1 00:00:00,000 --> 00:00:04,680 This is going to be stopping SDR relay and replay attacks and on 2 00:00:04,680 --> 00:00:08,020 passive key entry systems. So who in here has heard of these or 3 00:00:08,020 --> 00:00:11,740 seen them in the news? Yeah. Who in here is one of the fancy 4 00:00:11,740 --> 00:00:15,480 push button start cards? Yeah. Makes it even more that more 5 00:00:15,480 --> 00:00:17,800 interesting. So this is something where I'm going to go 6 00:00:17,800 --> 00:00:21,620 over a little cool device that I built after I did a relay attack 7 00:00:21,620 --> 00:00:25,800 it was two years ago when I got my original Edison 210 so I'll 8 00:00:25,800 --> 00:00:28,660 go into a little bit of that. A little bit about myself, 32 I 9 00:00:28,660 --> 00:00:32,440 work for NCR and I live in North Dakota. I've spoken this is my 10 00:00:32,440 --> 00:00:35,800 fourth year at DEF CON speaking black hat last year. Speak at a 11 00:00:35,800 --> 00:00:40,320 lot of ICS security conventions things like that so and I've been 12 00:00:40,320 --> 00:00:43,400 doing pen testing this is my 13th year professionally and I've 13 00:00:43,400 --> 00:00:45,980 been doing programming for about as long and I've just gotten 14 00:00:45,980 --> 00:00:49,540 into a lot of research anything radio or car related has been 15 00:00:49,540 --> 00:00:53,580 kind of my focus on the last year and I did a lot of attacks 16 00:00:53,580 --> 00:00:58,240 on ATMs and point of sale systems last year so and reverse 17 00:00:58,240 --> 00:00:58,640 engineering. So I've been working for NCR and I've been 18 00:00:58,660 --> 00:01:01,580 doing malware is one of my remaining hobbies and that's one 19 00:01:01,580 --> 00:01:03,360 of my original hobbies that's how I got into reversing is 20 00:01:03,360 --> 00:01:06,640 actually tearing apart the Chernobyl or CIH virus was the 21 00:01:06,640 --> 00:01:09,440 one that reversed your bios if anybody remembers that one was 22 00:01:09,440 --> 00:01:14,100 several years ago but yeah it's a very good time and yeah so 23 00:01:14,100 --> 00:01:17,780 yeah I'm going to do the car heckin' village here. So this 24 00:01:17,780 --> 00:01:21,520 presentation a little bit about the research. So last year about 25 00:01:21,520 --> 00:01:25,640 two years ago actually I looked into an amplification attack that 26 00:01:25,640 --> 00:01:28,640 some people in I believe it was the R.I.F.D.H. saw that this was 27 00:01:28,640 --> 00:01:30,500 in another country in Europe. 28 00:01:30,840 --> 00:01:31,980 I need to sleep more, obviously, 29 00:01:32,080 --> 00:01:33,500 but yeah, they're definitely... 30 00:01:34,300 --> 00:01:36,080 They did an amplification attack, 31 00:01:36,180 --> 00:01:37,340 so they basically boosted the frequency 32 00:01:37,340 --> 00:01:39,800 and were able to send it a certain amount of distance. 33 00:01:40,780 --> 00:01:45,360 And last year, I received three Edis U210s 34 00:01:46,320 --> 00:01:49,040 and one N210, which is the one on the right there. 35 00:01:49,600 --> 00:01:51,640 And so I had four software-defined radios, 36 00:01:51,640 --> 00:01:54,180 and I was like, what's the worst that could happen? 37 00:01:55,000 --> 00:01:57,780 And I was actually looking at immobilizer bypasses 38 00:01:57,780 --> 00:01:59,560 and older dealership tools. 39 00:02:00,000 --> 00:02:00,840 I was getting into... 40 00:02:00,840 --> 00:02:02,220 So I've been doing car hacking for about... 41 00:02:02,800 --> 00:02:03,780 This will be my third year, 42 00:02:03,920 --> 00:02:05,980 so it is something where people can pick it up 43 00:02:05,980 --> 00:02:06,500 really, really quick, 44 00:02:06,600 --> 00:02:07,400 especially with some of the stuff 45 00:02:07,400 --> 00:02:08,240 that you can Google nowadays, 46 00:02:08,540 --> 00:02:09,960 a lot of the kits that are out there. 47 00:02:10,180 --> 00:02:11,980 It's just the price to enter point 48 00:02:11,980 --> 00:02:14,780 has gotten a lot cheaper compared to what it was. 49 00:02:15,860 --> 00:02:17,440 And yeah, this is an actual pile 50 00:02:17,440 --> 00:02:20,400 of 433 and 315 megahertz radios, 51 00:02:20,460 --> 00:02:22,760 so I'll actually be going into how to build the device. 52 00:02:22,900 --> 00:02:24,440 I have a demo lab on Sunday, 53 00:02:24,560 --> 00:02:26,920 so if you guys want to come and see how to build the device, 54 00:02:27,020 --> 00:02:27,660 then I can go into it. 55 00:02:27,780 --> 00:02:29,620 A lot more detail once I hear back 56 00:02:29,620 --> 00:02:33,380 from Ford on the actual TPMS sensor also. 57 00:02:33,640 --> 00:02:38,000 So there was a Swiss amplification attack. 58 00:02:38,220 --> 00:02:39,320 There was a couple researchers, 59 00:02:40,040 --> 00:02:42,380 and they actually did the... 60 00:02:42,880 --> 00:02:44,860 There was several changes that actually went into 61 00:02:44,860 --> 00:02:46,180 a lot of the automobiles at that point. 62 00:02:46,460 --> 00:02:48,040 And from 2011 on, 63 00:02:48,200 --> 00:02:49,860 they started putting multiple sensors. 64 00:02:50,020 --> 00:02:53,100 They started dealing with actual delays 65 00:02:53,100 --> 00:02:54,540 and tracking a lot of that. 66 00:02:54,580 --> 00:02:55,540 There was a huge window. 67 00:02:55,600 --> 00:02:56,480 It was literally... 68 00:02:57,780 --> 00:02:59,580 A third of a second for some of the original stuff. 69 00:02:59,680 --> 00:03:01,020 Now it's down to about a tenth of a second 70 00:03:01,020 --> 00:03:03,380 where you can actually relay the actual signal. 71 00:03:04,000 --> 00:03:05,480 And does everybody in here kind of understand 72 00:03:05,480 --> 00:03:07,860 the concept behind how the relay attack works 73 00:03:08,240 --> 00:03:08,940 for the most part? 74 00:03:09,080 --> 00:03:09,180 Okay. 75 00:03:09,440 --> 00:03:11,860 Yeah, this is actual passive key entry systems. 76 00:03:12,020 --> 00:03:16,120 I did a lot of research also around 2014 on passive keys. 77 00:03:16,280 --> 00:03:17,340 So that's when I started looking at 78 00:03:17,340 --> 00:03:19,340 what they're actually speaking, 79 00:03:19,520 --> 00:03:20,240 what ranges they are. 80 00:03:20,440 --> 00:03:22,400 I looked into stolen vehicle slowdowns. 81 00:03:23,020 --> 00:03:26,360 I also had a DARPA contract and DHS contract with... 82 00:03:27,320 --> 00:03:27,680 They're... 83 00:03:27,780 --> 00:03:29,820 Attacks on PSAPs and E901 centers. 84 00:03:29,960 --> 00:03:32,260 So I started looking at some of the automotive... 85 00:03:33,440 --> 00:03:35,760 Automatic notification for crash detections. 86 00:03:35,820 --> 00:03:36,760 So if airbags were deployed, 87 00:03:36,960 --> 00:03:37,720 if vehicles rolled over. 88 00:03:37,920 --> 00:03:39,540 Because that is something that these messages 89 00:03:39,540 --> 00:03:41,740 might be able to be flooded into a call center 90 00:03:41,740 --> 00:03:42,280 and stuff like that. 91 00:03:42,400 --> 00:03:44,180 So it's something where that came across 92 00:03:44,180 --> 00:03:45,560 as a lot of our stuff. 