This is going to be stopping SDR relay and replay attacks and on
passive key entry systems. So who in here has heard of these or
seen them in the news? Yeah. Who in here is one of the fancy
push button start cards? Yeah. Makes it even more that more
interesting. So this is something where I'm going to go
over a little cool device that I built after I did a relay attack
it was two years ago when I got my original Edison 210 so I'll
go into a little bit of that. A little bit about myself, 32 I
work for NCR and I live in North Dakota. I've spoken this is my
fourth year at DEF CON speaking black hat last year. Speak at a
lot of ICS security conventions things like that so and I've been
doing pen testing this is my 13th year professionally and I've
been doing programming for about as long and I've just gotten
into a lot of research anything radio or car related has been
kind of my focus on the last year and I did a lot of attacks
on ATMs and point of sale systems last year so and reverse
engineering. So I've been working for NCR and I've been
doing malware is one of my remaining hobbies and that's one
of my original hobbies that's how I got into reversing is
actually tearing apart the Chernobyl or CIH virus was the
one that reversed your bios if anybody remembers that one was
several years ago but yeah it's a very good time and yeah so
yeah I'm going to do the car heckin' village here. So this
presentation a little bit about the research. So last year about
two years ago actually I looked into an amplification attack that
some people in I believe it was the R.I.F.D.H. saw that this was
in another country in Europe.
I need to sleep more, obviously,
but yeah, they're definitely...
They did an amplification attack,
so they basically boosted the frequency
and were able to send it a certain amount of distance.
And last year, I received three Edis U210s
and one N210, which is the one on the right there.
And so I had four software-defined radios,
and I was like, what's the worst that could happen?
And I was actually looking at immobilizer bypasses
and older dealership tools.
I was getting into...
So I've been doing car hacking for about...
This will be my third year,
so it is something where people can pick it up
really, really quick,
especially with some of the stuff
that you can Google nowadays,
a lot of the kits that are out there.
It's just the price to enter point
has gotten a lot cheaper compared to what it was.
And yeah, this is an actual pile
of 433 and 315 megahertz radios,
so I'll actually be going into how to build the device.
I have a demo lab on Sunday,
so if you guys want to come and see how to build the device,
then I can go into it.
A lot more detail once I hear back
from Ford on the actual TPMS sensor also.
So there was a Swiss amplification attack.
There was a couple researchers,
and they actually did the...
There was several changes that actually went into
a lot of the automobiles at that point.
And from 2011 on,
they started putting multiple sensors.
They started dealing with actual delays
and tracking a lot of that.
There was a huge window.
It was literally...
A third of a second for some of the original stuff.
Now it's down to about a tenth of a second
where you can actually relay the actual signal.
And does everybody in here kind of understand
the concept behind how the relay attack works
for the most part?
Okay.
Yeah, this is actual passive key entry systems.
I did a lot of research also around 2014 on passive keys.
So that's when I started looking at
what they're actually speaking,
what ranges they are.
I looked into stolen vehicle slowdowns.
I also had a DARPA contract and DHS contract with...
They're...
Attacks on PSAPs and E901 centers.
So I started looking at some of the automotive...
Automatic notification for crash detections.
So if airbags were deployed,
if vehicles rolled over.
Because that is something that these messages
might be able to be flooded into a call center
and stuff like that.
So it's something where that came across
as a lot of our stuff.
So yeah, it's pretty interesting research.
And I will definitely be going into
a lot of the actual passive key attacks that we have here.
So 2015, I submitted a...
Or...
Actually did the DSP for samples up to 700 megahertz.
So the only keys that I wasn't able to do at that time
were BMW and Ford
because they are a higher spectrum than that.
And that was just...
Yeah.
So I used the actual DSP that I built,
which is digital cycle processor built off of an FPGA.
And if you guys haven't played around with those,
the entry points for those are very cheap.
They're about $60 to $70.
And you can...
Yeah, you can make...
You can speed anything up that you need to do.
It's very, very cool systems.
And I would definitely recommend people getting into them.
So...
And there was a Beijing-based firm
So my setup that I'm going to go into
costs about $5,700.
Everybody has, you know, extra $5,700 laying around, right?
So...
Yeah, but the actual Beijing company,
they got it down to $22, which is unbelievable.
