1 00:00:00,000 --> 00:00:08,460 Let's go and get started. We are going to talk about how your car isn't. My name is BitBang. 2 00:00:08,560 --> 00:00:14,940 There's also some who call me Tim. I am a largely recovered software developer. I spent most 3 00:00:14,940 --> 00:00:19,800 of my career writing embedded systems for planes and the types of planes that you fly from 4 00:00:19,800 --> 00:00:25,760 the ground and cars. Somewhere along the way I've become a hardware guy. Still not quite 5 00:00:25,760 --> 00:00:30,560 sure how that happened but people keep asking me questions about hardware and I know the 6 00:00:30,560 --> 00:00:35,240 answer apparently. So I've been doing that a lot recently and I still get a bit twitchy 7 00:00:35,240 --> 00:00:44,780 around certain aircraft. I'm N2. In meat space most people call me Mitch. I am also a 8 00:00:44,780 --> 00:00:51,200 recovering software developer. I'm not quite as recovered as Tim is but get in there. I've 9 00:00:51,200 --> 00:00:55,600 had a passion for embedded development for a long time but for many years I was 10 00:00:55,600 --> 00:01:02,840 paying the bills doing web dev. It's a lot more fun breaking stuff. So that's what I do now 11 00:01:02,840 --> 00:01:13,700 full time. So this is your car. This is what it looks like now. There aren't things like 12 00:01:13,700 --> 00:01:21,060 carburetors. You don't replace your jets and tweak your idle screws to tune your car anymore. 13 00:01:21,240 --> 00:01:25,580 You do it a little bit differently these days. So I'm going to go ahead and get started. So I'm 14 00:01:25,600 --> 00:01:31,040 system. Your car is actually a network. A bunch of different components connected over typically other 15 00:01:31,040 --> 00:01:36,660 types of buses that we'll talk about later. And actually with that again your car isn't 16 00:01:36,660 --> 00:01:43,400 a network it's a whole bunch of networks. There's a bunch of stuff on there like a can, ethernet, 17 00:01:43,460 --> 00:01:52,720 Wi-Fi, Bluetooth, over radio, wirelessorener where tire pressure sensors. We'll be putting another radio on 18 00:01:52,720 --> 00:01:55,580 there for autonomous driving called a DSRC radio. If you don't know what that is, just look at 19 00:01:56,340 --> 00:02:05,640 I just see attack surface. So they're just networks. We've been protecting and working on 20 00:02:05,640 --> 00:02:13,280 networks for dozens of years now. We know how to do that. No, not quite. These are not the 21 00:02:13,280 --> 00:02:22,380 networks you're used to. So there's a bunch of standard techniques that used to be employed 22 00:02:22,380 --> 00:02:28,720 and are still employed for standard like TCP IP networks that don't work on CAN bus for a 23 00:02:28,720 --> 00:02:37,020 variety of reasons, which we will talk about now. So CAN bus has a tiny payload. It's 8 bytes 24 00:02:37,020 --> 00:02:41,320 in a packet. Now there are standards like ISO TP that allows you to send more traffic on the 25 00:02:41,320 --> 00:02:47,760 CAN bus, but CAN bus is also slow. About 500 kilobits per second is typical in a car. And 26 00:02:47,760 --> 00:02:52,000 there's a lot of data on a CAN bus. So if you hook into a CAN bus, we have our 27 00:02:52,000 --> 00:02:56,840 demo out in the car hacking village. You can hook into the bus, see the traffic. There's a lot of 28 00:02:56,840 --> 00:03:01,240 stuff going on there. And making it longer and making it take longer to process isn't always an 29 00:03:01,240 --> 00:03:07,640 option. Your processors on a lot of these ECUs are eight 16-bit micros with I can count the 30 00:03:07,640 --> 00:03:13,860 flash and RAM on my fingers in kilobytes. Very, very small processors. It also makes things 31 00:03:13,860 --> 00:03:18,260 like authentication. A lot of these things are also very safety critical, very time 32 00:03:18,260 --> 00:03:21,980 sensitively safety critical. So you add a bunch of overheads, you add a bunch of 33 00:03:23,900 --> 00:03:28,100 overhead to do authentication, add a bunch of overhead to do your encryption, all of a sudden 34 00:03:28,100 --> 00:03:32,460 you can't hit your timing requirements for safety anymore. You also have the question of 35 00:03:32,460 --> 00:03:35,840 protecting the keys. We actually give cars to people. I don't know how many of you realize 36 00:03:35,840 --> 00:03:40,580 this, but everybody who owns a car owns a car. And they have access to all of these things that 37 00:03:40,580 --> 00:03:44,740 are in the car. And if you're going to ship the key with the car, it's only a matter of time 38 00:03:44,740 --> 00:03:51,960 until somebody rips it out of there. Traditional networks use things like IPs and 39 00:03:51,980 --> 00:04:01,800 firewalls. They tend not to work quite so well in a CAN bus network. If you have any sort of 40 00:04:01,800 --> 00:04:06,940 message passing ability, lots of the time the messages which are normally passed in the course 41 00:04:06,940 --> 00:04:13,200 of normal operation can be used against you. So on most vehicles, there's some sort of diagnostic 42 00:04:13,200 --> 00:04:19,520 methodology where you can actually pulse the ABS modulator to bleed brakes. That's a normally 43 00:04:19,520 --> 00:04:21,960 allowed message. So it gets through a firewall. And if you have any sort of message passing 44 00:04:21,980 --> 00:04:28,780 through the CAN bus, it's a firewall. On the CAN bus, there is no way to determine what node on 45 00:04:28,780 --> 00:04:34,100 the bus is sending a network. So once the message gets on the network, it's indistinguishable from 46 00:04:34,100 --> 00:04:42,060 any other node's messages. So if the message can ever appear on the bus, it's basically forced to 47 00:04:42,060 --> 00:04:49,440 be treated as valid. So what about intrusion detection systems? Something a little bit smarter 48 00:04:49,440 --> 00:04:51,960 than a firewall is able to say something like, you know, you're a driver, you're going to get a 49 00:04:51,960 --> 00:04:56,900 call. Hey, you know, we're trying to bleed the brakes and we're going 70 miles an hour down the 50 00:04:56,900 --> 00:05:01,300 interstate. This probably shouldn't be happening. And while I'm not denying that this could be a 51 00:05:01,300 --> 00:05:07,460 part of the solution, what do you do? I mean, you can't just disable the ABS module because you 52 00:05:07,460 --> 00:05:12,360 kind of need that. You can't just pull over to the side of the road because that might not be a 53 00:05:12,360 --> 00:05:16,720 safe thing to do at the moment. So