93 00:03:45,760 --> 00:03:47,500 So yeah, it's pretty interesting research. 94 00:03:47,640 --> 00:03:50,680 And I will definitely be going into 95 00:03:50,680 --> 00:03:53,660 a lot of the actual passive key attacks that we have here. 96 00:03:53,780 --> 00:03:55,500 So 2015, I submitted a... 97 00:03:56,580 --> 00:03:56,980 Or... 98 00:03:56,980 --> 00:04:00,240 Actually did the DSP for samples up to 700 megahertz. 99 00:04:00,340 --> 00:04:02,800 So the only keys that I wasn't able to do at that time 100 00:04:02,800 --> 00:04:03,920 were BMW and Ford 101 00:04:03,920 --> 00:04:06,080 because they are a higher spectrum than that. 102 00:04:06,260 --> 00:04:07,220 And that was just... 103 00:04:08,220 --> 00:04:08,620 Yeah. 104 00:04:08,740 --> 00:04:10,240 So I used the actual DSP that I built, 105 00:04:10,300 --> 00:04:12,420 which is digital cycle processor built off of an FPGA. 106 00:04:12,620 --> 00:04:13,940 And if you guys haven't played around with those, 107 00:04:14,100 --> 00:04:15,400 the entry points for those are very cheap. 108 00:04:15,460 --> 00:04:16,700 They're about $60 to $70. 109 00:04:16,920 --> 00:04:17,760 And you can... 110 00:04:18,180 --> 00:04:19,000 Yeah, you can make... 111 00:04:19,000 --> 00:04:21,060 You can speed anything up that you need to do. 112 00:04:21,160 --> 00:04:22,400 It's very, very cool systems. 113 00:04:22,440 --> 00:04:24,260 And I would definitely recommend people getting into them. 114 00:04:24,380 --> 00:04:24,680 So... 115 00:04:24,680 --> 00:04:26,240 And there was a Beijing-based firm 116 00:04:27,300 --> 00:04:29,060 So my setup that I'm going to go into 117 00:04:29,060 --> 00:04:30,380 costs about $5,700. 118 00:04:30,780 --> 00:04:33,260 Everybody has, you know, extra $5,700 laying around, right? 119 00:04:33,500 --> 00:04:33,760 So... 120 00:04:34,260 --> 00:04:35,540 Yeah, but the actual Beijing company, 121 00:04:35,640 --> 00:04:37,540 they got it down to $22, which is unbelievable. 122 00:04:38,540 --> 00:04:39,940 So that's when it becomes... 123 00:04:39,940 --> 00:04:40,860 Anybody can do it. 124 00:04:40,920 --> 00:04:41,880 So it's something where... 125 00:04:41,880 --> 00:04:43,000 That's when it becomes scary. 126 00:04:43,180 --> 00:04:44,680 And that's when people will start talking about it. 127 00:04:44,700 --> 00:04:47,260 Press Wired did a very good write-up on it. 128 00:04:47,380 --> 00:04:48,420 They actually did a very good job 129 00:04:48,420 --> 00:04:49,600 with their talk and their slides 130 00:04:49,600 --> 00:04:50,960 if you guys are interested in their device 131 00:04:50,960 --> 00:04:52,440 and how it actually works. 132 00:04:53,140 --> 00:04:54,620 And what I'm going to basically go over 133 00:04:54,620 --> 00:04:56,780 is the actual hijack two-factor. 134 00:04:56,820 --> 00:04:56,960 I think it's called hijack two-factor. 135 00:04:56,980 --> 00:04:58,540 So who would like to have... 136 00:04:58,540 --> 00:04:59,720 Who has two-factor authentication 137 00:04:59,720 --> 00:05:01,380 on at least one of their electronic products? 138 00:05:02,000 --> 00:05:02,360 Yeah. 139 00:05:03,060 --> 00:05:04,320 How would you like to add it to your car? 140 00:05:05,220 --> 00:05:06,460 How would you like to use, like, 141 00:05:06,460 --> 00:05:08,000 a 1356 ring you have? 142 00:05:08,140 --> 00:05:09,700 Or some people are putting implants in. 143 00:05:10,060 --> 00:05:11,220 There's lots of things that you can do 144 00:05:11,220 --> 00:05:12,580 for your second form of verification. 145 00:05:15,320 --> 00:05:15,780 And, yeah. 146 00:05:15,880 --> 00:05:17,000 And how is this used? 147 00:05:17,220 --> 00:05:18,260 The passive key entry starts. 148 00:05:18,360 --> 00:05:20,100 The vehicle allows the driver 149 00:05:20,100 --> 00:05:21,820 to actually lock the vehicle doors 150 00:05:21,820 --> 00:05:22,720 without touching the key. 151 00:05:22,860 --> 00:05:23,800 So when you get into proximity, 152 00:05:24,040 --> 00:05:25,960 there's sensors in the roofs in most of them 153 00:05:25,960 --> 00:05:26,900 where it'll sense, 154 00:05:26,980 --> 00:05:27,520 where you are at, 155 00:05:27,600 --> 00:05:28,300 adjacent to the vehicle. 156 00:05:28,480 --> 00:05:29,400 So if you're in the back of the vehicle, 157 00:05:29,500 --> 00:05:30,180 you can't start it. 158 00:05:30,280 --> 00:05:31,740 If you're at the front of the vehicle, 159 00:05:31,800 --> 00:05:32,420 you can open the door. 160 00:05:32,500 --> 00:05:33,480 You can possibly start it. 161 00:05:33,920 --> 00:05:36,020 So these are remote key entry systems 162 00:05:36,020 --> 00:05:38,160 and the actual remote keyless ignitions. 163 00:05:38,780 --> 00:05:40,140 So the main frequencies for these, 164 00:05:40,260 --> 00:05:41,900 for as far as the U.S. goes at least, 165 00:05:42,000 --> 00:05:43,680 you're in most likely one of these ranges, 166 00:05:44,640 --> 00:05:47,480 314.9 to 315 or 433 megahertz. 167 00:05:47,740 --> 00:05:49,260 And then the 125 kilohertz 168 00:05:49,260 --> 00:05:50,800 is usually what the key is speaking 169 00:05:50,800 --> 00:05:52,360 for its low interrogation signal. 170 00:05:52,500 --> 00:05:53,700 So it doesn't have a lot of range. 171 00:05:54,140 --> 00:05:55,480 But it's basically going to... 172 00:05:55,480 --> 00:05:56,460 You have a key in your pocket. 173 00:05:56,460 --> 00:05:58,280 It's going to send out the 125 kilohertz 174 00:05:58,280 --> 00:06:01,340 and your vehicle is going to send back 433 or 315 175 00:06:01,340 --> 00:06:04,100 depending on what the actual make and model of it is. 176 00:06:05,240 --> 00:06:05,820 So yeah. 177 00:06:05,960 --> 00:06:07,340 And let's see here. 178 00:06:07,500 --> 00:06:10,220 Yeah, so the actual key that I was able to do 179 00:06:10,220 --> 00:06:11,560 some of the relay attacks on it 180 00:06:11,560 --> 00:06:12,540 was at 433 megahertz. 181 00:06:12,720 --> 00:06:18,380 And also I submitted all these to the actual Cadillac 182 00:06:18,380 --> 00:06:19,320 and Chevy have, 183 00:06:19,460 --> 00:06:21,540 or General Motors has an actual bug bounty program. 184 00:06:21,880 --> 00:06:23,420 And they informed me that they already knew 185 00:06:23,420 --> 00:06:24,380 about the amplification attacks. 186 00:06:24,880 --> 00:06:25,820 And I actually took a look 187 00:06:25,820 --> 00:06:26,440 at a lot of their systems. 188 00:06:26,440 --> 00:06:29,660 And they are definitely stepping up their systems. 189 00:06:29,780 --> 00:06:32,220 And then most of it was fixed by a lot of software patches. 190 00:06:32,380 --> 00:06:34,240 It's just a lot of the second-hand vehicles 191 00:06:34,240 --> 00:06:35,200 in some cases didn't get it. 192 00:06:35,320 --> 00:06:36,700 So it's definitely interesting. 193 00:06:37,040 --> 00:06:39,000 And so those were the two that I actually was working on. 194 00:06:39,400 --> 00:06:41,640 Because they were in the 433 to 315 range, 195 00:06:41,840 --> 00:06:44,640 which was within my sample range of the DSP that I built. 