1 00:00:00,000 --> 00:00:01,180 Thanks for coming to my talk. 2 00:00:01,300 --> 00:00:03,220 It's titled Hydra Keys, Hydra Car, 3 00:00:03,820 --> 00:00:06,460 Remotely Exploiting Connected Vehicle APIs and Apps. 4 00:00:09,420 --> 00:00:10,540 Anybody know LeVar Ball? 5 00:00:11,140 --> 00:00:11,540 Anybody? 6 00:00:11,840 --> 00:00:12,940 I was going to walk out like that, 7 00:00:12,960 --> 00:00:13,820 but if you don't know him, don't even worry. 8 00:00:14,200 --> 00:00:16,680 I figured it wasn't going to be a complete presentation 9 00:00:16,680 --> 00:00:17,600 without LeVar Ball. 10 00:00:20,260 --> 00:00:21,520 So my name's Aaron Guzman. 11 00:00:21,860 --> 00:00:24,320 My Twitter handle, scriptingxss. 12 00:00:25,000 --> 00:00:26,360 It'll probably say A-A-Ron, 13 00:00:26,360 --> 00:00:30,160 so if any of you guys have seen any of the skits, 14 00:00:30,300 --> 00:00:31,460 you'll know where it's from. 15 00:00:32,640 --> 00:00:34,280 First things first, I love pizza. 16 00:00:34,460 --> 00:00:35,400 I had pizza for breakfast. 17 00:00:35,640 --> 00:00:37,060 I had pizza probably twice already. 18 00:00:37,720 --> 00:00:39,400 I'm a serious fanatic about pizza. 19 00:00:39,980 --> 00:00:41,600 Second, I live in Los Angeles. 20 00:00:42,500 --> 00:00:46,080 I work for Gotham Digital Science, an Aon company. 21 00:00:46,880 --> 00:00:49,120 I like to hack all the things, anything IoT, 22 00:00:49,660 --> 00:00:51,580 anything connected vehicles, anything embedded, 23 00:00:51,800 --> 00:00:52,620 I'm all for it. 24 00:00:52,700 --> 00:00:54,840 I'm head first into it. 25 00:00:55,260 --> 00:00:56,060 I also... 26 00:00:56,520 --> 00:00:58,780 Well, I was a technical editor for a book called 27 00:00:59,640 --> 00:01:00,860 Practical Internet of Things Security. 28 00:01:01,360 --> 00:01:03,260 I'm actually co-authoring a book right now 29 00:01:03,260 --> 00:01:04,100 called Pen Testing. 30 00:01:04,300 --> 00:01:06,900 It's a pen testing cookbook for IoT, 31 00:01:07,120 --> 00:01:09,660 and that should be released in the next couple of months, 32 00:01:09,780 --> 00:01:11,620 hopefully, in the last couple chapters right now. 33 00:01:13,200 --> 00:01:15,520 Aside from that, I'm a board member for OWASP 34 00:01:15,520 --> 00:01:17,100 and Cloud Security Alliance, Southern California. 35 00:01:17,820 --> 00:01:20,020 I also contribute a lot to OWASP 36 00:01:20,020 --> 00:01:20,860 and Cloud Security Alliance. 37 00:01:21,020 --> 00:01:22,860 So for OWASP, I am a project leader. 38 00:01:23,280 --> 00:01:26,220 I help lead a project called Embedded Application 39 00:01:26,220 --> 00:01:26,880 Security Project. 40 00:01:27,620 --> 00:01:31,360 So mostly embedded Linux, but also some RTOS as well. 41 00:01:31,860 --> 00:01:34,400 And I contribute to a lot for Cloud Security Alliance 42 00:01:34,400 --> 00:01:35,360 IoT Working Group, 43 00:01:36,020 --> 00:01:38,680 and even their connected vehicle guidance documents 44 00:01:38,680 --> 00:01:42,660 and IoT for secure deployment. 45 00:01:43,780 --> 00:01:47,180 And here is my vehicle that we're going to be talking about. 46 00:01:47,400 --> 00:01:49,960 So today's topic is Subaru Starlink Remote Services 47 00:01:49,960 --> 00:01:51,400 in Vehicle Technology. 