So that's when it becomes...
Anybody can do it.
So it's something where...
That's when it becomes scary.
And that's when people will start talking about it.
Press Wired did a very good write-up on it.
They actually did a very good job
with their talk and their slides
if you guys are interested in their device
and how it actually works.
And what I'm going to basically go over
is the actual hijack two-factor.
I think it's called hijack two-factor.
So who would like to have...
Who has two-factor authentication
on at least one of their electronic products?
Yeah.
How would you like to add it to your car?
How would you like to use, like,
a 1356 ring you have?
Or some people are putting implants in.
There's lots of things that you can do
for your second form of verification.
And, yeah.
And how is this used?
The passive key entry starts.
The vehicle allows the driver
to actually lock the vehicle doors
without touching the key.
So when you get into proximity,
there's sensors in the roofs in most of them
where it'll sense,
where you are at,
adjacent to the vehicle.
So if you're in the back of the vehicle,
you can't start it.
If you're at the front of the vehicle,
you can open the door.
You can possibly start it.
So these are remote key entry systems
and the actual remote keyless ignitions.
So the main frequencies for these,
for as far as the U.S. goes at least,
you're in most likely one of these ranges,
314.9 to 315 or 433 megahertz.
And then the 125 kilohertz
is usually what the key is speaking
for its low interrogation signal.
So it doesn't have a lot of range.
But it's basically going to...
You have a key in your pocket.
It's going to send out the 125 kilohertz
and your vehicle is going to send back 433 or 315
depending on what the actual make and model of it is.
So yeah.
And let's see here.
Yeah, so the actual key that I was able to do
some of the relay attacks on it
was at 433 megahertz.
And also I submitted all these to the actual Cadillac
and Chevy have,
or General Motors has an actual bug bounty program.
And they informed me that they already knew
about the amplification attacks.
And I actually took a look
at a lot of their systems.
And they are definitely stepping up their systems.
And then most of it was fixed by a lot of software patches.
It's just a lot of the second-hand vehicles
in some cases didn't get it.
So it's definitely interesting.
And so those were the two that I actually was working on.
Because they were in the 433 to 315 range,
which was within my sample range of the DSP that I built.
So, and let's see.
Updated in most vehicles.
Yeah, like they have multi-roof sensors.
Fiat Chrysler is an amazing company.
They're very open about talking to people
in the security community.
They had some Jeep issues.
Several years back.
And they've been very, very good to the community.
And they talk to people.
They're very good at reaching out
and actually taking care of the issues.
So, yeah.
So basically when you walk in the range,
you're detected by the door.
The car opens.
You're sitting near the passenger door.
The car won't start.
That was one of the issues that I'm,
I'm actually in my demo lab on Sunday.
I will go into a little bit of how you can do some of the,
it's basically beam forming.
Or you can make your beacons appear
as if they're coming from somewhere else inside the vehicle.
Or you can actually roll through six foot,
about a six foot,
about a six foot radius.
You can actually change it.
And that was something that I also used
for some of the 802.11 attacks that I did yesterday.
So, and yeah.
2015 was about, I said about a $5,400 set up.
And 2016, it's, you know,
now I can probably get around the same set up for about,
I would say about $1,200 to $1,300.
And 2017 set up is about $300 to $22.
So actual ones, the attack surface
is getting very, very cheap.
And that's where, some of these have been used in the wild.
There's lots of, you know, people,
when it becomes in that $22 range,
everybody can afford it.
And it's, especially when plans are leaked
or they're out there, so.
Yeah, so how did I start this research?
I admired my neighbor's black Durango.
And I went over to my neighbor
and asked to borrow her Durango.
I ran a wire from my driveway over to the Durango.
And yeah, basically explained to her
that I was gonna see if I could drive around
without the key in it.
And basically, you'll get glares for the rest of your life
when you mow your lawn after you've done stuff like this.
So it's better to just go out and rent it
or have a family member or,
like I had a friend who had another vehicle
that would have been susceptible to it, so.
But yeah, here's a little bit of the explanation of it.
So you have a software-defined radio on one side.
And this is the very expensive version of it.
So basically, there was my driveway.
I had an Edison 210 on that side,
an Edison 210 on this side.
I tried using the USB versions at that time
when I was doing that.