196 00:06:44,920 --> 00:06:46,600 So, and let's see. 197 00:06:46,840 --> 00:06:47,760 Updated in most vehicles. 198 00:06:48,320 --> 00:06:49,600 Yeah, like they have multi-roof sensors. 199 00:06:50,020 --> 00:06:51,160 Fiat Chrysler is an amazing company. 200 00:06:51,300 --> 00:06:53,600 They're very open about talking to people 201 00:06:53,600 --> 00:06:54,440 in the security community. 202 00:06:54,640 --> 00:06:56,260 They had some Jeep issues. 203 00:06:56,260 --> 00:06:57,160 Several years back. 204 00:06:57,340 --> 00:06:58,840 And they've been very, very good to the community. 205 00:06:59,060 --> 00:07:00,060 And they talk to people. 206 00:07:00,160 --> 00:07:02,000 They're very good at reaching out 207 00:07:02,000 --> 00:07:03,320 and actually taking care of the issues. 208 00:07:03,600 --> 00:07:04,720 So, yeah. 209 00:07:04,820 --> 00:07:05,820 So basically when you walk in the range, 210 00:07:05,900 --> 00:07:06,620 you're detected by the door. 211 00:07:06,660 --> 00:07:07,200 The car opens. 212 00:07:08,000 --> 00:07:09,340 You're sitting near the passenger door. 213 00:07:09,520 --> 00:07:10,260 The car won't start. 214 00:07:10,520 --> 00:07:13,080 That was one of the issues that I'm, 215 00:07:13,080 --> 00:07:15,040 I'm actually in my demo lab on Sunday. 216 00:07:15,120 --> 00:07:16,780 I will go into a little bit of how you can do some of the, 217 00:07:16,880 --> 00:07:18,600 it's basically beam forming. 218 00:07:18,780 --> 00:07:20,640 Or you can make your beacons appear 219 00:07:20,640 --> 00:07:22,740 as if they're coming from somewhere else inside the vehicle. 220 00:07:22,980 --> 00:07:25,340 Or you can actually roll through six foot, 221 00:07:25,440 --> 00:07:26,240 about a six foot, 222 00:07:26,260 --> 00:07:26,360 about a six foot radius. 223 00:07:26,720 --> 00:07:28,020 You can actually change it. 224 00:07:28,120 --> 00:07:30,560 And that was something that I also used 225 00:07:30,560 --> 00:07:33,280 for some of the 802.11 attacks that I did yesterday. 226 00:07:33,540 --> 00:07:35,580 So, and yeah. 227 00:07:35,620 --> 00:07:38,860 2015 was about, I said about a $5,400 set up. 228 00:07:39,800 --> 00:07:42,400 And 2016, it's, you know, 229 00:07:42,420 --> 00:07:46,140 now I can probably get around the same set up for about, 230 00:07:46,180 --> 00:07:47,900 I would say about $1,200 to $1,300. 231 00:07:48,900 --> 00:07:51,920 And 2017 set up is about $300 to $22. 232 00:07:52,220 --> 00:07:54,840 So actual ones, the attack surface 233 00:07:54,840 --> 00:07:55,900 is getting very, very cheap. 234 00:07:55,900 --> 00:07:58,520 And that's where, some of these have been used in the wild. 235 00:07:58,780 --> 00:08:00,720 There's lots of, you know, people, 236 00:08:00,840 --> 00:08:02,160 when it becomes in that $22 range, 237 00:08:02,300 --> 00:08:03,080 everybody can afford it. 238 00:08:03,240 --> 00:08:04,840 And it's, especially when plans are leaked 239 00:08:04,840 --> 00:08:05,940 or they're out there, so. 240 00:08:07,640 --> 00:08:09,140 Yeah, so how did I start this research? 241 00:08:09,360 --> 00:08:11,660 I admired my neighbor's black Durango. 242 00:08:12,760 --> 00:08:14,280 And I went over to my neighbor 243 00:08:14,280 --> 00:08:16,460 and asked to borrow her Durango. 244 00:08:16,640 --> 00:08:19,220 I ran a wire from my driveway over to the Durango. 245 00:08:19,860 --> 00:08:22,340 And yeah, basically explained to her 246 00:08:22,340 --> 00:08:24,140 that I was gonna see if I could drive around 247 00:08:24,140 --> 00:08:24,800 without the key in it. 248 00:08:26,040 --> 00:08:28,360 And basically, you'll get glares for the rest of your life 249 00:08:28,360 --> 00:08:30,640 when you mow your lawn after you've done stuff like this. 250 00:08:30,760 --> 00:08:32,040 So it's better to just go out and rent it 251 00:08:32,040 --> 00:08:33,340 or have a family member or, 252 00:08:33,400 --> 00:08:36,820 like I had a friend who had another vehicle 253 00:08:36,820 --> 00:08:38,540 that would have been susceptible to it, so. 254 00:08:39,200 --> 00:08:41,100 But yeah, here's a little bit of the explanation of it. 255 00:08:41,260 --> 00:08:43,280 So you have a software-defined radio on one side. 256 00:08:43,540 --> 00:08:45,740 And this is the very expensive version of it. 257 00:08:45,820 --> 00:08:47,740 So basically, there was my driveway. 258 00:08:47,960 --> 00:08:49,340 I had an Edison 210 on that side, 259 00:08:49,420 --> 00:08:50,380 an Edison 210 on this side. 260 00:08:50,720 --> 00:08:54,300 I tried using the USB versions at that time 261 00:08:54,720 --> 00:08:55,560 when I was doing that. 262 00:08:55,560 --> 00:08:57,920 My USB 3.0 ports couldn't keep up with it. 263 00:08:57,980 --> 00:08:58,940 So I did a lot of troubleshooting 264 00:08:58,940 --> 00:09:01,460 and wasted a lot of time getting it to work 265 00:09:01,460 --> 00:09:03,220 when I should have just went with the network versions of it. 266 00:09:03,540 --> 00:09:06,260 So ran a cable, did a cabled test first. 267 00:09:06,980 --> 00:09:08,480 And here's the actual setup on the bottom. 268 00:09:08,620 --> 00:09:11,720 So I had two Lenovo laptops, N210s, 269 00:09:11,740 --> 00:09:14,400 and then basically had to have a daughter card 270 00:09:14,400 --> 00:09:15,380 that's within that range. 271 00:09:15,500 --> 00:09:17,080 And you can tie in the DSP to the daughter card 272 00:09:17,080 --> 00:09:19,360 so you can actually demodulate and remodulate it 273 00:09:19,360 --> 00:09:20,680 a lot faster, so. 274 00:09:21,680 --> 00:09:23,680 And yeah, here's test two explained. 275 00:09:23,820 --> 00:09:24,940 So I did it over wireless. 276 00:09:25,560 --> 00:09:27,940 The second time, it was susceptible to latency. 277 00:09:28,760 --> 00:09:31,080 And that was, I was checking into that. 278 00:09:31,160 --> 00:09:32,460 And when, this is the actual results 279 00:09:32,460 --> 00:09:33,900 when I submitted it and everything like that. 280 00:09:34,040 --> 00:09:35,920 And they were asking me if it was, 281 00:09:36,080 --> 00:09:38,360 it had an aftermarket starter added to it 282 00:09:38,360 --> 00:09:38,880 and stuff like that. 283 00:09:38,960 --> 00:09:40,520 So it might have added a little bit of susceptibility 284 00:09:40,520 --> 00:09:43,280 for that type of stuff for as far as accepting the start. 285 00:09:43,560 --> 00:09:46,500 But as far as, up to 18 milliseconds of latency 286 00:09:46,500 --> 00:09:47,220 is what I could add. 287 00:09:47,360 --> 00:09:49,900 So to it, where it would actually still accept it 288 00:09:49,900 --> 00:09:51,020 as a valid key entry, so. 289 00:09:52,500 --> 00:09:54,520 And yeah, so this is basically the same as the wired, 290 00:09:54,580 --> 00:09:55,540 except for that we went with the wired. 