48 00:01:51,960 --> 00:01:54,080 Just to kind of set what that is, 49 00:01:54,160 --> 00:01:56,200 what Subaru Starlink is capable of, 50 00:01:56,220 --> 00:01:56,480 what Subaru Starlink is capable of doing, 51 00:01:56,640 --> 00:01:59,480 is you can unlock the car, honk the horn, 52 00:01:59,600 --> 00:02:01,320 locate the vehicle, locate the owner, 53 00:02:02,020 --> 00:02:03,940 have a vehicle health report, 54 00:02:04,080 --> 00:02:06,660 so you can check whether your oil is at the right stage, 55 00:02:06,800 --> 00:02:08,480 if anything's going on with your ABS, 56 00:02:09,480 --> 00:02:11,300 get monthly reports, weekly reports. 57 00:02:11,780 --> 00:02:13,700 So it could be pretty detailed. 58 00:02:14,320 --> 00:02:16,120 This is all with their telematics. 59 00:02:16,940 --> 00:02:19,280 You could also schedule your services 60 00:02:19,280 --> 00:02:21,640 and track your history as well, your mileage, 61 00:02:22,600 --> 00:02:23,440 get notifications. 62 00:02:24,740 --> 00:02:26,020 But what it doesn't do, 63 00:02:26,020 --> 00:02:27,500 it doesn't remote start your vehicle. 64 00:02:27,720 --> 00:02:29,900 But it's not to say that that cannot be added here. 65 00:02:30,080 --> 00:02:31,920 It's only a $300 add-on. 66 00:02:32,300 --> 00:02:34,140 But that was kind of out of scope for my research. 67 00:02:34,220 --> 00:02:35,380 I wanted to get what was installed, 68 00:02:35,680 --> 00:02:40,220 what was used within Starlink in-vehicle technology. 69 00:02:40,740 --> 00:02:43,520 So I started with, okay, 70 00:02:43,580 --> 00:02:47,360 I actually had purchased a vehicle in 2016 71 00:02:47,360 --> 00:02:50,100 thinking it had telematics installed. 72 00:02:50,800 --> 00:02:52,320 But come to find out, 73 00:02:52,340 --> 00:02:55,620 only some 2016 versions of Subaru or models, 74 00:02:56,020 --> 00:02:56,960 do have Starlink. 75 00:02:57,060 --> 00:03:01,840 But so far, they have official versions of 2017 and 18 vehicles. 76 00:03:02,120 --> 00:03:04,100 I think all 2017 and 18 vehicles 77 00:03:04,100 --> 00:03:06,420 now have a Subaru Starlink by default. 78 00:03:07,180 --> 00:03:10,260 So you would have to purchase a subscription, 79 00:03:10,480 --> 00:03:11,580 but it's always connected. 80 00:03:11,920 --> 00:03:13,020 So, you know. 81 00:03:15,580 --> 00:03:19,520 So some of the motivations and research that I started with, 82 00:03:19,580 --> 00:03:21,380 like this is why I kind of got a Subaru, 83 00:03:21,680 --> 00:03:24,600 is I figured there was no research in this space 84 00:03:24,600 --> 00:03:25,580 as far as, 85 00:03:25,580 --> 00:03:28,100 security research for connected vehicles 86 00:03:28,100 --> 00:03:29,800 on the Subaru aspect. 87 00:03:30,180 --> 00:03:32,040 Aside from tuning a car, 88 00:03:32,100 --> 00:03:32,660 it's a rally car, 89 00:03:32,840 --> 00:03:34,400 so it's an STI, 90 00:03:34,440 --> 00:03:37,820 so usually there's some modifications made to the engine 91 00:03:37,820 --> 00:03:41,720 to compensate for the ECU and air intake, for example. 92 00:03:42,080 --> 00:03:46,060 So anything changing within the vehicle's, 93 00:03:46,760 --> 00:03:47,580 let's say, engine, 94 00:03:47,760 --> 00:03:48,560 you'd have to tune it. 95 00:03:48,800 --> 00:03:51,160 And there's already verified manufacturers 96 00:03:51,160 --> 00:03:52,880 who are out there that do that. 97 00:03:53,280 --> 00:03:54,920 But as far as security is concerned, 98 00:03:55,120 --> 00:03:55,560 I don't know. 99 00:03:55,560 --> 00:03:56,660 I didn't find anything that was out there, 100 00:03:56,720 --> 00:03:58,040 so it was an area of interest. 