there's a question, so you have this IDS that alerts you, 54 00:05:16,800 --> 00:05:21,660 which is great, but what do you do about that? And what do you do with that alert? It's like a 55 00:05:21,660 --> 00:05:25,140 check engine. You're going to take it to the mechanic in three months and, you know, see what's up 56 00:05:25,140 --> 00:05:36,800 with that. So what can we do? Segregating networks is a great first step. You can't hack or influence 57 00:05:36,800 --> 00:05:44,800 what you can't talk to. So if you have dedicated buses for just talking between the power 58 00:05:44,800 --> 00:05:50,560 steering and I don't even know what needs to talk to the power steering most of the time, usually the 59 00:05:51,660 --> 00:05:58,760 power steering is for speed-related messages, there's a lot less attack service on the bus. So if 60 00:05:58,760 --> 00:06:06,600 you can't talk to your brake module from the head unit, then no one who gets into the head unit from 61 00:06:06,600 --> 00:06:11,900 some sort of Internet connection can apply your brakes in the middle of, like, driving. Good 62 00:06:11,900 --> 00:06:20,180 things. Having some sort of internal sanity checking on each module, so I'm going 70 miles an hour 63 00:06:20,180 --> 00:06:26,540 down the highway, maybe now is not the right time to try and bleed the brakes. Some of these we're 64 00:06:26,540 --> 00:06:37,560 starting to see in modules, not as much as we might hope. For all of these, like, it's just a part of a 65 00:06:37,560 --> 00:06:46,340 broader solution. The end solution is probably getting rid of CAN altogether, but eventually maybe. 66 00:06:47,480 --> 00:06:48,680 That's going to take a while. 67 00:06:51,400 --> 00:06:57,900 So what does it mean to hack a car? Is this car hacking? This is actually more expensive than a lot of 68 00:06:57,900 --> 00:07:01,740 forms of car hacking that we're going to talk about. Those things probably cost 20, 30 bucks a piece. 69 00:07:01,940 --> 00:07:08,300 I mean, that's a lot of money going into that Audi there. Axes aren't cheap. No, they are not. 70 00:07:12,660 --> 00:07:17,500 So hacking a car, what does it mean? That depends on who you're talking to, who's doing the hacking, 71 00:07:17,500 --> 00:07:23,400 what systems are in scope for the hacking that you're doing, what are your goals? Are you trying, 72 00:07:23,500 --> 00:07:29,600 you know, like, for the modern community, like, they're trying to get into the ECU and do some 73 00:07:29,600 --> 00:07:32,940 performance tuning. That's the hacking that they're doing. There's nothing malicious about it. 74 00:07:32,960 --> 00:07:38,220 They just want their car to go a little bit faster. There's plenty of other things that we're 75 00:07:38,220 --> 00:07:47,320 going to talk about, too, in a couple slides. So hacking a car can mean a lot of different things. 76 00:07:47,500 --> 00:07:53,660 Like Mitch alluded to earlier, a lot of stuff that we found is diagnostics that are left enabled on 77 00:07:53,660 --> 00:07:59,780 ECUs that can be enabled at times that would be somewhat inconvenient for the driver, like the 78 00:07:59,780 --> 00:08:05,600 brake bleeding at 70 miles an hour. Sending CAN messages to control the vehicle, doing 79 00:08:05,600 --> 00:08:11,620 enough reverse engineering on the CAN bus to figure out what different messages do. Taking over 80 00:08:11,620 --> 00:08:17,180 the infotainment system via the Internet or SMS, this is kind of getting more into your, you know, 81 00:08:17,180 --> 00:08:22,800 more standard Wi-Fi type hacking, where this is just a infotainment system. It's a full-fledged 82 00:08:22,800 --> 00:08:28,440 operating system. It's, you know, Windows CE, QNX, Android, running Wi-Fi, running Bluetooth. This 83 00:08:28,440 --> 00:08:32,960 is a lot of attack surface, a lot of what's very quickly becoming very well-known attack 84 00:08:32,960 --> 00:08:38,440 surface. And, by the way, these are also almost always connected to the CAN bus. Now, the 85 00:08:38,440 --> 00:08:44,400 segregation is actually happening. We're seeing it happen in the real world that the infotainment, 86 00:08:44,420 --> 00:08:47,160 which used to maybe be on every CAN bus, is now only on a couple of CAN buses. And, you know, the 87 00:08:47,160 --> 00:08:49,600 infotainment system is on a couple of them, which is great, you know, especially isolating it 88 00:08:49,600 --> 00:08:53,660 from the safety-critical systems is something that we're seeing happening now. So now you still 89 00:08:53,660 --> 00:08:57,080 have to pivot off something in order, because there are things that are connected to both CAN 90 00:08:57,080 --> 00:09:02,580 buses. You've got to find a device that's also vulnerable to compromise to pivot then onto the 91 00:09:02,580 --> 00:09:08,460 bus that you want to get to. And, I mean, GPS, a lot of the cars have built-in microphones for 92 00:09:08,460 --> 00:09:16,580 your cell phone, using the TPMS sensors that all have a unique ID to track a vehicle. Yeah, lots 93 00:09:16,580 --> 00:09:24,400 of other concerns as well. And all these different types of hackers, these different goals in 94 00:09:24,400 --> 00:09:33,960 mind are going to employ various of these and other attack methods. Something that's useful to 95 00:09:33,960 --> 00:09:41,020 know when you start actually looking at hacking cars is that the OEMs, so, like, Ford and 96 00:09:41,020 --> 00:09:46,560 Nissan and Volkswagen, they don't make cars. They put their cars on the road, and they don't 97 00:09:46,560 --> 00:09:52,180 put them together. So they subcontract construction of pretty much every assembly in the 98 00:09:52,180 --> 00:09:59,740 vehicle. So the primary subcontractors are called Tier 1s. Tier 1s employ Tier 2s who employ 99 00:09:59,740 --> 00:10:07,700 Tier 3s, many levels deep sometimes. When you're dealing with security requirements, there's some 100 00:10:07,700 --> 00:10:14,900 high-level requirements that the OEMs specify when they're designing the car. This must be secure. 101 00:10:15,500 --> 00:10:16,540 Who knows? 