we're talking about CAM,
we have to talking about CAM bus.
That's why CAM network is based on a bus to bus ship.
Each node could be a sensor or a vehicle EQ,
and the information transmitted on the bus
can be used by several nodes at the same time.
As CAM was developed for use in automated environment
where there is a lot of noise,
it uses a system known as differential voltage
and that allows it to gain immunity against interference.
In this system, there is a transmitter
that transmits a signal in duplicate,
one with positive value and the other one with negative value.
These are CAM high and CAM low signals.
If the receiver receives two signals that are not equal,
it discards it, assuming that it's noise on the bus.
Moreover, CAM protocol has something known as inverted logic
where we have a dominant state, which is zero,
and a recessive state, which is one.
So, it influences a bit in the frame format.
In that graph, we can see a standard CAM frame.
The green part is the arbitration fields
that contains
the frame's ID.
One important here is that those IDs with mostly zeros
will have higher priority on the bus.
So, that's why CAM frames associated with the engine
has the lowest ID, so the higher priority on the CAM bus.
And after that, we have the data length in yellow
and the data itself in red
that can contain a maximum of eight bytes.
And, as we can observe, there aren't source or destination addresses,
neither source or destination ports,
like protocols we know better, such as TCP, IP.
So, a CAM node has to check the arbitration fields
to know if it should take the frame's data.
Yep.
And I guess my English is not good enough
to explain this clearly, so you can go to Wikipedia as well.
Okay, this is how a CAM frame looks like.
We have to know that a CAM frame does not indicate
anywhere what kind of information is scary.
For example, a CAM frame that is scary information
about RPM, does not indicate anywhere
that it's information is about RPM.
So, that's why to find out what kind of information
each frame is scary, we have to do a reversing process.
Yep, for that, there is a lot of different tools.
This is an oscilloscope, and it's the lowest level tool
we can find to analyze count signals.
Don't use it.
Don't use it, yeah, yeah.
In our case, we have a count model that allows us
to see the hexadecimal representation of such signals.
Yep, but yeah, it's too fast to see, it's impossible.
On the other hand, we have the higher level tools
that allow us to see count frames in a nice way,
and we can analyze them so much easy, in an easy way, yep.
Anyway, it's still too hard, so.
We have an example here.
We are doing in a VW Fox, yeah.
We just start the light, and this is what's occurring
in the sniffing.
Yeah, so if you see this, it is, again,
just, you can see that the only action that I do
is start the light, is put the lighting on, yeah,
but there is a lot of frames of the data
traveling in the canvas.
That is why it's very difficult to do this one,
because in your house, when you're putting on, you know,
the light, yeah, the light, it's just one command.
You put it on, and the light is on, that's all, that's all.
There is no magic, but in the car,
when you activate the light in your car,
the canvas is, the model, I'm sorry, for the light,
is sending every time, every second, a lot of frames,
send with the message, lights on, lights on, lights on,
lights on, yeah, not just once, yeah?
So, when you activate this one, you can see,
for my horrible explanation, that there is a line
with one change every time, but it's not the case,
because when you activate the light in your car,
you have that message constantly,
but you have another message.
Why?
Because when you start the light in your car,
not only the light in the car,
if it's on, because you have the activation
of the panel of the instrument,
where you have the icon of the light,
and you have other lights in your panel that's putting on,
and maybe other function, depending of the car.
So, in this car, that is an old, well, okay,
it's an old car,
and it's a mechanical action,
and you have a, we have a lot of message,
but think about what happened with a new car.
For example, an Honda Civic, and Honda Civic from this year.
We have a video about what happened when you put the key
in the ignition mode.
It's the fucking Matrix.
So, the real question is that.
Is this one.
how we can find the cam frame we want. It's a bit difficult. So nowadays there are several
tools to analyze cam last. Here in the car hacking village or in the vendor's area we can
find some of them. Cam spike, cam loop, cam tag, cam analyzer from microchip or even we can
use socket cam with open hardware tool as well. With the canal tilt for Linux. Yeah. Yeah.