291 00:09:55,540 --> 00:09:56,260 This is the wireless version of it. 292 00:09:57,120 --> 00:09:58,120 And here's my final test. 293 00:09:58,360 --> 00:10:00,540 So I did it over a 365 spectrum. 294 00:10:00,700 --> 00:10:03,160 And I did it from almost a quarter of a mile away. 295 00:10:03,280 --> 00:10:05,200 It was a Super Bowl Sunday like two years ago. 296 00:10:05,660 --> 00:10:08,300 And I was, everybody else was watching the Super Bowl game. 297 00:10:08,460 --> 00:10:10,120 I don't even know who won that year or who's even playing 298 00:10:10,120 --> 00:10:13,080 because I was driving a Durango around without the keys in it. 299 00:10:13,240 --> 00:10:14,140 So I'm having a blast. 300 00:10:14,960 --> 00:10:15,980 It was a very fun time. 301 00:10:16,200 --> 00:10:17,560 And like I said, I have a whole set up. 302 00:10:17,820 --> 00:10:19,300 And like, this was a little bit expensive. 303 00:10:19,540 --> 00:10:21,180 But this one had really good range. 304 00:10:21,400 --> 00:10:24,180 It worked on multiple keys, which is something that I'm, 305 00:10:24,220 --> 00:10:25,100 from what I understand, 306 00:10:25,100 --> 00:10:27,200 of the $22 version is you can, 307 00:10:28,160 --> 00:10:30,620 it's very susceptible to interference and stuff like that. 308 00:10:30,700 --> 00:10:32,460 I could literally walk this one into a dealership, 309 00:10:32,460 --> 00:10:33,520 throw it down by the dealership rack 310 00:10:33,520 --> 00:10:35,600 and go off with any vehicle that's on the lot. 311 00:10:36,080 --> 00:10:38,000 Because of the way that it samples 312 00:10:38,000 --> 00:10:39,320 and the rates that it can sample at, 313 00:10:39,480 --> 00:10:42,440 it is very, it can take a lot of data 314 00:10:42,440 --> 00:10:43,900 before it'll actually start jamming it up 315 00:10:43,900 --> 00:10:46,380 or basically garbling the messages, so. 316 00:10:48,100 --> 00:10:49,420 And yeah, this is what I drove, 317 00:10:49,540 --> 00:10:52,660 the ATM that I did my ATM hacking talk last year. 318 00:10:52,780 --> 00:10:53,980 So that was one of the vehicles that I did 319 00:10:53,980 --> 00:10:56,140 that performed the attack on, so. 320 00:10:56,600 --> 00:10:57,380 And it was pretty fun. 321 00:10:57,580 --> 00:10:58,920 It was, I love the vehicles. 322 00:10:59,040 --> 00:11:00,100 They're amazing vehicles. 323 00:11:00,320 --> 00:11:02,220 But yeah, it was the actual one 324 00:11:02,220 --> 00:11:03,100 that I performed the attack on. 325 00:11:03,200 --> 00:11:06,000 So, or not this exact one, but it was a white Durango. 326 00:11:06,160 --> 00:11:07,140 So, but yeah. 327 00:11:07,740 --> 00:11:10,880 So the dealership, the actual digital to analog, 328 00:11:11,000 --> 00:11:12,860 analog to digital dealership attack. 329 00:11:13,000 --> 00:11:14,220 So that was like one of the proof of concepts 330 00:11:14,220 --> 00:11:17,860 that I submitted along with my vulnerability disclosure. 331 00:11:18,880 --> 00:11:20,440 Was, say for example, if somebody was to go 332 00:11:20,440 --> 00:11:21,860 into a dealership, dealerships, 333 00:11:21,860 --> 00:11:22,760 they have them hanging in a box 334 00:11:22,760 --> 00:11:23,880 inside of a wall, inside of a manager. 335 00:11:23,980 --> 00:11:26,680 So if somebody was to drop the bag near one of those, 336 00:11:27,340 --> 00:11:29,160 they would be able to actually walk off 337 00:11:29,160 --> 00:11:30,520 with several vehicles in some cases, 338 00:11:31,140 --> 00:11:32,660 depending on the actual setup of it 339 00:11:32,660 --> 00:11:33,560 or how many keys there were. 340 00:11:34,140 --> 00:11:35,460 There might have been a lot of confusion, 341 00:11:35,900 --> 00:11:38,300 depending on how many of the interrogation signals 342 00:11:38,300 --> 00:11:39,940 and things were getting passed back and forth. 343 00:11:40,320 --> 00:11:44,340 So this actual attack, so that would have been something 344 00:11:44,340 --> 00:11:47,020 where, you know, in addition to like rental returns, 345 00:11:47,460 --> 00:11:49,940 there was a couple other concepts that I went through 346 00:11:49,940 --> 00:11:52,500 that would be possible, especially in smaller cities, 347 00:11:52,540 --> 00:11:53,320 not like the bigger airports. 348 00:11:53,320 --> 00:11:55,200 They have the strips where you wouldn't be able 349 00:11:55,200 --> 00:11:56,200 to drive them out and stuff like that. 350 00:11:56,380 --> 00:11:59,580 But yeah, so if you do the digital analog, analog to digital, 351 00:11:59,680 --> 00:12:01,740 so you're basically taking it from layer zero to layer one, 352 00:12:01,800 --> 00:12:03,540 back down to layer two, or down to layer one, 353 00:12:03,580 --> 00:12:04,740 or layer zero, excuse me. 354 00:12:05,860 --> 00:12:07,840 So, and yeah, so the low frequency, 355 00:12:08,000 --> 00:12:11,880 so I used a Proxmark proxy, which who on here 356 00:12:11,880 --> 00:12:13,440 has dealt with those before, 1356. 357 00:12:14,200 --> 00:12:15,220 They're very, very nice. 358 00:12:15,440 --> 00:12:17,360 I've used them on RFID badges in the past, 359 00:12:17,400 --> 00:12:20,240 and it's something where the low interrogation signal 360 00:12:20,240 --> 00:12:21,160 that's sent off from the key fob, 361 00:12:21,240 --> 00:12:22,100 you're able to actually do, 362 00:12:23,320 --> 00:12:25,640 that one is a little bit less susceptible 363 00:12:25,640 --> 00:12:27,500 to some of the actual interference and things like that. 364 00:12:27,880 --> 00:12:29,700 But this was a part of the initial setup, 365 00:12:29,800 --> 00:12:31,520 so I had the Proxmark, and then I had that 366 00:12:31,860 --> 00:12:36,100 for all the actual LFR low channel information. 367 00:12:36,360 --> 00:12:40,620 Then for the UHF channels, it was 315, 433. 368 00:12:40,840 --> 00:12:42,240 That was what I was tuned to, 369 00:12:42,300 --> 00:12:45,120 so anything out of that range, like I tried it on, 370 00:12:45,220 --> 00:12:46,540 there was a couple Ford vehicles, 371 00:12:46,620 --> 00:12:48,720 my wife has a Lincoln, did not work on those. 372 00:12:49,560 --> 00:12:53,200 And I believe BMW was 868, so that was two of the things, 373 00:12:53,200 --> 00:12:55,760 and these are the ones I didn't dive too much into them 374 00:12:55,760 --> 00:12:56,660 after I saw they didn't work. 375 00:12:57,080 --> 00:12:58,460 So those numbers might be inaccurate, 376 00:12:58,700 --> 00:13:00,180 or they might be for their actual fob system. 