102 00:10:16,540 --> 00:10:22,220 knows if those actually get implemented down the line. Some of this stuff is really hard to 103 00:10:22,220 --> 00:10:34,080 verify experimentally. As we mentioned, the relationship between OEMs and their Tier 1s and 104 00:10:34,080 --> 00:10:39,820 their Tier 2s and their Tier 3s isn't always necessarily a completely healthy, open and 105 00:10:39,820 --> 00:10:44,920 honest one. Which in some ways makes sense. These Tier 1s are working with more than one OEM. 106 00:10:44,920 --> 00:10:50,500 They have their secret sauce that makes their stuff better. So they put on their marketing 107 00:10:50,500 --> 00:10:55,860 glossies. So they don't necessarily want to just give the OEM complete access to all of their 108 00:10:55,860 --> 00:11:00,580 source code, all of their information, because they could lose out on competitive advantage 109 00:11:00,580 --> 00:11:09,380 that way. So that's the question. What exactly do you do about that? There's a lot of 110 00:11:09,380 --> 00:11:14,760 project manager chicken being played. Yes. I'm going to go to the next question. 111 00:11:14,920 --> 00:11:18,440 So who's doing the hacking? As I mentioned, modders. They want to add cool features. They want to 112 00:11:18,440 --> 00:11:23,720 make their car go faster. They want to turn their LEDs blue instead of yellow in their car. All 113 00:11:23,720 --> 00:11:31,540 those very vitally safety critical features in there. Security professionals. I hack on cars, too. 114 00:11:32,200 --> 00:11:39,300 To protect and against what? What's actually important? Where should the focus be put? And how 115 00:11:39,300 --> 00:11:44,900 do we address some of these fairly complex issues that face the automotive industry? I'm going to 116 00:11:46,020 --> 00:11:50,440 go to the next question. Expedition engineers. Code execution. Like I said, these are often very, 117 00:11:50,540 --> 00:11:54,880 very small micros. They're not running an operating system. There's no data execution 118 00:11:54,880 --> 00:11:59,840 prevention. There's no ASLR. If you find a buffer overflow, you stick your cell code on the 119 00:11:59,840 --> 00:12:06,400 stack, overwrite program counter, and jump to it. It's back to the 90s in terms of security, because 120 00:12:06,400 --> 00:12:12,820 these small processors that are in use just don't have these features. There is no operating system 121 00:12:12,820 --> 00:12:14,880 in use to add these features. So I'm going to go to the next question. I'm going to go to the next question. 122 00:12:16,220 --> 00:12:22,340 Organized crime. This is actually the one that kind of, so what keeps me up at night isn't so much, 123 00:12:22,340 --> 00:12:27,280 you know, hacker, you know, Fast and Furious 8 hacker taking over the world and crashing all the 124 00:12:27,280 --> 00:12:34,920 cars into each other all the time. It's more targeted stuff. Targeted assassination. One of the 125 00:12:34,920 --> 00:12:39,080 saving graces of the automotive industry is that there is so much difference in a car. There's 126 00:12:39,080 --> 00:12:44,320 different, every car has different ECUs. Even between model years, when you find out on a 2012 focus, 127 00:12:44,900 --> 00:12:46,580 there's a lot of difference. So I think that the hack that you have out there might be different, 128 00:12:46,660 --> 00:12:52,800 at least in some critical ways, from a 2013 focus. So the hack that hacks all the cars just isn't 129 00:12:52,800 --> 00:12:58,440 going to happen because of that difference. But the hack that hacks one car is a lot more in 130 00:12:58,440 --> 00:13:06,240 reach. And of course, nation state level stuff that I'm not going to get into. In terms of 131 00:13:06,240 --> 00:13:14,380 organized crime, larger crime ranks are starting to figure out, oh, I can actually use like relay 132 00:13:14,380 --> 00:13:23,480 attacks to do a remote replay, not replay, relay attack against most keyless entry dongles and 133 00:13:23,480 --> 00:13:29,900 steal cars that way. It's actually pretty easy. I think there was a good talk on it last year at 134 00:13:29,900 --> 00:13:44,360 Def Con? I'm not sure. Yesterday. I missed that one. So how are, you know, targets and 135 00:13:44,380 --> 00:13:46,540 all these various people hacking into cars. 136 00:13:47,160 --> 00:13:49,820 There's a lot of different interfaces 137 00:13:49,820 --> 00:13:50,920 you can actually get into. 138 00:13:51,960 --> 00:13:54,300 So all of these are networked at this point. 139 00:13:55,280 --> 00:13:59,240 Your OnStar uses like a 4G AT&T connection 140 00:13:59,240 --> 00:14:00,140 that's always on. 141 00:14:00,820 --> 00:14:03,220 The Uconnect system is on Sprint. 142 00:14:04,540 --> 00:14:06,560 I don't actually know off the top of my head 143 00:14:06,560 --> 00:14:08,740 what other cell networks the other OEMs use, 144 00:14:08,920 --> 00:14:12,440 but most modern infotainment systems 145 00:14:12,440 --> 00:14:16,460 will be connected to a 4G network somehow. 146 00:14:18,480 --> 00:14:22,760 There's much lower level like debug interfaces. 147 00:14:23,120 --> 00:14:25,200 So you've got JTAG and SWD interfaces. 148 00:14:25,640 --> 00:14:27,600 If you can actually take the time 149 00:14:27,600 --> 00:14:29,500 to pull a module out of the car and tear it apart. 150 00:14:30,460 --> 00:14:33,400 If you have an active debug peripheral, 151 00:14:33,930 --> 00:14:37,440 you can dump whatever from where you want most of the time. 152 00:14:40,020 --> 00:14:42,420 Even if you don't have a debug peripheral, 153 00:14:42,440 --> 00:14:44,800 there's other buses you can attack. 154 00:14:45,240 --> 00:14:47,320 If you want to reverse engineer 155 00:14:47,320 --> 00:14:50,540 the operation of subcomponents, 156 00:14:51,480 --> 00:14:54,880 you've got SPI, I2C, and UARTs, 157 00:14:54,880 --> 00:14:57,160 which are commonly used to talk between modules 158 00:14:57,160 --> 00:14:58,000 on the same board. 159 00:14:59,740 --> 00:15:03,500 Firmware updates are less secure than you might hope. 160 00:15:04,780 --> 00:15:08,440 I don't think I've yet encountered a submodule 161 00:15:09,000 --> 00:15:11,760 other than head units that use code signing 162 00:15:11,760 --> 00:15:12,420 or anything like that. 163 00:15:12,420 --> 00:15:15,440 I don't think there's any sort of decent integrity checking. 164 00:15:18,200 --> 00:15:20,940 There's lots of different radios on your cars. 165 00:15:21,400 --> 00:15:24,340 So even like your FM radio, 166 00:15:24,580 --> 00:15:26,520 just listening to FM, 167 00:15:27,880 --> 00:15:29,840 if you take a look at your head unit, 168 00:15:30,000 --> 00:15:32,500 it'll display station names and track names. 169 00:15:32,960 --> 00:15:35,100 That's done with a system called RDS, 170 00:15:35,340 --> 00:15:36,340 the radio data system. 171 00:15:37,160 --> 00:15:40,560 In addition to just displaying short strings of text like that, 172 00:15:40,740 --> 00:15:42,400 there's an entire subsystem 173 00:15:42,400 --> 00:15:43,940 for distributing traffic messages. 