101 00:03:59,320 --> 00:04:00,200 And like I said, 102 00:04:00,220 --> 00:04:02,620 only 2016 and up have a Talimatics. 103 00:04:02,940 --> 00:04:03,940 So when I purchased mine, 104 00:04:04,080 --> 00:04:07,340 I literally thought that I was gonna have to, 105 00:04:09,100 --> 00:04:11,120 well, I actually did purchase a 2018 one. 106 00:04:11,480 --> 00:04:13,540 Just literally, just to hack the vehicle. 107 00:04:13,800 --> 00:04:15,660 And we'll go through some of the steps that I went through. 108 00:04:15,840 --> 00:04:18,320 But also, I noticed that the DMC exemption 109 00:04:18,320 --> 00:04:21,760 for security research last October occurred. 110 00:04:21,960 --> 00:04:24,980 As long as it's the device or whatever, 111 00:04:24,980 --> 00:04:26,980 whatever item you're researching is lawfully acquired, 112 00:04:27,680 --> 00:04:28,760 good faith research, 113 00:04:29,080 --> 00:04:30,480 so you're not trying to harm anybody, 114 00:04:30,880 --> 00:04:32,120 and it's in a controlled environment. 115 00:04:32,760 --> 00:04:36,520 And also, if it happened after October 28th, 2016. 116 00:04:37,020 --> 00:04:39,400 So obviously, that's already way past that. 117 00:04:39,620 --> 00:04:41,480 So that's good for me. 118 00:04:41,540 --> 00:04:42,260 I'm not gonna get in trouble. 119 00:04:42,420 --> 00:04:42,940 It's my car. 120 00:04:43,260 --> 00:04:44,700 I wanna have some fun with it. 121 00:04:45,460 --> 00:04:46,880 And I always wanted an STI. 122 00:04:46,940 --> 00:04:47,880 I always thought they were pretty cool, 123 00:04:47,980 --> 00:04:50,300 pretty fast, pretty fun cars. 124 00:04:50,620 --> 00:04:52,380 And like I said, I had a 2016 version. 125 00:04:52,380 --> 00:04:57,000 And so, my 2016 version, I spoke here last year 126 00:04:57,000 --> 00:04:58,640 at IoT Village, and I shared some of the findings. 127 00:04:59,300 --> 00:05:01,720 So the first thing I did was, 128 00:05:01,780 --> 00:05:03,440 I found multiple bugs there. 129 00:05:03,580 --> 00:05:06,620 We'll go through what those actually look like. 130 00:05:07,720 --> 00:05:09,320 So let's jump right into the demo 131 00:05:09,320 --> 00:05:11,200 so I can show you exactly what I found, 132 00:05:11,300 --> 00:05:13,440 and go through the methodology of it. 133 00:05:19,020 --> 00:05:20,300 So it's smaller than I would like, 134 00:05:20,400 --> 00:05:22,320 but let's go ahead, and I'll walk you through. 135 00:05:22,320 --> 00:05:26,140 There's no audio right now. 136 00:05:26,200 --> 00:05:27,680 So I figured, hey, I'm from L.A. 137 00:05:27,780 --> 00:05:30,060 Might as well take a video in Santa Monica. 138 00:05:31,220 --> 00:05:33,560 And literally, this is a week after getting my car. 139 00:05:33,680 --> 00:05:34,980 We'll go through the timeline in just a bit. 140 00:05:35,140 --> 00:05:36,580 But I don't even have plates on the thing. 141 00:05:38,040 --> 00:05:41,600 I'm basically right now talking about what I'm gonna show. 142 00:05:41,980 --> 00:05:46,060 And that's unlocking the car, honking the horn, 143 00:05:46,160 --> 00:05:46,980 flashing the lights. 