My USB 3.0 ports couldn't keep up with it.
So I did a lot of troubleshooting
and wasted a lot of time getting it to work
when I should have just went with the network versions of it.
So ran a cable, did a cabled test first.
And here's the actual setup on the bottom.
So I had two Lenovo laptops, N210s,
and then basically had to have a daughter card
that's within that range.
And you can tie in the DSP to the daughter card
so you can actually demodulate and remodulate it
a lot faster, so.
And yeah, here's test two explained.
So I did it over wireless.
The second time, it was susceptible to latency.
And that was, I was checking into that.
And when, this is the actual results
when I submitted it and everything like that.
And they were asking me if it was,
it had an aftermarket starter added to it
and stuff like that.
So it might have added a little bit of susceptibility
for that type of stuff for as far as accepting the start.
But as far as, up to 18 milliseconds of latency
is what I could add.
So to it, where it would actually still accept it
as a valid key entry, so.
And yeah, so this is basically the same as the wired,
except for that we went with the wired.
This is the wireless version of it.
And here's my final test.
So I did it over a 365 spectrum.
And I did it from almost a quarter of a mile away.
It was a Super Bowl Sunday like two years ago.
And I was, everybody else was watching the Super Bowl game.
I don't even know who won that year or who's even playing
because I was driving a Durango around without the keys in it.
So I'm having a blast.
It was a very fun time.
And like I said, I have a whole set up.
And like, this was a little bit expensive.
But this one had really good range.
It worked on multiple keys, which is something that I'm,
from what I understand,
of the $22 version is you can,
it's very susceptible to interference and stuff like that.
I could literally walk this one into a dealership,
throw it down by the dealership rack
and go off with any vehicle that's on the lot.
Because of the way that it samples
and the rates that it can sample at,
it is very, it can take a lot of data
before it'll actually start jamming it up
or basically garbling the messages, so.
And yeah, this is what I drove,
the ATM that I did my ATM hacking talk last year.
So that was one of the vehicles that I did
that performed the attack on, so.
And it was pretty fun.
It was, I love the vehicles.
They're amazing vehicles.
But yeah, it was the actual one
that I performed the attack on.
So, or not this exact one, but it was a white Durango.
So, but yeah.
So the dealership, the actual digital to analog,
analog to digital dealership attack.
So that was like one of the proof of concepts
that I submitted along with my vulnerability disclosure.
Was, say for example, if somebody was to go
into a dealership, dealerships,
they have them hanging in a box
inside of a wall, inside of a manager.
So if somebody was to drop the bag near one of those,
they would be able to actually walk off
with several vehicles in some cases,
depending on the actual setup of it
or how many keys there were.
There might have been a lot of confusion,
depending on how many of the interrogation signals
and things were getting passed back and forth.
So this actual attack, so that would have been something
where, you know, in addition to like rental returns,
there was a couple other concepts that I went through
that would be possible, especially in smaller cities,
not like the bigger airports.
They have the strips where you wouldn't be able
to drive them out and stuff like that.
But yeah, so if you do the digital analog, analog to digital,
so you're basically taking it from layer zero to layer one,
back down to layer two, or down to layer one,
or layer zero, excuse me.
So, and yeah, so the low frequency,
so I used a Proxmark proxy, which who on here
has dealt with those before, 1356.
They're very, very nice.
I've used them on RFID badges in the past,
and it's something where the low interrogation signal
that's sent off from the key fob,
you're able to actually do,
that one is a little bit less susceptible
to some of the actual interference and things like that.
But this was a part of the initial setup,
so I had the Proxmark, and then I had that
for all the actual LFR low channel information.
Then for the UHF channels, it was 315, 433.
That was what I was tuned to,
so anything out of that range, like I tried it on,
there was a couple Ford vehicles,
my wife has a Lincoln, did not work on those.
And I believe BMW was 868, so that was two of the things,
and these are the ones I didn't dive too much into them
after I saw they didn't work.
So those numbers might be inaccurate,
or they might be for their actual fob system.
Some of these vehicles might not have passive key entry at all.
It's just the actual spectrums that they're actually using, so.