174 00:15:44,960 --> 00:15:46,940 So it'll actually update, 175 00:15:47,120 --> 00:15:48,600 on my car at least, 176 00:15:48,740 --> 00:15:52,400 that's the method used to add accident indicators 177 00:15:52,400 --> 00:15:54,180 on the navigation system. 178 00:15:56,540 --> 00:15:58,660 And if you get really dedicated, 179 00:15:58,940 --> 00:16:00,660 you can start decapping chips 180 00:16:00,660 --> 00:16:02,900 to try and break into hardware security modules. 181 00:16:04,680 --> 00:16:06,780 So general analysis is a lot of fun too. 182 00:16:07,160 --> 00:16:07,660 Yes, it is. 183 00:16:09,240 --> 00:16:11,960 And car hacking doesn't have to be all that expensive. 184 00:16:12,400 --> 00:16:15,180 The CanTact, Canable are what? 185 00:16:16,180 --> 00:16:18,520 If you want to build your own Canable, 186 00:16:18,620 --> 00:16:21,280 I built them in like 15 quantity 187 00:16:21,280 --> 00:16:24,080 for I think it was eight bucks each. 188 00:16:24,480 --> 00:16:25,860 That's pretty cheap. 189 00:16:26,020 --> 00:16:27,500 So the Canable and CanTact 190 00:16:27,500 --> 00:16:31,000 are a open source hardware CAN adapter 191 00:16:31,000 --> 00:16:34,640 built around a small STM32 microcontroller. 192 00:16:35,160 --> 00:16:38,560 The default firmware exposes it just as a UART 193 00:16:38,560 --> 00:16:40,480 using a standard CAN protocol. 194 00:16:42,560 --> 00:16:44,760 And they're really basic hardware, 195 00:16:44,980 --> 00:16:46,380 but they work really well. 196 00:16:49,540 --> 00:16:49,980 Yeah. 197 00:16:51,280 --> 00:16:52,660 I have a bunch now. 198 00:16:53,940 --> 00:16:55,700 You can do a software-defined radio. 199 00:16:55,860 --> 00:16:57,460 These are obviously a little bit more expensive, 200 00:16:57,640 --> 00:16:58,740 but still pretty reasonable. 201 00:16:58,940 --> 00:17:02,420 Like a Blade RF or Lime SGR is three, four hundred bucks. 202 00:17:02,580 --> 00:17:04,160 Do a whole bunch of different types 203 00:17:04,160 --> 00:17:07,280 of wireless hacking with those. 204 00:17:07,380 --> 00:17:09,240 In addition to your standard on Wi-Fi, 205 00:17:09,240 --> 00:17:11,220 your laptop has a Wi-Fi chip on it, 206 00:17:11,240 --> 00:17:12,140 just use Wireshark. 207 00:17:12,400 --> 00:17:16,740 And for the more esoteric ones like your TPMS sensors 208 00:17:17,280 --> 00:17:25,020 or TPMS and the SCR works really well for that. 209 00:17:25,140 --> 00:17:28,300 There's also the Yardstick One and the Pandwa RF, 210 00:17:28,520 --> 00:17:33,060 which are slightly less capable than SDR like the Blade RF, 211 00:17:33,300 --> 00:17:35,280 but still definitely quite useful. 212 00:17:35,980 --> 00:17:38,820 Like the Yardstick One was used in the Roll Jam attack 213 00:17:38,820 --> 00:17:42,320 against your car's key fob. 214 00:17:42,400 --> 00:17:45,740 Which is a very interesting attack. 215 00:17:46,120 --> 00:17:49,440 They're less capable, but they're a lot easier to use. 216 00:17:50,040 --> 00:17:50,620 Yeah, that too. 217 00:17:50,860 --> 00:17:52,660 If you want to use SDRs, 218 00:17:52,660 --> 00:17:54,600 the most common way of interfacing with them 219 00:17:54,600 --> 00:17:57,620 is with something like GNU Radio Companion, 220 00:17:57,740 --> 00:18:03,400 which is a very complex flowchart-based radio setup tool. 221 00:18:04,220 --> 00:18:08,480 The Yardstick One and Pandwa RF are all in hardware. 222 00:18:08,720 --> 00:18:12,280 So it's configurable, and it does multiple modulation types, 223 00:18:12,280 --> 00:18:13,940 and encodings. 224 00:18:14,360 --> 00:18:17,660 But you set the hardware up, and you just do the data transfer. 225 00:18:17,960 --> 00:18:19,860 It's much simpler to use. 226 00:18:20,920 --> 00:18:22,040 And also the... 227 00:18:22,660 --> 00:18:23,420 Is that my question? 228 00:18:23,800 --> 00:18:26,100 Yeah, the can tag you were talking about, 229 00:18:26,180 --> 00:18:28,800 is that like a USB to can? 230 00:18:29,060 --> 00:18:29,360 Yeah. 231 00:18:29,460 --> 00:18:31,700 So you're saying those are actually cheap to make? 232 00:18:31,780 --> 00:18:34,700 I'm seeing the ones for sale for like $3.95 or $2.95. 233 00:18:35,080 --> 00:18:37,460 All the commercial ones are way overpriced. 234 00:18:37,600 --> 00:18:40,640 If you want to pay Vector, they're all overpriced. 235 00:18:40,640 --> 00:18:42,140 Yeah, if you want to pay Vector, 236 00:18:42,280 --> 00:18:42,760 and you don't have that much money, 237 00:18:42,820 --> 00:18:43,540 then go right ahead. 238 00:18:43,720 --> 00:18:44,640 But you really don't have to. 239 00:18:44,820 --> 00:18:46,540 So where do you find the can tags? 240 00:18:47,100 --> 00:18:51,260 So the can tag, I think the website is cantag.io. 241 00:18:52,160 --> 00:18:52,880 I'm not sure. 242 00:18:52,980 --> 00:18:54,100 If you Google it, you'll find it. 243 00:18:54,140 --> 00:18:55,860 It's a unique project. 244 00:18:56,220 --> 00:18:57,700 If you Google cannibal, 245 00:18:57,900 --> 00:19:00,540 you will get Google auto-correcting it to cannibal, 246 00:19:00,660 --> 00:19:01,600 and that's not what you want. 247 00:19:02,980 --> 00:19:05,900 But if you actually tell it to search in verbatim mode, 248 00:19:05,980 --> 00:19:06,980 you'll find the right project. 249 00:19:07,800 --> 00:19:09,480 They're based on the same schematic. 250 00:19:09,480 --> 00:19:12,460 So cantag was a project from Eric Evanczyk, 251 00:19:12,640 --> 00:19:14,100 who writes for Hackaday. 252 00:19:16,440 --> 00:19:19,220 It's literally just a microcontroller 253 00:19:19,220 --> 00:19:22,620 that has a crystal on the side 254 00:19:22,620 --> 00:19:24,880 and a CAN transceiver. 255 00:19:25,260 --> 00:19:26,600 It's super basic. 256 00:19:26,940 --> 00:19:29,500 The one thing you don't get in this sort of hardware 257 00:19:29,500 --> 00:19:31,320 is any sort of galvanic isolation. 258 00:19:31,880 --> 00:19:35,760 So some of the more expensive CAN adapters 259 00:19:35,760 --> 00:19:37,860 will actually protect your PC 260 00:19:37,860 --> 00:19:38,900 from high voltages 261 00:19:38,900 --> 00:19:39,460 that they're going to get 262 00:19:39,480 --> 00:19:40,760 or the CAN bus might experience 263 00:19:41,280 --> 00:19:42,400 if something goes wrong. 264 00:19:42,700 --> 00:19:44,180 These are just directly connected. 265 00:19:46,400 --> 00:19:49,200 I've never had a situation where that's important, 266 00:19:49,460 --> 00:19:51,820 but it's something to be aware of. 267 00:19:52,120 --> 00:19:54,780 Still, a cantag and a USB hub is a lot cheaper 268 00:19:54,780 --> 00:19:55,960 than anything you buy from Vector. 