377 00:13:00,340 --> 00:13:02,060 Some of these vehicles might not have passive key entry at all. 378 00:13:02,160 --> 00:13:04,800 It's just the actual spectrums that they're actually using, so. 379 00:13:06,160 --> 00:13:09,500 And I'm not saying that any of those are susceptible 100%, 380 00:13:09,500 --> 00:13:10,620 but yeah, it's something where, 381 00:13:10,740 --> 00:13:12,660 it's cool to see how they've actually done reactions 382 00:13:12,660 --> 00:13:14,880 ever since the 2009, 2010 research, 383 00:13:15,080 --> 00:13:16,700 because they published their research in 2009 384 00:13:16,700 --> 00:13:17,720 for the amplification attack, 385 00:13:18,160 --> 00:13:20,480 and the actual attack surface for that went down 386 00:13:20,960 --> 00:13:21,920 pretty severely, so. 387 00:13:24,260 --> 00:13:25,700 And yeah, so RollerJam, 388 00:13:25,820 --> 00:13:27,840 that's something that Sammy Kamkar did last year, 389 00:13:27,960 --> 00:13:30,820 basically blocks your message, 390 00:13:30,900 --> 00:13:32,120 and then it'll allow it to relay, 391 00:13:32,300 --> 00:13:34,860 or replay it a second time once you play the second thing. 392 00:13:34,980 --> 00:13:36,100 It's very, very cool, you should go check it out. 393 00:13:36,560 --> 00:13:38,820 That's one of the features that I'm actually building into. 394 00:13:39,520 --> 00:13:41,900 The stop mitigation method, it's actually gonna stop, 395 00:13:42,040 --> 00:13:43,360 because you have a two-factor authentication 396 00:13:43,360 --> 00:13:44,480 on the device that I'm building, 397 00:13:45,000 --> 00:13:46,560 so you'll actually be able to detect 398 00:13:46,560 --> 00:13:48,180 if there's any RollerJamming going on. 399 00:13:48,700 --> 00:13:50,120 So that one will do a signaling, 400 00:13:50,760 --> 00:13:52,280 and I'll show you the actual Adreno method. 401 00:13:52,420 --> 00:13:53,040 If you guys want to go, 402 00:13:53,200 --> 00:13:56,120 to the demo labs, I'll actually go into greater detail. 403 00:13:56,320 --> 00:13:57,700 I could literally talk for a half an hour 404 00:13:57,700 --> 00:13:59,660 about that specifically, so. 405 00:14:00,260 --> 00:14:02,820 But yeah, it's gonna add, there's other key attacks. 406 00:14:03,200 --> 00:14:05,160 There's some Genesis code attacks, 407 00:14:05,360 --> 00:14:06,940 like from dealership codes and stuff like that, 408 00:14:07,000 --> 00:14:08,920 where people are able to do some other things. 409 00:14:09,000 --> 00:14:10,140 You'll be able to detect if anybody's 410 00:14:10,140 --> 00:14:11,320 trying to attack your vehicle wirelessly, 411 00:14:12,420 --> 00:14:14,260 and adding features as they develop, 412 00:14:14,360 --> 00:14:15,700 and I'd love to see what the community has to do. 413 00:14:16,100 --> 00:14:17,360 One of the biggest ones is I have a, 414 00:14:17,360 --> 00:14:19,660 I don't have a stock infotainment system in my computer. 415 00:14:19,780 --> 00:14:20,860 I have an aftermarket CD player. 416 00:14:20,980 --> 00:14:22,500 It's an Android CD player, 417 00:14:23,200 --> 00:14:25,000 and I have a Bluetooth radio on that one, 418 00:14:25,040 --> 00:14:27,180 so I can actually basically tie it in 419 00:14:27,180 --> 00:14:28,440 to the jamming frequency. 420 00:14:28,660 --> 00:14:30,360 My vehicle that I have is a 95. 421 00:14:30,540 --> 00:14:31,140 It's an older vehicle, 422 00:14:31,240 --> 00:14:33,200 but it still has a 1356 chip in the ignition, 423 00:14:33,400 --> 00:14:35,340 so it still has some kind of wireless that I can jam 424 00:14:35,340 --> 00:14:37,260 to actually pass, or de-auth. 425 00:14:37,840 --> 00:14:39,080 Jamming would be illegal, so. 426 00:14:39,760 --> 00:14:40,900 But it's something where you can actually 427 00:14:40,900 --> 00:14:42,900 take care of the actual wireless beacons, 428 00:14:42,960 --> 00:14:45,340 and it won't be able to actually pass off to the immobilizer, 429 00:14:45,380 --> 00:14:46,360 and you won't be able to start the vehicle. 430 00:14:46,660 --> 00:14:49,320 They will be able to with certain other instances. 431 00:14:49,540 --> 00:14:51,540 There still are bypasses that people can do 432 00:14:51,960 --> 00:14:52,720 to steal vehicles, 433 00:14:52,720 --> 00:14:53,660 and disable them, so. 434 00:14:54,400 --> 00:14:56,060 But basically, it's a time lock option, 435 00:14:56,180 --> 00:14:56,540 so you can, 436 00:14:57,500 --> 00:14:59,280 this one is a built-in time frame, 437 00:14:59,460 --> 00:15:01,760 so like for the beta one that I did, 438 00:15:01,780 --> 00:15:03,720 I did from the hours that I'm sleeping, basically. 439 00:15:04,120 --> 00:15:06,700 Or I can actually do when my phone gets plugged in, 440 00:15:06,740 --> 00:15:07,760 any time my phone gets plugged in, 441 00:15:08,200 --> 00:15:09,700 it'll turn on a certain beacon, 442 00:15:09,860 --> 00:15:10,840 or you can do whatever you want 443 00:15:10,840 --> 00:15:12,020 for as far as your trigger for it. 444 00:15:12,360 --> 00:15:15,080 You could eventually have an Android phone hooked up to it, 445 00:15:15,120 --> 00:15:16,340 and in certain parts of town, 446 00:15:16,400 --> 00:15:16,960 you'll just lock your, 447 00:15:17,040 --> 00:15:19,860 jam your vehicle's actual authentication. 448 00:15:20,140 --> 00:15:20,980 So there's plenty of methods, 449 00:15:21,060 --> 00:15:22,560 and I would love to see what the actual hacker community 450 00:15:22,560 --> 00:15:23,680 can come up with for this. 451 00:15:23,820 --> 00:15:26,040 But you're basically adding two-factor authentication, 452 00:15:26,320 --> 00:15:29,060 so if you're de-authenticating about a foot radius, 453 00:15:29,100 --> 00:15:29,980 depending on the TX code, 454 00:15:30,340 --> 00:15:32,120 or the actual TX strength, excuse me, 455 00:15:32,560 --> 00:15:34,140 depending on your broadcast strength, 456 00:15:34,280 --> 00:15:36,320 you can take care of basically your van, 457 00:15:36,500 --> 00:15:38,400 or your vehicle area network, 458 00:15:38,580 --> 00:15:38,940 so it's gonna, 459 00:15:39,060 --> 00:15:40,540 everything that's in proximity to your vehicle, 460 00:15:40,580 --> 00:15:42,160 you're not gonna be stopping other vehicles, 461 00:15:43,640 --> 00:15:44,500 in most cases. 462 00:15:44,680 --> 00:15:46,000 So that's, other ways you can do is, 463 00:15:46,060 --> 00:15:48,180 you can just actually disrupt the CAN bus method, 464 00:15:48,340 --> 00:15:50,280 or there's a lot of ways that you can disrupt 465 00:15:50,280 --> 00:15:51,380 the actual starting of the vehicle. 466 00:15:51,380 --> 00:15:53,720 I don't think radio jamming would be necessarily 467 00:15:53,720 --> 00:15:54,360 the best one, 468 00:15:54,440 --> 00:15:56,740 but it's one that was the first one that came to mind, 469 00:15:56,800 --> 00:15:57,880 and it seems to be the simplest, 470 00:15:58,500 --> 00:16:00,080 where it gets you in that $11 range. 471 00:16:00,720 --> 00:16:02,140 Some of the other methods would involve 472 00:16:02,140 --> 00:16:03,980 having to buy proprietary ports, 473 00:16:04,140 --> 00:16:06,580 or at least Chinese knock-offs of them, so. 474 00:16:07,260 --> 00:16:09,820 And yeah, you can basically disrupt the infotainment system, 475 00:16:10,060 --> 00:16:10,880 you could do a PIN, 476 00:16:10,980 --> 00:16:12,620 that's one that I would recommend dealerships do, 477 00:16:12,760 --> 00:16:15,420 or actual auto manufacturers. 