And I'm not saying that any of those are susceptible 100%,
but yeah, it's something where,
it's cool to see how they've actually done reactions
ever since the 2009, 2010 research,
because they published their research in 2009
for the amplification attack,
and the actual attack surface for that went down
pretty severely, so.
And yeah, so RollerJam,
that's something that Sammy Kamkar did last year,
basically blocks your message,
and then it'll allow it to relay,
or replay it a second time once you play the second thing.
It's very, very cool, you should go check it out.
That's one of the features that I'm actually building into.
The stop mitigation method, it's actually gonna stop,
because you have a two-factor authentication
on the device that I'm building,
so you'll actually be able to detect
if there's any RollerJamming going on.
So that one will do a signaling,
and I'll show you the actual Adreno method.
If you guys want to go,
to the demo labs, I'll actually go into greater detail.
I could literally talk for a half an hour
about that specifically, so.
But yeah, it's gonna add, there's other key attacks.
There's some Genesis code attacks,
like from dealership codes and stuff like that,
where people are able to do some other things.
You'll be able to detect if anybody's
trying to attack your vehicle wirelessly,
and adding features as they develop,
and I'd love to see what the community has to do.
One of the biggest ones is I have a,
I don't have a stock infotainment system in my computer.
I have an aftermarket CD player.
It's an Android CD player,
and I have a Bluetooth radio on that one,
so I can actually basically tie it in
to the jamming frequency.
My vehicle that I have is a 95.
It's an older vehicle,
but it still has a 1356 chip in the ignition,
so it still has some kind of wireless that I can jam
to actually pass, or de-auth.
Jamming would be illegal, so.
But it's something where you can actually
take care of the actual wireless beacons,
and it won't be able to actually pass off to the immobilizer,
and you won't be able to start the vehicle.
They will be able to with certain other instances.
There still are bypasses that people can do
to steal vehicles,
and disable them, so.
But basically, it's a time lock option,
so you can,
this one is a built-in time frame,
so like for the beta one that I did,
I did from the hours that I'm sleeping, basically.
Or I can actually do when my phone gets plugged in,
any time my phone gets plugged in,
it'll turn on a certain beacon,
or you can do whatever you want
for as far as your trigger for it.
You could eventually have an Android phone hooked up to it,
and in certain parts of town,
you'll just lock your,
jam your vehicle's actual authentication.
So there's plenty of methods,
and I would love to see what the actual hacker community
can come up with for this.
But you're basically adding two-factor authentication,
so if you're de-authenticating about a foot radius,
depending on the TX code,
or the actual TX strength, excuse me,
depending on your broadcast strength,
you can take care of basically your van,
or your vehicle area network,
so it's gonna,
everything that's in proximity to your vehicle,
you're not gonna be stopping other vehicles,
in most cases.
So that's, other ways you can do is,
you can just actually disrupt the CAN bus method,
or there's a lot of ways that you can disrupt
the actual starting of the vehicle.
I don't think radio jamming would be necessarily
the best one,
but it's one that was the first one that came to mind,
and it seems to be the simplest,
where it gets you in that $11 range.
Some of the other methods would involve
having to buy proprietary ports,
or at least Chinese knock-offs of them, so.
And yeah, you can basically disrupt the infotainment system,
you could do a PIN,
that's one that I would recommend dealerships do,
or actual auto manufacturers.
So maybe they leave the keyless doors
being able to be opened,
but they add some kind of thing where you can opt-in
to have your vehicle have a four-digit PIN
to actually get your immobilizer,
or some kind of thing to actually stop these kind of attacks.
And I hope that they handle it
with a little bit more security in mind.
So, and I have a USB-based infotainment jammer,
so that one is one where you can basically
still get into your doors,
you can still unlock your vehicle,
depending on the makes and models.
Some of them that are non-wired
for the actual keyless entry,
you wouldn't work on that.
And yeah, so you'll be able to detect,
like I was saying,
a roofing plastic slip for your key fob.
There's actual modifications I'm doing
for the actual fobs for the Fiat Chrysler vehicles,
where you can actually basically slide a piece of plastic
up on the side,
and it actually covers the actual
internal battery portion of it.
So yeah, so there's lots of actual ways
that people would stop this.
I know a lot of people were like,
oh, put your key in an electrostatic bag,
or inside of a Faraday cage,
or something along those lines.