269 00:19:56,220 --> 00:19:56,360 Yes. 270 00:19:58,600 --> 00:20:00,480 I also have the CANCAT. 271 00:20:00,640 --> 00:20:02,260 That's a tool we've developed in-house. 272 00:20:02,440 --> 00:20:05,360 It's an Arduino Dewey with a CAN shield on it, 273 00:20:05,400 --> 00:20:05,800 open source. 274 00:20:06,060 --> 00:20:06,920 If you want to see a demo, 275 00:20:07,020 --> 00:20:08,960 we have it at our car hacking lab 276 00:20:09,480 --> 00:20:10,100 in the car hacking village. 277 00:20:11,700 --> 00:20:13,640 Slightly more expensive than the CANtactor CANable, 278 00:20:13,740 --> 00:20:15,720 but it also has two CAN transceivers on it. 279 00:20:15,800 --> 00:20:16,560 So you can do... 280 00:20:17,340 --> 00:20:19,420 CANCAT supports what we call CAN in the middle mode 281 00:20:19,420 --> 00:20:21,180 where you can isolate a device, 282 00:20:21,260 --> 00:20:23,380 basically use the two CAN transceivers 283 00:20:23,380 --> 00:20:24,740 as a pass-through. 284 00:20:24,920 --> 00:20:26,700 And you can also do filtering 285 00:20:26,700 --> 00:20:27,980 or modification of messages 286 00:20:27,980 --> 00:20:29,760 or block a certain method 287 00:20:29,760 --> 00:20:31,700 or whatever you want to do to screw with it. 288 00:20:31,820 --> 00:20:34,480 It's also really nice since CAN doesn't have a source IP address 289 00:20:34,480 --> 00:20:37,420 or source address as part of the packet. 290 00:20:37,600 --> 00:20:39,460 If you don't know which device is set 291 00:20:39,480 --> 00:20:40,160 for sending a message, 292 00:20:40,380 --> 00:20:42,740 you can use that to isolate a specific device 293 00:20:42,740 --> 00:20:44,080 and then see which messages 294 00:20:44,080 --> 00:20:45,440 that device is actually sending. 295 00:20:46,680 --> 00:20:48,520 Otherwise the CAN bus is just nothing but 296 00:20:49,240 --> 00:20:50,440 messages going back and forth 297 00:20:50,440 --> 00:20:52,640 and no idea where they're even originating from. 298 00:20:54,580 --> 00:20:55,280 Makena M2 299 00:20:55,280 --> 00:20:56,780 is a Kickstarter project. 300 00:20:57,160 --> 00:20:59,400 I think everybody said they're going to start shipping 301 00:20:59,400 --> 00:21:00,160 in a couple of weeks. 302 00:21:00,900 --> 00:21:01,700 I don't recall. 303 00:21:04,240 --> 00:21:05,900 Yeah, it's going to start shipping in a couple of weeks. 304 00:21:06,080 --> 00:21:07,900 It's also based on the Arduino Dewey 305 00:21:07,900 --> 00:21:09,940 and after our CANCAT firmware runs on it. 306 00:21:10,080 --> 00:21:12,240 Same deal, you get two CAN transceivers. 307 00:21:12,500 --> 00:21:13,440 You also get 308 00:21:14,020 --> 00:21:15,380 what else do you get on it? 309 00:21:15,980 --> 00:21:18,420 It does 12-volt I.O. 310 00:21:18,440 --> 00:21:19,220 It has 311 00:21:19,220 --> 00:21:21,140 a single-wire CAN, 312 00:21:21,420 --> 00:21:22,580 also called GMLAN. 313 00:21:22,840 --> 00:21:25,220 It's used for lots of the lower-speed communications 314 00:21:25,220 --> 00:21:26,320 in GM vehicles. 315 00:21:27,560 --> 00:21:29,420 It does K-Line. 316 00:21:29,520 --> 00:21:30,180 It does LIN. 317 00:21:31,440 --> 00:21:33,820 Basically, if it's a protocol that a car speaks 318 00:21:33,820 --> 00:21:35,820 that isn't automotive Ethernet, 319 00:21:35,940 --> 00:21:36,540 it'll do that. 320 00:21:37,900 --> 00:21:38,580 Does it do J1950? 321 00:21:39,760 --> 00:21:41,760 I think it does J1950. 322 00:21:41,920 --> 00:21:42,020 Yeah. 323 00:21:42,640 --> 00:21:43,940 A whole bunch of stuff. 324 00:21:44,200 --> 00:21:46,640 Especially if you have an older car you're hacking on. 325 00:21:47,600 --> 00:21:49,580 Modern cars mostly just have CAN 326 00:21:49,580 --> 00:21:51,640 and the single-wire CAN 327 00:21:51,640 --> 00:21:52,500 if it's a GM vehicle. 328 00:21:52,820 --> 00:21:55,480 If you're hacking anything before about 2008 though, 329 00:21:55,680 --> 00:21:57,180 the Makena's awesome for that 330 00:21:57,180 --> 00:21:58,820 because it has all of these older protocols 331 00:21:58,820 --> 00:22:00,420 that aren't in so much use anymore. 332 00:22:01,880 --> 00:22:03,440 But we're using those older vehicles. 333 00:22:03,560 --> 00:22:04,700 It's a great tool for that. 334 00:22:07,900 --> 00:22:09,780 And what's the fun in giving a talk 335 00:22:09,780 --> 00:22:11,640 if you don't actually introduce something new? 336 00:22:12,020 --> 00:22:13,660 So over the past couple weeks 337 00:22:13,660 --> 00:22:15,720 I put something together we're calling CANFLY. 338 00:22:16,500 --> 00:22:17,900 It's based on the ESP32. 339 00:22:18,760 --> 00:22:20,280 Has anyone heard of the ESP32? 340 00:22:21,220 --> 00:22:23,000 It's an IOT 341 00:22:23,660 --> 00:22:24,780 targeted module. 342 00:22:25,080 --> 00:22:27,000 It's got inbuilt Wi-Fi 343 00:22:27,000 --> 00:22:27,980 and Bluetooth. 344 00:22:29,020 --> 00:22:31,300 It does both Bluetooth Classic, 345 00:22:31,620 --> 00:22:32,440 Bluetooth Low Energy. 346 00:22:32,820 --> 00:22:35,720 It has a CAN transceiver on it, 347 00:22:35,760 --> 00:22:36,180 thankfully. 348 00:22:37,900 --> 00:22:41,920 It has two 200 MHz processors. 349 00:22:42,340 --> 00:22:44,180 It's a little bit of a weird architecture 350 00:22:44,180 --> 00:22:46,120 but the tooling is a lot better 351 00:22:46,120 --> 00:22:47,220 than it was a few years ago. 352 00:22:47,840 --> 00:22:49,380 So you can actually run 353 00:22:49,380 --> 00:22:51,140 a modern GCC on it 354 00:22:51,760 --> 00:22:52,460 which is great. 355 00:22:52,660 --> 00:22:55,960 No crappy proprietary compilers. 356 00:22:56,900 --> 00:22:59,580 The way the CANFLY uses the hardware 357 00:22:59,580 --> 00:23:02,220 is it exposes a Wi-Fi access point 358 00:23:02,220 --> 00:23:03,720 which you connect to 359 00:23:04,340 --> 00:23:05,400 and then you 360 00:23:05,400 --> 00:23:07,440 at the moment, the only protocol 361 00:23:07,900 --> 00:23:09,700 that supports is the Metasploit Hardware Bridge 362 00:23:09,700 --> 00:23:11,180 because that seemed like an interesting 363 00:23:11,180 --> 00:23:12,000 place to start. 