And in our case we began using cam loop and cam analyzer from microchip. Usually these tools
allow us to inject cam frames on the bus as well. But the frequency with which this tool makes
the transmissions may not be fast enough to cam bus. Yeah. So we decided to use this tool to
test the cam frame. That's when that happens. So, yeah. As I can say each node is
concurrently is current state. So constantly it's current state. So in, in this case the light
module is saying that the lights are off. While we are injecting every 100 milliseconds that
the lights are on. So this is what produces the flicker effect. So you can see that we
need more speed to inject that payload. So eh, with software it's not so easy. So we, we
build an, an, our back door to do this eh, with the uh, ODV2 ports. So that is why we start
working in that project. And we present this one in the co-party the last year. And for this
moment. For this project. A lot of people don't understand this. And it's, it's kind of the cold
people ask us about how it is possible to someone put in your car a back door, a hardware
back door, and you don't notice that. The answer is easy because if you, for example, left
your car in a car wash, it's a good opportunity for someone to put something in your ODB2
ports. Or maybe in a valid parking. There are moments when you left your car and someone can do
that. Or maybe if you give a ride some Spive. Maybe. Or maybe if you are married with Shane's
mom. I don't know. There is a possibility that we start working in that project that was the
first one. Yeah. When we began, we started with a simple
injector. Yeah. And then we started with a simple injector. And then we started with a
pick 18F2680. Yeah. With a transceiver to convert high and low signals. And it's kind, the
firmware that we developed in assembly can inject with a great speed on the car frame. So
avoiding that what we saw in the previous video. And after came the malicious ideas. And we
thought how we could control this remotely. So we added a single injector. And then we started to
develop a software. And then we added that we added sim 80, 800L. So so that to control the
hardware back door through SMS commas. Yeah. And that was the result. Our first proof of concept.
And works, works fine. And after that, we thought that would be nice, would be nice to setting up
the cam frames. And the attack commands through a PC software. So avoiding hard coding the
they carve the gun frames and the commands
into the firmware, so yeah.
So we added a USB interface.
We have to develop a new hardware, yeah.
Where there is two modes, hack mode and a programming mode.
We can toggle between two modes via this switch.
Yeah, you have the programming mode and the hack mode, yeah.
And this new hardware has, it looks a bit nice,
just you use SMD components, yeah.
It's this one?
Yeah, it's this one, yeah.
And here we can see, it's the comparison
with a rubber ducky.
As you can see, it's a little, little hardware, yeah.
So we have it at this moment, at this moment.
Let me see.
At this moment, we think about, it was a nice project,
but we need to improve it.
Why?
Because to configure this one, like Shaylee say,
we need to know about assembler, yeah.
You have to put that, put out the microchip,
program it, and put it again.
So we start working in this new interface,
in this new design, and we,
we need, or we want to create another piece of this project
that was software, yeah.
So this is the real thing about the CarBackDoorMaker.
So for us, this is the Vicho, yeah,
and this is the CarBackDoorMaker.
Why?
Because in this program, you don't need to know
anything about assembler, anything about programming,
just you know to need the correct frame
that you want to inject, yeah.
Put it right in the memory, and it's solved.
So this is the other part of this project.
And when we start creating this,
we work in this setup, in this basic setup,
when you can see the ID, the Identificator,
and I think that Shaylee told you,
but when the ID is lower, there is high,
there is higher, thank you.
Higher priority on the investment.
Higher priority on the investment.
So because the lower ID is the engine function, yeah.
This is the length of the frame,
and this are the data in the eight bytes.
This is the first part, and we have the SMS control.
So when we create this one, if you read a message,
a frame message,
and the cam that start the light,
you can put that correct frame here.
You can say, with SMS, you will control it, yeah.
And just press right, and that's all.
But when we construct this, when we will this application,
we start thinking about another function, yeah.
And we start working in the advanced setups.
So, I think the best thing is the possibility
to introduce your phone number.
So, if you put this one in your car,
and you put here your phone number,
so only you can control this feature, yeah?
And anyone can.
And the second thing is to run automatically this payload.
How?