478 00:16:15,620 --> 00:16:17,500 So maybe they leave the keyless doors 479 00:16:17,500 --> 00:16:18,460 being able to be opened, 480 00:16:18,500 --> 00:16:21,260 but they add some kind of thing where you can opt-in 481 00:16:21,380 --> 00:16:23,700 to have your vehicle have a four-digit PIN 482 00:16:23,700 --> 00:16:25,960 to actually get your immobilizer, 483 00:16:26,040 --> 00:16:27,940 or some kind of thing to actually stop these kind of attacks. 484 00:16:28,180 --> 00:16:29,980 And I hope that they handle it 485 00:16:30,720 --> 00:16:32,640 with a little bit more security in mind. 486 00:16:32,920 --> 00:16:36,100 So, and I have a USB-based infotainment jammer, 487 00:16:36,180 --> 00:16:38,900 so that one is one where you can basically 488 00:16:39,800 --> 00:16:40,780 still get into your doors, 489 00:16:40,860 --> 00:16:41,840 you can still unlock your vehicle, 490 00:16:42,480 --> 00:16:43,540 depending on the makes and models. 491 00:16:43,700 --> 00:16:45,700 Some of them that are non-wired 492 00:16:45,700 --> 00:16:46,820 for the actual keyless entry, 493 00:16:46,940 --> 00:16:47,680 you wouldn't work on that. 494 00:16:48,300 --> 00:16:50,040 And yeah, so you'll be able to detect, 495 00:16:50,140 --> 00:16:50,540 like I was saying, 496 00:16:51,380 --> 00:16:53,280 a roofing plastic slip for your key fob. 497 00:16:53,660 --> 00:16:54,980 There's actual modifications I'm doing 498 00:16:54,980 --> 00:16:58,000 for the actual fobs for the Fiat Chrysler vehicles, 499 00:16:58,160 --> 00:17:00,980 where you can actually basically slide a piece of plastic 500 00:17:00,980 --> 00:17:01,560 up on the side, 501 00:17:01,620 --> 00:17:03,400 and it actually covers the actual 502 00:17:03,400 --> 00:17:05,300 internal battery portion of it. 503 00:17:05,560 --> 00:17:07,180 So yeah, so there's lots of actual ways 504 00:17:07,180 --> 00:17:07,980 that people would stop this. 505 00:17:08,100 --> 00:17:09,080 I know a lot of people were like, 506 00:17:09,160 --> 00:17:11,980 oh, put your key in an electrostatic bag, 507 00:17:12,060 --> 00:17:13,260 or inside of a Faraday cage, 508 00:17:13,340 --> 00:17:14,420 or something along those lines. 509 00:17:14,560 --> 00:17:16,480 And yeah, I definitely wouldn't see that 510 00:17:16,480 --> 00:17:17,260 as being something convenient, 511 00:17:17,420 --> 00:17:18,780 but I think adding a second factor, 512 00:17:18,840 --> 00:17:20,860 such as having your phone and Bluetooth, 513 00:17:21,400 --> 00:17:24,120 would definitely be something that would be simple to use. 514 00:17:24,260 --> 00:17:26,760 So basically, it jams 433 or 315, 515 00:17:26,960 --> 00:17:28,720 not necessarily jams it, it can de-auth it, 516 00:17:28,780 --> 00:17:30,440 it can take care of those radio signals, 517 00:17:30,540 --> 00:17:31,060 however they're saying, 518 00:17:31,440 --> 00:17:33,340 but it effectively adds a two-factor authentication 519 00:17:33,340 --> 00:17:34,000 to your vehicle. 520 00:17:34,220 --> 00:17:37,160 So if you're jamming 315 megahertz, 521 00:17:37,280 --> 00:17:39,000 it's not gonna jam 2.4 gigahertz, 522 00:17:39,060 --> 00:17:39,780 which is that your Bluetooth, 523 00:17:39,860 --> 00:17:42,140 or whatever your secondary wireless beacon's 524 00:17:42,140 --> 00:17:43,140 actually gonna be in range. 525 00:17:43,320 --> 00:17:45,040 And you could literally have it as simple as something, 526 00:17:45,220 --> 00:17:46,640 there's Bluetooth Low Energy, 527 00:17:46,920 --> 00:17:47,660 you could have it, 528 00:17:47,720 --> 00:17:49,760 there's lots of devices that actually put off these, 529 00:17:49,800 --> 00:17:51,000 so you could have a watch to start your car. 530 00:17:51,380 --> 00:17:52,380 It's amazing, I just have it, 531 00:17:53,180 --> 00:17:55,460 the idea and the concept is actually to stop this attack, 532 00:17:55,800 --> 00:17:58,100 and it was to build some kind of two-form authentication. 533 00:17:59,420 --> 00:18:00,740 It's really, really fun when you have something 534 00:18:00,740 --> 00:18:02,380 that's in your vehicle that works with your vehicle. 535 00:18:02,820 --> 00:18:04,860 And it's a really, really fun project, 536 00:18:04,940 --> 00:18:05,480 it's really cheap, 537 00:18:05,520 --> 00:18:07,300 and it takes about two hours to build. 538 00:18:09,200 --> 00:18:10,040 And yeah, like I was saying, 539 00:18:10,120 --> 00:18:12,860 you could do the actual 8 p.m. to 5 a.m., 540 00:18:12,860 --> 00:18:13,580 that's what I do for mine. 541 00:18:13,880 --> 00:18:16,100 If I needed to actually go to work 542 00:18:16,100 --> 00:18:16,800 in between here and there, 543 00:18:16,900 --> 00:18:17,900 I still have ways that I can do it. 544 00:18:17,940 --> 00:18:20,400 I can go in there and I can actually do workarounds, 545 00:18:20,400 --> 00:18:20,560 or 546 00:18:21,380 --> 00:18:22,720 if some days, if, yeah, 547 00:18:22,820 --> 00:18:24,560 it's just as simple as modifying it. 548 00:18:24,800 --> 00:18:26,100 There's a very, very simple file, 549 00:18:26,200 --> 00:18:28,300 and I'll be releasing all these open source MIT license, 550 00:18:28,540 --> 00:18:30,520 so everybody can just literally grab this, 551 00:18:30,660 --> 00:18:32,040 they can throw it into products. 552 00:18:32,160 --> 00:18:35,780 I hope the actual companies offer these kind of things. 553 00:18:35,980 --> 00:18:37,400 I would think that would be awesome, 554 00:18:37,460 --> 00:18:37,980 and it would be nice, 555 00:18:38,020 --> 00:18:40,220 and for the years that aren't covered, though, 556 00:18:40,260 --> 00:18:41,700 it's nice to be able to actually build something 557 00:18:41,700 --> 00:18:42,460 from the ground up. 558 00:18:42,760 --> 00:18:43,300 And yeah. 559 00:18:43,520 --> 00:18:44,980 And it has simple clock control, 560 00:18:45,120 --> 00:18:46,440 so the simple clock control one, 561 00:18:46,540 --> 00:18:47,780 so the one that's windowing, 562 00:18:47,780 --> 00:18:49,600 just for shutting your vehicle down at certain hours, 563 00:18:49,820 --> 00:18:51,080 that one is very cheap to build. 564 00:18:51,080 --> 00:18:53,980 I built that one for less than $6, so. 565 00:18:54,320 --> 00:18:55,940 And I'll be releasing all the plans for those 566 00:18:55,940 --> 00:18:56,900 a little after DEF CON, 567 00:18:57,140 --> 00:19:00,660 and yeah, using the actual jammer to steal vehicles. 568 00:19:00,880 --> 00:19:02,040 So this is another proof of concept. 569 00:19:02,140 --> 00:19:03,620 This is something dealerships need to watch out for. 570 00:19:04,140 --> 00:19:05,160 So I was like, okay, 571 00:19:05,260 --> 00:19:08,680 if people can build 433 jammers, 315 jammers, 572 00:19:08,920 --> 00:19:10,520 they can basically go to a car dealership, 573 00:19:10,560 --> 00:19:11,840 walk up to a salesman and be like, 574 00:19:11,920 --> 00:19:13,260 hey, I'd like to purchase this vehicle. 