And yeah, I definitely wouldn't see that
as being something convenient,
but I think adding a second factor,
such as having your phone and Bluetooth,
would definitely be something that would be simple to use.
So basically, it jams 433 or 315,
not necessarily jams it, it can de-auth it,
it can take care of those radio signals,
however they're saying,
but it effectively adds a two-factor authentication
to your vehicle.
So if you're jamming 315 megahertz,
it's not gonna jam 2.4 gigahertz,
which is that your Bluetooth,
or whatever your secondary wireless beacon's
actually gonna be in range.
And you could literally have it as simple as something,
there's Bluetooth Low Energy,
you could have it,
there's lots of devices that actually put off these,
so you could have a watch to start your car.
It's amazing, I just have it,
the idea and the concept is actually to stop this attack,
and it was to build some kind of two-form authentication.
It's really, really fun when you have something
that's in your vehicle that works with your vehicle.
And it's a really, really fun project,
it's really cheap,
and it takes about two hours to build.
And yeah, like I was saying,
you could do the actual 8 p.m. to 5 a.m.,
that's what I do for mine.
If I needed to actually go to work
in between here and there,
I still have ways that I can do it.
I can go in there and I can actually do workarounds,
or
if some days, if, yeah,
it's just as simple as modifying it.
There's a very, very simple file,
and I'll be releasing all these open source MIT license,
so everybody can just literally grab this,
they can throw it into products.
I hope the actual companies offer these kind of things.
I would think that would be awesome,
and it would be nice,
and for the years that aren't covered, though,
it's nice to be able to actually build something
from the ground up.
And yeah.
And it has simple clock control,
so the simple clock control one,
so the one that's windowing,
just for shutting your vehicle down at certain hours,
that one is very cheap to build.
I built that one for less than $6, so.
And I'll be releasing all the plans for those
a little after DEF CON,
and yeah, using the actual jammer to steal vehicles.
So this is another proof of concept.
This is something dealerships need to watch out for.
So I was like, okay,
if people can build 433 jammers, 315 jammers,
they can basically go to a car dealership,
walk up to a salesman and be like,
hey, I'd like to purchase this vehicle.
Then they'll go over to the vehicle,
the vehicle won't open.
What is the first thing the salesman does?
He walks to go get a jump starter,
then they just turn off the jammer and walk off of it,
so that's something where I think
the automotive manufacturers need to put
some kind of jam tracking in there,
some kind of light, some kind of indicator,
something on the key fobs.
It's definitely something that
I don't think this is gonna go away.
It's something where they might get more advanced.
Like I was saying, I never thought
that they'd be able to get it down to $22.
If you would have funded me a million dollars,
I wouldn't have been able to get it down
to the small form factor that they did it,
so it's something where, you know,
with a little bit of research put into it,
people are able to get it to that
where now it's available in everybody's hands, so.
Actually, a couple other cool projects I was working on,
I mentioned some of these TPMS sensors,
so the tire pressure monitor sensors.
I actually have one for,
so I had a buddy who races Mustangs
and he hates having his dash flashing
while he's at the drag strip or whatever,
so he switches his tires out
and he has to go have his vehicle flash every time,
so basically I wrote a program or a modification
that you can do to actual Ford and Lincoln vehicles
from somewhere around 2007 up.
You'll be able to actually modify the TPMS IDs,
so you can have three sets
of tires on your vehicle.
And this one only works for Ford and Lincoln.
If there's interest in other stuff,
maybe other people in the community
want to reach out to me,
we can do it for other vehicles.
I don't think other vehicles
are as hard to actually flash over.
I haven't actually researched it, though.
So, we're on five minutes?
Awesome, yeah, it should be wrapped up here soon.
And yeah, so the random TPMS ID,
so every time you start your vehicle,
I have the, this is one of the security talks
I did yesterday.
It was actually, every time your vehicle starts,
it flashes your TPMS sensors,
so it does random numbers, basically,
and it actually loads them
into your ECU and everything for you.
So it does everything that the dealership does,
except for every time you drive around,
you're not being able to be tracked by billboards,
and it's gonna get more and more intrusive in the future.
People are gonna literally be using these.
I know over in other countries,
they've even used TPMS sensors for IEDs and other things.