364 00:23:13,720 --> 00:23:15,640 The Metasploit Hardware Bridge 365 00:23:15,640 --> 00:23:16,680 is fairly new. 366 00:23:17,580 --> 00:23:19,820 If you see Craig Smith around 367 00:23:19,820 --> 00:23:21,460 he's put a lot of work into it. 368 00:23:26,840 --> 00:23:29,320 Soon we're working on adding 369 00:23:29,900 --> 00:23:31,580 you're working on adding support 370 00:23:31,580 --> 00:23:33,840 for our existing tooling for CANCAT 371 00:23:33,840 --> 00:23:35,960 and I'm working on 372 00:23:35,960 --> 00:23:37,880 putting together a socket 373 00:23:37,900 --> 00:23:39,320 CAN adapter so you can use it 374 00:23:39,320 --> 00:23:40,800 with whatever socket CAN stuff 375 00:23:40,800 --> 00:23:41,760 in Linux you might want. 376 00:23:42,100 --> 00:23:44,600 But the main advantage of this 377 00:23:44,600 --> 00:23:46,220 is that it's really cheap. 378 00:23:46,660 --> 00:23:49,540 So being an IoT targeted module 379 00:23:49,540 --> 00:23:50,820 the ESP32 380 00:23:50,820 --> 00:23:52,980 you can buy it for $7.50 381 00:23:52,980 --> 00:23:54,460 from AliExpress 382 00:23:54,460 --> 00:23:57,680 or several other Chinese sites. 383 00:23:59,140 --> 00:24:01,000 And then all you need 384 00:24:01,000 --> 00:24:01,800 in addition to that 385 00:24:01,800 --> 00:24:03,440 is a CAN transceiver 386 00:24:03,440 --> 00:24:06,960 which you can find for as little as $1.50 387 00:24:07,900 --> 00:24:08,240 on the checkout board 388 00:24:08,240 --> 00:24:09,840 with all the bypass caps you need. 389 00:24:11,740 --> 00:24:13,700 So this is what the hardware looks like. 390 00:24:13,940 --> 00:24:15,820 It's not terribly impressive 391 00:24:15,820 --> 00:24:17,260 because it's really simple. 392 00:24:17,660 --> 00:24:19,220 All you have is the 393 00:24:19,900 --> 00:24:20,800 ESP32 module 394 00:24:21,980 --> 00:24:23,580 you've got the CAN transceiver 395 00:24:23,580 --> 00:24:25,000 hanging out in the middle of the screen 396 00:24:25,000 --> 00:24:27,760 and then I have it hooked up to an OBD2 397 00:24:27,760 --> 00:24:28,060 connector. 398 00:24:28,880 --> 00:24:31,040 The only other thing you need for this 399 00:24:31,040 --> 00:24:33,960 is a 5-volt power source. 400 00:24:34,340 --> 00:24:36,000 Do you have anything you wanted to say? 401 00:24:36,800 --> 00:24:37,800 You usually 402 00:24:37,900 --> 00:24:39,440 supplied over a micro USB cable 403 00:24:39,440 --> 00:24:41,920 on most of the ESP32 breakout boards. 404 00:24:42,240 --> 00:24:43,940 Yeah, for most of my testing 405 00:24:43,940 --> 00:24:45,240 so far I've just plugged it into 406 00:24:45,240 --> 00:24:46,900 a USB power bank and let it be. 407 00:24:47,360 --> 00:24:49,060 At some point in the near future 408 00:24:49,060 --> 00:24:50,000 we're going to put together 409 00:24:50,000 --> 00:24:52,560 probably a separate breakout board 410 00:24:52,560 --> 00:24:54,700 that you can plug it into 411 00:24:54,700 --> 00:24:56,320 and actually power it from your car. 412 00:24:57,520 --> 00:24:59,680 It's a really simple voltage regulator. 413 00:25:00,400 --> 00:25:01,760 So the demo 414 00:25:01,760 --> 00:25:02,920 is not particularly impressive 415 00:25:02,920 --> 00:25:04,260 because it's just a screencast 416 00:25:04,260 --> 00:25:06,420 of using Metasploit. 417 00:25:10,260 --> 00:25:12,120 I was originally going to try 418 00:25:12,120 --> 00:25:13,960 and put together a live demo 419 00:25:13,960 --> 00:25:15,580 on something in the car hacking village 420 00:25:15,580 --> 00:25:17,280 but I didn't want to risk 421 00:25:17,280 --> 00:25:18,440 Wi-Fi at DEF CON 422 00:25:18,440 --> 00:25:19,960 over that much distance. 423 00:25:20,180 --> 00:25:21,380 It's not a good idea. 424 00:25:21,960 --> 00:25:23,780 So here we just launched Metasploit. 425 00:25:24,340 --> 00:25:25,520 We're going to actually 426 00:25:25,520 --> 00:25:27,240 start using the Metasploit 427 00:25:27,240 --> 00:25:28,200 hardware bridge client. 428 00:25:28,860 --> 00:25:30,600 We'll configure it to connect 429 00:25:30,600 --> 00:25:33,100 to the 192.168.4.1 430 00:25:33,100 --> 00:25:35,720 router access point this is exposing. 431 00:25:36,280 --> 00:25:37,420 Set up the port 432 00:25:37,900 --> 00:25:39,700 connect with run 433 00:25:39,700 --> 00:25:41,360 and we have a session 434 00:25:41,820 --> 00:25:43,580 with the CAN fly. 435 00:25:45,180 --> 00:25:46,660 The CAN fly is exposing 436 00:25:46,660 --> 00:25:48,260 just one CAN bus at the moment. 437 00:25:48,480 --> 00:25:50,420 If we need two in the future 438 00:25:50,420 --> 00:25:51,300 we can probably attach 439 00:25:51,300 --> 00:25:52,460 something via SPI. 440 00:25:53,500 --> 00:25:54,700 Now I'm going to run 441 00:25:54,700 --> 00:25:58,040 one of the standard Metasploit 442 00:25:58,780 --> 00:26:00,380 hardware bridge payloads. 443 00:26:00,400 --> 00:26:01,380 This is just something 444 00:26:01,380 --> 00:26:02,560 that scrapes out a bunch of 445 00:26:02,560 --> 00:26:05,620 vehicle info over OBD2. 446 00:26:06,000 --> 00:26:07,780 So it lists all the bunch 447 00:26:07,900 --> 00:26:10,900 of OBD2 PIDs 448 00:26:10,900 --> 00:26:11,480 you can fetch 449 00:26:11,480 --> 00:26:13,420 via standard commands. 450 00:26:14,360 --> 00:26:15,920 It grabbed them. 451 00:26:16,120 --> 00:26:17,300 We got the VIN. 452 00:26:17,400 --> 00:26:19,840 We got the calibration ID 453 00:26:19,840 --> 00:26:20,980 which is one of the standard 454 00:26:20,980 --> 00:26:23,820 parameters on an OBD2 455 00:26:24,420 --> 00:26:25,500 diagnostic connection. 456 00:26:25,900 --> 00:26:27,260 And we have an ECU name. 457 00:26:27,620 --> 00:26:29,600 So this is all running on a 3PO 458 00:26:29,600 --> 00:26:31,640 our mobile car hacking lab. 459 00:26:31,920 --> 00:26:33,420 So some of it looks a little bit weird. 460 00:26:33,720 --> 00:26:35,600 Engine temp is negative 40 C. 461 00:26:35,740 --> 00:26:37,140 There's no engine. 462 00:26:37,900 --> 00:26:38,900 There's no engine temperature sensors. 463 00:26:39,420 --> 00:26:41,360 It looks a lot more normal 464 00:26:41,360 --> 00:26:43,820 on other things. 465 00:26:46,560 --> 00:26:49,000 The engine light being off 466 00:26:49,000 --> 00:26:49,780 is a little bit weird. 467 00:26:49,920 --> 00:26:51,140 I think I might have 468 00:26:51,140 --> 00:26:52,300 a few more bugs to fix. 469 00:26:53,460 --> 00:26:54,600 Being so new 470 00:26:54,600 --> 00:26:55,480 the Metasploit code 471 00:26:55,480 --> 00:26:57,440 is still a little rough. 472 00:26:57,720 --> 00:26:59,120 So I actually have my own 473 00:26:59,120 --> 00:27:00,260 branch right now. 474 00:27:00,500 --> 00:27:02,380 I need to get some fixes 475 00:27:02,380 --> 00:27:04,000 pushed upstream. 476 00:27:05,000 --> 00:27:06,200 But soon. 477 00:27:09,660 --> 00:27:11,560 So let me touch a little bit 478 00:27:11,560 --> 00:27:12,140 on what you need. 479 00:27:12,240 --> 00:27:13,700 But here's a slide with all of that. 480 00:27:13,800 --> 00:27:15,820 You need the ESP32 dev board. 