575 00:19:13,940 --> 00:19:15,140 Then they'll go over to the vehicle, 576 00:19:15,220 --> 00:19:15,920 the vehicle won't open. 577 00:19:16,060 --> 00:19:17,260 What is the first thing the salesman does? 578 00:19:17,620 --> 00:19:19,080 He walks to go get a jump starter, 579 00:19:19,260 --> 00:19:20,980 then they just turn off the jammer and walk off of it, 580 00:19:20,980 --> 00:19:22,740 so that's something where I think 581 00:19:22,740 --> 00:19:25,400 the automotive manufacturers need to put 582 00:19:25,400 --> 00:19:26,600 some kind of jam tracking in there, 583 00:19:26,640 --> 00:19:27,980 some kind of light, some kind of indicator, 584 00:19:28,400 --> 00:19:29,480 something on the key fobs. 585 00:19:29,720 --> 00:19:30,920 It's definitely something that 586 00:19:30,920 --> 00:19:31,920 I don't think this is gonna go away. 587 00:19:32,480 --> 00:19:34,180 It's something where they might get more advanced. 588 00:19:34,420 --> 00:19:35,420 Like I was saying, I never thought 589 00:19:35,420 --> 00:19:36,720 that they'd be able to get it down to $22. 590 00:19:37,240 --> 00:19:39,820 If you would have funded me a million dollars, 591 00:19:39,900 --> 00:19:41,460 I wouldn't have been able to get it down 592 00:19:41,460 --> 00:19:43,000 to the small form factor that they did it, 593 00:19:43,100 --> 00:19:44,880 so it's something where, you know, 594 00:19:44,880 --> 00:19:46,420 with a little bit of research put into it, 595 00:19:46,460 --> 00:19:47,740 people are able to get it to that 596 00:19:47,740 --> 00:19:49,840 where now it's available in everybody's hands, so. 597 00:19:51,300 --> 00:19:53,780 Actually, a couple other cool projects I was working on, 598 00:19:53,840 --> 00:19:55,180 I mentioned some of these TPMS sensors, 599 00:19:55,300 --> 00:19:56,480 so the tire pressure monitor sensors. 600 00:19:56,820 --> 00:19:57,940 I actually have one for, 601 00:19:58,560 --> 00:20:00,680 so I had a buddy who races Mustangs 602 00:20:00,680 --> 00:20:03,020 and he hates having his dash flashing 603 00:20:03,020 --> 00:20:04,680 while he's at the drag strip or whatever, 604 00:20:04,780 --> 00:20:06,380 so he switches his tires out 605 00:20:06,380 --> 00:20:07,880 and he has to go have his vehicle flash every time, 606 00:20:08,080 --> 00:20:11,160 so basically I wrote a program or a modification 607 00:20:11,160 --> 00:20:14,120 that you can do to actual Ford and Lincoln vehicles 608 00:20:14,620 --> 00:20:16,700 from somewhere around 2007 up. 609 00:20:16,920 --> 00:20:19,640 You'll be able to actually modify the TPMS IDs, 610 00:20:19,760 --> 00:20:20,660 so you can have three sets 611 00:20:20,660 --> 00:20:21,420 of tires on your vehicle. 612 00:20:21,780 --> 00:20:24,020 And this one only works for Ford and Lincoln. 613 00:20:24,100 --> 00:20:25,100 If there's interest in other stuff, 614 00:20:25,300 --> 00:20:26,360 maybe other people in the community 615 00:20:26,360 --> 00:20:27,120 want to reach out to me, 616 00:20:27,200 --> 00:20:28,360 we can do it for other vehicles. 617 00:20:28,500 --> 00:20:29,340 I don't think other vehicles 618 00:20:29,340 --> 00:20:31,120 are as hard to actually flash over. 619 00:20:31,280 --> 00:20:32,420 I haven't actually researched it, though. 620 00:20:32,620 --> 00:20:33,720 So, we're on five minutes? 621 00:20:33,960 --> 00:20:35,360 Awesome, yeah, it should be wrapped up here soon. 622 00:20:36,440 --> 00:20:38,440 And yeah, so the random TPMS ID, 623 00:20:38,600 --> 00:20:39,580 so every time you start your vehicle, 624 00:20:39,740 --> 00:20:43,340 I have the, this is one of the security talks 625 00:20:43,340 --> 00:20:44,140 I did yesterday. 626 00:20:44,420 --> 00:20:45,580 It was actually, every time your vehicle starts, 627 00:20:45,640 --> 00:20:46,960 it flashes your TPMS sensors, 628 00:20:47,040 --> 00:20:48,540 so it does random numbers, basically, 629 00:20:48,660 --> 00:20:50,520 and it actually loads them 630 00:20:50,660 --> 00:20:51,620 into your ECU and everything for you. 631 00:20:51,720 --> 00:20:53,080 So it does everything that the dealership does, 632 00:20:53,420 --> 00:20:54,660 except for every time you drive around, 633 00:20:54,840 --> 00:20:56,280 you're not being able to be tracked by billboards, 634 00:20:56,440 --> 00:20:58,420 and it's gonna get more and more intrusive in the future. 635 00:20:58,640 --> 00:21:00,800 People are gonna literally be using these. 636 00:21:00,960 --> 00:21:02,620 I know over in other countries, 637 00:21:02,680 --> 00:21:06,620 they've even used TPMS sensors for IEDs and other things. 638 00:21:06,780 --> 00:21:08,620 So there's lots of ways that if people were able 639 00:21:08,620 --> 00:21:10,520 to actually shut their actual sensors off of their vehicles 640 00:21:11,240 --> 00:21:12,800 without the actual dash lights going off, 641 00:21:12,880 --> 00:21:16,020 or being able to add at least three sets of tires 642 00:21:16,020 --> 00:21:16,640 to their vehicles, 643 00:21:16,800 --> 00:21:18,220 it would be something that they'd be very interested in. 644 00:21:18,320 --> 00:21:19,820 And if you guys have any questions about any of these, 645 00:21:19,820 --> 00:21:21,340 I will also be talking about these 646 00:21:21,340 --> 00:21:23,780 at the actual demo labs on Sunday, 647 00:21:23,880 --> 00:21:25,660 because I can drive into a little bit deeper detail. 648 00:21:25,760 --> 00:21:28,360 You can ask some of the more questions that you want to roll. 649 00:21:29,040 --> 00:21:31,680 So basically, the random rolls of the TPMS sensors, 650 00:21:31,980 --> 00:21:34,200 cycle throughs, 10 revisions is what I have 651 00:21:34,200 --> 00:21:35,560 the Lincoln model working for. 652 00:21:35,980 --> 00:21:37,260 So it'll actually, every time you start, 653 00:21:37,340 --> 00:21:38,380 it'll roll through one of 10, 654 00:21:38,900 --> 00:21:41,140 so basically that's 10 sets of tires attached to your vehicle 655 00:21:41,140 --> 00:21:43,080 and it does draw a little more energy, 656 00:21:43,180 --> 00:21:44,240 so you can wirelessly charge it. 657 00:21:44,480 --> 00:21:46,760 So if people aren't a fan of putting more things 658 00:21:46,760 --> 00:21:47,360 into their tires, 659 00:21:47,720 --> 00:21:49,440 that might be something that they might want to refrain from 660 00:21:49,440 --> 00:21:53,240 or have some kind of actual kinetic energy system to run it. 661 00:21:53,660 --> 00:21:55,380 And early warrant detection system, 662 00:21:55,560 --> 00:21:57,620 this is one that I came up with about two weeks 663 00:21:58,100 --> 00:21:59,180 before I came to DEF CON actually. 