For example, if you, in youremos, this payload, right?
car, you are driving your car and throw for a specific location with a GPS, I can tell to
the program, to the bicho, that start automatically the payload for example for activating
the brakes or for starting the light or for controlling the fuel, everything. The same, we
work the same with the, with a specific frame. So, if you are working, you are driving your
car and you, for example, start the light, I can tell you to the bicho that when you start the
light, the car stops. The machine stops. Or the brakes stop. I don't know. So, I can tell
you, if you want to see this one.
For example, this is the bicho in the programming mode. Yeah? With this deep switch down, it's
in programming mode. You can see that we have a green light. Yeah. But if I start the program,
if I start the program, the bicho will stop. So, I can tell you that the bicho will stop.
And I just put the connect. Yeah. This light is red now. Yeah. So, this is telling me that
there is a communication between the software and the hardware. Yeah. So, if I know the
correct frame, I just put it here. So, I can tell you that the bicho will stop. So, I can tell
you that the bicho will stop. And the correct SMS that I want to use to control this one. Which
four letter can I use? Which I want. So, I can use four letter in that case. That's all. For
example. And it's okay. Yeah. Here, I can tell you that the bicho will stop. So, I can tell you
my phone number. And if I press right, that's all. The model is ready to hack. Yeah? So, I just
disconnect this here. Put this one. Put this in app to hack it more and connect this in the
other region. That's all. Yeah.
Thanks for listening.
They are friends. Thank you.
But at this point, we have another problem. Because to do this one, we need to know the
correct frame. So, we have another problem. Yeah. I have to sniff my car every time.
or but I have another problem that my car for example have a
specific message can I leave to control the light, the brakes,
the speed, everything and your car I'm sure use another CAN
message. Because it's not standard that message. Every
manufacturer has implemented his own CAN message. Even in the
same manufacturer, every model had different CAN frames. So we
start working in another thing that is the open CAN database.
Yeah and open CAN database is a shared database just to share
information about the CAN message. If you read with some
sniffer a CAN message for your car you can come here, put
put outcome frame and that's all. Complete this information. So if you don't find your
card you can add a new card and if you don't have the vector you can add a new vector and
it's totally open and free for you too. So at this moment we have a hardware, we have a
software and an open card database so you have a lot of fun. And everything is free. That's
the beautiful of this one. You can see an example of this one. With this video. We send a
message with light on and now a message with stop the light. And the light is off. So that's
it. If you are thinking that is that's all, the correct answer is yes. It is. For now. For
now. This project is not over. So thank you very much.
And to finish this I want to thank some people that support us for Nicoleno for our English.
Yeah, it's his fault. Eva and Chris for the design of the web page. For the design. And
Mondalan for his support with sharing canvas for the database. Yeah, that's all. So thank you
very much. And if you have questions, we are here.
Thank you very much.
.
.
.
.
.
.
.
.
.
.
.
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
sells key locks.
Oh, yeah.
So if you're concerned about it,
you buy the key lock, you put it on.
Nice.
Thank you very much.
Not that far down,
because by law you have to be able to have
as dry carbon connected in
without putting your head between your knees
and your left foot in the master section.
Thank you.
Thank you.
Any other questions?
The other one.
You're not, you're not, you can't.
How long did it take for you to develop all this?
How long?
How long?
I don't know.
A year?
I don't know.
10 months, I don't know.
Yeah, 10 months.
It's our hobby, so it's not work.
Yeah.
I think all the project was not easy,
but I think that it's difficult
to find the correct frame.
This is a very complicated work.
Yeah, we had a lot of reversing processes
to find the cam frame you want
for the lights, for the engine, or whatever.
So yeah, it takes a lot of time.
That's because we do the open database.
Yeah.
This is to share.
Yeah.
So.
Yes.
With cellular carriers,
is it specific cellular carriers
when you plug in your phone number?
So.
No.
Okay.
You can put anyone.
It's not a, it's not a problem.
What is GSM?
GSM.
The GSM is for locating with the provider, yeah?
But it's not important the sale of the chip, yeah?
Yeah.
I say this because in the States they have GSM
and they have CDMA.
Okay.
No.
It's GSM.
Yeah.
Yeah.
I'm sorry.
Yeah.
Oh.
Any other questions?
No.
Okay.
Thank you very much.
Thank you very much.