481 00:27:16,040 --> 00:27:17,380 You need a CAN transceiver. 482 00:27:18,060 --> 00:27:19,400 This CAN transceiver 483 00:27:20,080 --> 00:27:21,420 actually if you can find it 484 00:27:21,420 --> 00:27:23,280 get the 232 not the 230. 485 00:27:23,540 --> 00:27:25,160 There's basically just one fewer pin 486 00:27:25,160 --> 00:27:26,160 you have to mess around with 487 00:27:26,160 --> 00:27:27,700 to get the 232 working. 488 00:27:29,480 --> 00:27:30,940 Just make sure if you do get 489 00:27:30,940 --> 00:27:31,780 a CAN transceiver 490 00:27:31,780 --> 00:27:35,720 the ESP32 is a 3.3 volt part 491 00:27:35,720 --> 00:27:37,880 and most CAN transceivers 492 00:27:37,900 --> 00:27:39,160 that I've seen are 5 volt parts. 493 00:27:39,340 --> 00:27:41,120 Just make sure that you get a 3.3 494 00:27:41,120 --> 00:27:43,080 If you just pick up a random CAN transceiver 495 00:27:43,080 --> 00:27:44,280 it's probably going to be a 5 volt part. 496 00:27:44,360 --> 00:27:47,060 So make sure you get a 3.3 volt transceiver. 497 00:27:47,400 --> 00:27:48,900 You need a 5 volt power source 498 00:27:50,140 --> 00:27:51,260 There's usually a voltage regulator 499 00:27:51,260 --> 00:27:53,340 on the ESP32 dev board 500 00:27:53,340 --> 00:27:54,920 to step down from 5 to 3 volts 501 00:27:54,920 --> 00:27:55,680 to power the micro. 502 00:27:56,960 --> 00:27:59,080 Wire and possibly a soldering iron. 503 00:28:01,740 --> 00:28:03,660 And the total cost of all this 504 00:28:03,660 --> 00:28:05,460 assuming you already have a soldering iron 505 00:28:05,460 --> 00:28:07,300 on a power source is less than 10 bucks. 506 00:28:10,340 --> 00:28:12,060 So the firmware for this 507 00:28:12,060 --> 00:28:14,720 uses an IOT framework 508 00:28:14,720 --> 00:28:15,920 called Mongoose OS 509 00:28:17,040 --> 00:28:18,460 It's absolutely miserable 510 00:28:18,460 --> 00:28:19,700 from a security perspective 511 00:28:19,700 --> 00:28:21,940 so when you spin it up 512 00:28:22,700 --> 00:28:23,980 don't run a port scan 513 00:28:23,980 --> 00:28:25,240 like it's terrifying 514 00:28:25,240 --> 00:28:26,520 how many ports it has on there. 515 00:28:26,520 --> 00:28:26,880 Yeah don't do that. 516 00:28:27,280 --> 00:28:28,460 It also crashes. 517 00:28:28,760 --> 00:28:29,700 Yeah it does. 518 00:28:30,840 --> 00:28:33,080 You actually compile the source 519 00:28:33,080 --> 00:28:34,100 at the moment by 520 00:28:34,940 --> 00:28:37,220 it's like compilation as a service 521 00:28:37,900 --> 00:28:38,920 I think their goal was to 522 00:28:40,180 --> 00:28:41,780 enable people to 523 00:28:42,760 --> 00:28:43,740 compile firmware 524 00:28:43,740 --> 00:28:45,240 without downloading a toolchain 525 00:28:45,860 --> 00:28:47,920 so you post your source code 526 00:28:47,920 --> 00:28:48,640 to the cloud 527 00:28:48,640 --> 00:28:50,080 and it gives you a zip back 528 00:28:50,080 --> 00:28:52,360 we're going to be rewriting this soon 529 00:28:52,360 --> 00:28:53,600 so it doesn't use this firmware 530 00:28:54,360 --> 00:28:55,400 it's not good 531 00:28:55,400 --> 00:28:57,180 but it is simple 532 00:28:57,180 --> 00:29:00,500 so the entire firmware runs 250 lines of C 533 00:29:02,020 --> 00:29:03,620 it's pretty straight forward 534 00:29:03,620 --> 00:29:04,480 as C goes 535 00:29:04,480 --> 00:29:07,480 I wrote most of the query string 536 00:29:07,900 --> 00:29:09,960 code at 3am without beer 537 00:29:09,960 --> 00:29:11,780 so it's probably not 538 00:29:12,480 --> 00:29:14,440 it's anything but bullet proof 539 00:29:14,440 --> 00:29:15,180 but it works 540 00:29:15,180 --> 00:29:16,240 it works 541 00:29:17,640 --> 00:29:20,360 as soon as we get some time 542 00:29:20,360 --> 00:29:21,560 this will be rewritten 543 00:29:21,560 --> 00:29:23,240 to not depend on the cloud 544 00:29:27,700 --> 00:29:30,320 looks like we are significantly earlier 545 00:29:30,320 --> 00:29:31,360 than I thought we would be 546 00:29:32,220 --> 00:29:34,080 Does anyone have questions? 547 00:29:34,480 --> 00:29:35,660 Yeah what about 548 00:29:35,660 --> 00:29:37,180 other software 549 00:29:37,900 --> 00:29:39,360 stuff that's out there 550 00:29:39,360 --> 00:29:41,340 that's cheaper than the car spy 551 00:29:41,670 --> 00:29:41,960 software 552 00:29:41,960 --> 00:29:43,900 that does the same thing 553 00:29:45,620 --> 00:29:47,080 build loops of 554 00:29:47,080 --> 00:29:49,380 so like the 555 00:29:50,000 --> 00:29:50,840 vehicle spy 556 00:29:50,840 --> 00:29:55,700 I don't do a whole lot with GUIs 557 00:29:55,700 --> 00:29:57,400 but there are a few 558 00:29:57,400 --> 00:29:59,160 open source projects 559 00:29:59,800 --> 00:30:00,860 working on that 560 00:30:03,240 --> 00:30:05,300 do you remember any of the names 561 00:30:05,730 --> 00:30:06,860 Savvy can is a good one 562 00:30:07,900 --> 00:30:08,640 this is the one I was thinking of 563 00:30:08,640 --> 00:30:10,880 pick up Craig Smith's car hackers handbook 564 00:30:10,880 --> 00:30:12,260 seriously for real 565 00:30:12,260 --> 00:30:14,860 I need to start getting a commission from him 566 00:30:14,860 --> 00:30:15,920 because it's an awesome book 567 00:30:18,220 --> 00:30:20,480 Have you guys looked at any of the 568 00:30:22,260 --> 00:30:23,140 monitoring products 569 00:30:23,140 --> 00:30:24,540 like Verizon or Progressive 570 00:30:24,540 --> 00:30:26,120 putting into their cars 571 00:30:26,120 --> 00:30:27,180 saying oh we can make sure 572 00:30:27,180 --> 00:30:28,280 we'll prove you're a safe driver 573 00:30:28,280 --> 00:30:30,060 but they're putting these products in there 574 00:30:30,060 --> 00:30:31,320 and I'm going to go out on a limb 575 00:30:31,320 --> 00:30:32,640 and guess they have not been fully vetted 576 00:30:32,640 --> 00:30:33,360 as far as security 577 00:30:38,700 --> 00:30:40,100 so if you stay here 578 00:30:40,100 --> 00:30:41,820 Corey Thune is giving the next talk 579 00:30:41,820 --> 00:30:43,300 he's the guy who did the Progressive 580 00:30:43,300 --> 00:30:45,480 dongle hack 3-4 years ago 581 00:30:47,060 --> 00:30:47,860 so yes 582 00:30:47,860 --> 00:30:48,520 these things are 583 00:30:49,940 --> 00:30:50,340 not 584 00:30:50,340 --> 00:30:52,900 my insurance company offers them 585 00:30:52,900 --> 00:30:54,160 and my car does not have one 586 00:30:54,160 --> 00:30:54,800 I'll put it that way 587 00:30:56,260 --> 00:30:59,060 you can shut down cars 588 00:30:59,060 --> 00:31:00,320 with those