664 00:21:59,400 --> 00:22:01,380 And it's actually, there's on certain, 665 00:22:02,160 --> 00:22:03,300 so when somebody's served a warrant, 666 00:22:03,460 --> 00:22:05,340 they basically have to, for the most part, 667 00:22:05,440 --> 00:22:08,200 they have to serve a empty dump truck to their house 668 00:22:08,200 --> 00:22:10,480 and actually load the trash in that way. 669 00:22:10,620 --> 00:22:12,660 So, and it was something, it was just a proof of concept 670 00:22:12,660 --> 00:22:14,220 and I just, I've reached out to a couple 671 00:22:14,220 --> 00:22:16,460 of the actual manufacturers to see if it's something 672 00:22:16,460 --> 00:22:17,380 that they care about, 673 00:22:17,500 --> 00:22:18,160 because there are load, 674 00:22:18,160 --> 00:22:19,900 either from the airbag distributions 675 00:22:20,360 --> 00:22:23,000 and it's something that I know there's a couple people 676 00:22:23,000 --> 00:22:25,920 that have done research on actual loads for armored trucks 677 00:22:25,920 --> 00:22:26,800 to be able to tell how, 678 00:22:27,920 --> 00:22:29,060 just by how they're riding, 679 00:22:29,200 --> 00:22:30,500 how much actual stuff is inside of them. 680 00:22:30,640 --> 00:22:32,040 So it's something where they need to actually 681 00:22:32,040 --> 00:22:33,140 maybe lock down a little bit 682 00:22:33,140 --> 00:22:34,600 on some of the wireless sensors in this case. 683 00:22:34,800 --> 00:22:36,800 So, but yeah, I'm gonna open up to questions 684 00:22:36,800 --> 00:22:38,640 and then we got like maybe like two minutes left, 685 00:22:38,740 --> 00:22:39,240 something like that. 686 00:22:40,720 --> 00:22:42,900 So yeah, does anybody have any questions or? 687 00:22:44,460 --> 00:22:44,820 Yes. 688 00:22:45,820 --> 00:22:47,620 I apologize if you covered this in the beginning 689 00:22:48,160 --> 00:22:51,600 of the talk, but how susceptible are the cars 690 00:22:51,600 --> 00:22:55,400 to immobilizer attacks involving a targeted remote radio jammer? 691 00:22:56,260 --> 00:22:58,260 Targeted remote jammers for as far as? 692 00:22:58,300 --> 00:22:59,940 Like if you were pointing a high gain antenna 693 00:22:59,940 --> 00:23:01,820 at a car jamming the frequency? 694 00:23:02,760 --> 00:23:03,800 It's accidentally happened. 695 00:23:04,040 --> 00:23:05,100 There was an instance in New York 696 00:23:05,100 --> 00:23:07,440 where somebody's AV equipment actually jammed, 697 00:23:07,440 --> 00:23:08,860 I think it was like three and a half miles 698 00:23:08,860 --> 00:23:11,320 of vehicle starting that had, yeah. 699 00:23:11,680 --> 00:23:13,380 So it's gotten a lot better since then. 700 00:23:13,400 --> 00:23:15,640 That was early, that was early adopters right there, I think. 701 00:23:15,800 --> 00:23:18,140 So we do not have to accept all the interference in New York? 702 00:23:18,160 --> 00:23:18,800 Is it intended and unintended? 703 00:23:19,820 --> 00:23:21,480 Um, and some of the newer ones, 704 00:23:21,600 --> 00:23:22,740 they possibly do have some of the, 705 00:23:22,820 --> 00:23:24,440 I know they definitely worked a lot of the kinks 706 00:23:24,440 --> 00:23:25,700 out of the original ones. 707 00:23:25,880 --> 00:23:28,300 So you're talking for which spectrum or? 708 00:23:28,360 --> 00:23:29,400 If you wanna ask me on the hallway, 709 00:23:29,500 --> 00:23:31,400 we can probably do that or maybe. 710 00:23:31,600 --> 00:23:33,480 I was just curious if that historically happened already. 711 00:23:33,680 --> 00:23:35,060 Okay, yeah, I think it has 712 00:23:35,060 --> 00:23:37,440 and I've heard of instances in New York, so yes. 713 00:23:38,120 --> 00:23:39,540 Anybody else have any other questions or? 714 00:23:39,640 --> 00:23:39,860 Yes. 715 00:23:41,400 --> 00:23:43,240 Usually I thought if you unlocked the car 716 00:23:43,240 --> 00:23:44,440 in the way it wanted to start, 717 00:23:44,940 --> 00:23:47,540 the kink's not needed anymore for any ride. 718 00:23:48,160 --> 00:23:50,140 So you can go as far as you can for safety reasons. 719 00:23:50,440 --> 00:23:50,720 Yeah, yeah. 720 00:23:50,760 --> 00:23:55,340 Did you experience some, some, well, setbacks? 721 00:23:55,480 --> 00:23:57,480 Did the car give you warnings? 722 00:23:57,620 --> 00:23:58,560 Did the car say like, 723 00:23:58,560 --> 00:24:01,540 your wife through the window or something like that? 724 00:24:01,780 --> 00:24:03,620 Yeah, yeah, when you drive around it will, 725 00:24:04,200 --> 00:24:05,540 the vehicle that I was driving around, 726 00:24:05,620 --> 00:24:07,300 I thought the key, it did beep every few miles 727 00:24:07,300 --> 00:24:09,320 and then once I got it out of drive, 728 00:24:09,500 --> 00:24:11,700 it did notify me every time. 729 00:24:11,780 --> 00:24:13,040 But I was able to drive pretty much 730 00:24:13,040 --> 00:24:14,440 until I turned the vehicle off. 731 00:24:14,620 --> 00:24:16,520 So in that instance, and then, 732 00:24:16,560 --> 00:24:17,980 what was the first half of the question? 733 00:24:18,160 --> 00:24:19,540 Well, I just wanted to know 734 00:24:19,540 --> 00:24:21,660 if there was a limit to how far you could go or? 735 00:24:22,140 --> 00:24:23,720 Um, yes, yeah, some of them are throttled. 736 00:24:23,860 --> 00:24:25,180 Long years or something like that? 737 00:24:26,100 --> 00:24:26,720 Yeah, yeah. 738 00:24:26,840 --> 00:24:27,740 I think there was a re-tax. 739 00:24:27,940 --> 00:24:28,920 Yeah, it's like a thin line 740 00:24:28,920 --> 00:24:30,160 that they're dancing on with that right now 741 00:24:30,160 --> 00:24:32,040 because it's, what if somebody, you know, 742 00:24:32,040 --> 00:24:34,220 is hurt or injured and their vehicle 743 00:24:34,860 --> 00:24:36,340 would not be able to drive them to the hospital? 744 00:24:36,360 --> 00:24:38,160 That, you know, defeats the rate of, you know, 745 00:24:38,180 --> 00:24:41,540 people or the actual NICB or whatever the ratings 746 00:24:41,540 --> 00:24:43,440 that their vehicles will get for being stolen a lot. 747 00:24:43,540 --> 00:24:44,960 So if it gets to be a bigger issue, 748 00:24:45,100 --> 00:24:46,380 I'm hoping that they will actually include 749 00:24:46,380 --> 00:24:47,700 something like this as an add-on. 750 00:24:48,160 --> 00:24:49,140 Because like I said, the Bluetooth version 751 00:24:49,140 --> 00:24:49,900 is very, very simple. 752 00:24:50,140 --> 00:24:51,200 And if they could have actual output 753 00:24:51,200 --> 00:24:52,560 from their infotainment systems, 754 00:24:53,440 --> 00:24:54,700 it would be something that would be, 755 00:24:54,760 --> 00:24:56,080 even if it was a secondary device, 756 00:24:56,520 --> 00:24:57,880 it's something that, there are still 757 00:24:57,880 --> 00:24:58,720 a lot of ways to fix this. 758 00:24:59,000 --> 00:25:00,420 And I haven't found any utility 759 00:25:00,420 --> 00:25:02,860 or any kind of patenting that would make it 760 00:25:02,860 --> 00:25:04,640 where they wouldn't, it would stop them 761 00:25:04,640 --> 00:25:05,500 from doing anything like that. 762 00:25:05,580 --> 00:25:07,640 So it's not like one brand of vehicle 763 00:25:07,640 --> 00:25:08,760 has anything like that, so. 764 00:25:08,920 --> 00:25:09,960 Any other questions or? 765 00:25:10,360 --> 00:25:10,820 Thank you. 766 00:25:10,940 --> 00:25:12,360 Yeah, thanks a lot for your guys' time 767 00:25:12,360 --> 00:25:13,440 and thanks for listening, so. 768 00:25:18,160 --> 00:25:18,480 Thank you.