So there's lots of ways that if people were able
to actually shut their actual sensors off of their vehicles
without the actual dash lights going off,
or being able to add at least three sets of tires
to their vehicles,
it would be something that they'd be very interested in.
And if you guys have any questions about any of these,
I will also be talking about these
at the actual demo labs on Sunday,
because I can drive into a little bit deeper detail.
You can ask some of the more questions that you want to roll.
So basically, the random rolls of the TPMS sensors,
cycle throughs, 10 revisions is what I have
the Lincoln model working for.
So it'll actually, every time you start,
it'll roll through one of 10,
so basically that's 10 sets of tires attached to your vehicle
and it does draw a little more energy,
so you can wirelessly charge it.
So if people aren't a fan of putting more things
into their tires,
that might be something that they might want to refrain from
or have some kind of actual kinetic energy system to run it.
And early warrant detection system,
this is one that I came up with about two weeks
before I came to DEF CON actually.
And it's actually, there's on certain,
so when somebody's served a warrant,
they basically have to, for the most part,
they have to serve a empty dump truck to their house
and actually load the trash in that way.
So, and it was something, it was just a proof of concept
and I just, I've reached out to a couple
of the actual manufacturers to see if it's something
that they care about,
because there are load,
either from the airbag distributions
and it's something that I know there's a couple people
that have done research on actual loads for armored trucks
to be able to tell how,
just by how they're riding,
how much actual stuff is inside of them.
So it's something where they need to actually
maybe lock down a little bit
on some of the wireless sensors in this case.
So, but yeah, I'm gonna open up to questions
and then we got like maybe like two minutes left,
something like that.
So yeah, does anybody have any questions or?
Yes.
I apologize if you covered this in the beginning
of the talk, but how susceptible are the cars
to immobilizer attacks involving a targeted remote radio jammer?
Targeted remote jammers for as far as?
Like if you were pointing a high gain antenna
at a car jamming the frequency?
It's accidentally happened.
There was an instance in New York
where somebody's AV equipment actually jammed,
I think it was like three and a half miles
of vehicle starting that had, yeah.
So it's gotten a lot better since then.
That was early, that was early adopters right there, I think.
So we do not have to accept all the interference in New York?
Is it intended and unintended?
Um, and some of the newer ones,
they possibly do have some of the,
I know they definitely worked a lot of the kinks
out of the original ones.
So you're talking for which spectrum or?
If you wanna ask me on the hallway,
we can probably do that or maybe.
I was just curious if that historically happened already.
Okay, yeah, I think it has
and I've heard of instances in New York, so yes.
Anybody else have any other questions or?
Yes.
Usually I thought if you unlocked the car
in the way it wanted to start,
the kink's not needed anymore for any ride.
So you can go as far as you can for safety reasons.
Yeah, yeah.
Did you experience some, some, well, setbacks?
Did the car give you warnings?
Did the car say like,
your wife through the window or something like that?
Yeah, yeah, when you drive around it will,
the vehicle that I was driving around,
I thought the key, it did beep every few miles
and then once I got it out of drive,
it did notify me every time.
But I was able to drive pretty much
until I turned the vehicle off.
So in that instance, and then,
what was the first half of the question?
Well, I just wanted to know
if there was a limit to how far you could go or?
Um, yes, yeah, some of them are throttled.
Long years or something like that?
Yeah, yeah.
I think there was a re-tax.
Yeah, it's like a thin line
that they're dancing on with that right now
because it's, what if somebody, you know,
is hurt or injured and their vehicle
would not be able to drive them to the hospital?
That, you know, defeats the rate of, you know,
people or the actual NICB or whatever the ratings
that their vehicles will get for being stolen a lot.
So if it gets to be a bigger issue,
I'm hoping that they will actually include
something like this as an add-on.
Because like I said, the Bluetooth version
is very, very simple.
And if they could have actual output
from their infotainment systems,
it would be something that would be,
even if it was a secondary device,
it's something that, there are still
a lot of ways to fix this.
And I haven't found any utility
or any kind of patenting that would make it
where they wouldn't, it would stop them
from doing anything like that.
So it's not like one brand of vehicle
has anything like that, so.
Any other questions or?
Thank you.
Yeah, thanks a lot for your guys' time
and thanks for listening, so.
Thank you.