things installed 589 00:31:00,320 --> 00:31:01,780 and you can get on the CAN bus 590 00:31:01,780 --> 00:31:02,480 which on the CAN bus 591 00:31:02,480 --> 00:31:03,660 you can do whatever you want to do 592 00:31:07,900 --> 00:31:09,440 Are they only targeting at OBD2 593 00:31:09,440 --> 00:31:11,000 or OCS? 594 00:31:12,620 --> 00:31:13,740 Whatever CAN 595 00:31:13,740 --> 00:31:14,900 you want to run it on 596 00:31:14,900 --> 00:31:17,700 so I've been connecting it 597 00:31:17,700 --> 00:31:19,460 to the OBD2 port 598 00:31:19,460 --> 00:31:20,780 out of convenience 599 00:31:22,020 --> 00:31:23,700 if you have like 600 00:31:23,700 --> 00:31:25,560 some under hood CAN line 601 00:31:25,560 --> 00:31:27,180 or something that you want to connect to 602 00:31:27,180 --> 00:31:27,980 it would work for that too 603 00:31:28,740 --> 00:31:30,360 Elevators often run CAN 604 00:31:31,440 --> 00:31:32,800 whatever you can tap into 605 00:31:37,900 --> 00:31:38,820 Do you guys have any experience 606 00:31:38,820 --> 00:31:39,940 with J2534? 607 00:31:42,620 --> 00:31:43,680 I've used it 608 00:31:43,680 --> 00:31:45,560 I'm a bit familiar with it 609 00:31:45,560 --> 00:31:47,360 it's just a windows 610 00:31:47,360 --> 00:31:49,680 API pass through layer to get on 611 00:31:49,680 --> 00:31:51,500 whatever bus you're using to flash 612 00:31:51,500 --> 00:31:52,040 which 613 00:31:53,120 --> 00:31:55,720 in modern vehicles is almost always going to be CAN 614 00:32:02,140 --> 00:32:03,560 So you mentioned 615 00:32:04,560 --> 00:32:05,740 CAN is an old 616 00:32:05,740 --> 00:32:06,000 protocol 617 00:32:07,900 --> 00:32:08,960 that's going to be phased out eventually 618 00:32:08,960 --> 00:32:10,360 We hope 619 00:32:10,360 --> 00:32:10,920 We only hope 620 00:32:10,920 --> 00:32:14,460 So that's what I want more information on 621 00:32:14,460 --> 00:32:16,560 what's the next step 622 00:32:17,300 --> 00:32:18,160 what's going to 623 00:32:18,160 --> 00:32:19,660 sunset CAN 624 00:32:20,780 --> 00:32:21,880 what's that going to take? 625 00:32:22,160 --> 00:32:24,020 For higher speed stuff 626 00:32:24,020 --> 00:32:26,080 or latency critical stuff 627 00:32:26,080 --> 00:32:28,440 automotive ethernet is starting to get rolled out 628 00:32:28,440 --> 00:32:31,240 it's actually kind of an interesting physical layer 629 00:32:31,240 --> 00:32:32,480 because it still uses two 630 00:32:32,480 --> 00:32:33,740 wire pairs 631 00:32:33,740 --> 00:32:35,500 but it runs at 632 00:32:37,900 --> 00:32:39,400 gigabit speeds over it 633 00:32:39,400 --> 00:32:40,980 it has 634 00:32:40,980 --> 00:32:43,300 it's noise robust enough 635 00:32:43,300 --> 00:32:44,720 that it actually works in cars 636 00:32:44,720 --> 00:32:47,740 and you get all the benefits 637 00:32:47,740 --> 00:32:49,940 of a ethernet 638 00:32:49,940 --> 00:32:50,340 system 639 00:32:52,160 --> 00:32:54,020 The car hacking 640 00:32:54,020 --> 00:32:55,600 village badges actually have a 641 00:32:55,600 --> 00:32:56,940 TGA 1100 642 00:32:57,840 --> 00:32:59,620 automotive ethernet transceiver 643 00:32:59,620 --> 00:32:59,980 on them 644 00:33:01,860 --> 00:33:03,720 It's interesting because it's 645 00:33:03,720 --> 00:33:04,780 purely point to point 646 00:33:05,840 --> 00:33:07,880 much like gigabit ethernet 647 00:33:07,900 --> 00:33:09,980 there's no way to passively 648 00:33:09,980 --> 00:33:10,920 tap it in the middle 649 00:33:10,920 --> 00:33:13,180 so you actually need to 650 00:33:15,540 --> 00:33:17,120 to explain why 651 00:33:17,740 --> 00:33:19,400 the way the 652 00:33:19,400 --> 00:33:21,260 it's a full duplex protocol 653 00:33:21,260 --> 00:33:23,700 you can talk and listen at the same time 654 00:33:23,700 --> 00:33:25,280 and the way that works 655 00:33:25,280 --> 00:33:27,580 this gross oversimplification 656 00:33:27,580 --> 00:33:29,560 you send messages 657 00:33:29,560 --> 00:33:32,000 and you subtract whatever you're sending 658 00:33:32,000 --> 00:33:33,840 from what you see on the bus 659 00:33:34,960 --> 00:33:35,600 so 660 00:33:35,600 --> 00:33:36,420 you 661 00:33:37,900 --> 00:33:39,000 if you try and 662 00:33:39,000 --> 00:33:40,260 tap it in the middle 663 00:33:40,260 --> 00:33:42,780 you can't tell what's being sent 664 00:33:42,780 --> 00:33:44,640 because either side might have 665 00:33:44,640 --> 00:33:45,640 sent that energy 666 00:33:45,640 --> 00:33:48,720 so you have a lot more security 667 00:33:48,720 --> 00:33:49,920 in that sense 668 00:33:52,560 --> 00:33:53,500 there's no 669 00:33:53,500 --> 00:33:54,680 question 670 00:33:54,680 --> 00:33:57,200 what node something came from 671 00:34:00,320 --> 00:34:01,020 yeah 672 00:34:08,300 --> 00:34:10,300 So CAN FD is a protocol 673 00:34:10,300 --> 00:34:10,800 which is 674 00:34:10,800 --> 00:34:13,160 it was finally actually finished 675 00:34:13,760 --> 00:34:15,500 standardization this year 676 00:34:15,500 --> 00:34:16,160 I think 677 00:34:17,980 --> 00:34:20,260 it's much like CAN 678 00:34:20,260 --> 00:34:21,860 it's somewhat 679 00:34:21,860 --> 00:34:24,060 compatible with traditional CAN 680 00:34:24,060 --> 00:34:25,720 devices on the same bus 681 00:34:25,720 --> 00:34:28,400 it expands the data payload 682 00:34:28,400 --> 00:34:30,100 to 64 bytes 683 00:34:30,100 --> 00:34:31,220 instead of 8 684 00:34:31,800 --> 00:34:34,020 so you can fit a lot more 685 00:34:34,020 --> 00:34:34,860 in a message 686 00:34:35,660 --> 00:34:37,260 and it's also 8 times faster 687 00:34:37,900 --> 00:34:38,280 to send the same number 688 00:34:38,280 --> 00:34:39,240 of messages through 689 00:34:39,240 --> 00:34:41,220 And also FlexRay 690 00:34:41,220 --> 00:34:43,620 FlexRay is something 691 00:34:43,620 --> 00:34:45,860 I actually haven't worked with a whole lot 692 00:34:45,860 --> 00:34:48,420 but it's a bus designed for 693 00:34:48,420 --> 00:34:49,680 time critical communications 694 00:34:49,680 --> 00:34:52,720 it uses a bunch of complicated 695 00:34:52,720 --> 00:34:54,500 time slot management techniques 696 00:34:54,500 --> 00:34:57,160 so there's actually like a synchronous 697 00:34:57,160 --> 00:34:57,880 clock 698 00:34:57,880 --> 00:34:59,980 and each module on the bus 699 00:34:59,980 --> 00:35:02,020 gets a slot within the bus 700 00:35:02,020 --> 00:35:02,800 to talk 701 00:35:04,440 --> 00:35:05,200 yeah 702 00:35:09,800 --> 00:35:10,640 Anybody else? 703 00:35:14,160 --> 00:35:14,720 Cool 704 00:35:14,720 --> 00:35:15,220 Alright 705 00:35:15,220 --> 00:35:16,020 Thank you very much