144 00:05:47,140 --> 00:05:50,820 I'm gonna add two users to my Subaru account 145 00:05:50,820 --> 00:05:52,200 that have access to my vehicle. 146 00:05:53,040 --> 00:05:55,240 And also show that the keys are gonna be on the roof. 147 00:05:55,920 --> 00:05:56,840 So I'm locking the vehicle, 148 00:05:56,980 --> 00:05:58,620 making sure it honks so you can see the lights here. 149 00:06:00,320 --> 00:06:01,680 I'm gonna go ahead and put those keys 150 00:06:02,740 --> 00:06:03,760 right on top of the roof. 151 00:06:07,940 --> 00:06:09,320 And from here, I'm setting up, 152 00:06:09,320 --> 00:06:11,340 just gonna show that there are no authorized users 153 00:06:11,340 --> 00:06:12,300 in my Subaru account. 154 00:06:12,720 --> 00:06:13,860 So there's no users here. 155 00:06:13,980 --> 00:06:15,380 They would show up here, email addresses. 156 00:06:17,900 --> 00:06:20,160 So what I'm gonna do is go ahead and run my exploit script 157 00:06:20,160 --> 00:06:21,180 in just a second here. 158 00:06:22,200 --> 00:06:22,700 Then you'll see, 159 00:06:26,140 --> 00:06:27,340 you'll see the magic happen. 160 00:06:28,300 --> 00:06:29,900 So of course, it's a python script, 161 00:06:30,040 --> 00:06:30,940 like everything else, right? 162 00:06:32,600 --> 00:06:35,860 So I'm running my Subaru exploit script here. 163 00:06:37,060 --> 00:06:39,400 And what it's doing is bypassing authorization. 164 00:06:40,520 --> 00:06:44,260 Gaining a session, CSRFing remote service requests. 165 00:06:44,960 --> 00:06:46,320 Meaning unlocking the car, 166 00:06:46,560 --> 00:06:47,740 honking the horn, flashing the lights. 167 00:06:48,120 --> 00:06:49,560 You can also locate the vehicle as well, 168 00:06:49,600 --> 00:06:50,320 like I said, and the owner. 169 00:06:50,740 --> 00:06:52,180 But for this particular vehicle, it's gonna be one of these. 170 00:06:52,200 --> 00:06:56,360 video. It's only unlocking the vehicle, honking the horn, flashing the lights, and adding 171 00:06:56,360 --> 00:07:02,240 two users. So it's going to take just a second. You'll see the lights flash. See, the car 172 00:07:02,240 --> 00:07:07,440 is now unlocked. And we have no audio, but it would honk right now. And I'm going to 173 00:07:07,440 --> 00:07:16,260 go ahead and show the car being unlocked. By the way, I'll take a second. I'm one of 174 00:07:16,260 --> 00:07:20,800 the organizers for AppSec California. It's the last weekend of January, right on the 175 00:07:20,800 --> 00:07:26,140 beach in Santa Monica. So it's an OWASP conference. So here we go. It unlocked. Let's go 176 00:07:26,140 --> 00:07:34,320 ahead and open the door. There it is. Same backpack that I have right here. And now I'm 177 00:07:34,320 --> 00:07:40,620 going to see, still see the keys up here. And now we're going to see that two users have 178 00:07:40,620 --> 00:07:48,500 been added to the account, to the MySubaru account, associated with my car, my vehicle. So 179 00:07:48,500 --> 00:07:50,780 now I have two users here that are, that are, that are doing the same thing. I'm going to 180 00:07:50,780 --> 00:07:53,820 show you what's happening. And you'll see that they're joined. It says car hacking email, 181 00:07:54,000 --> 00:07:58,580 and car hacking email at Gmail, too. Or at one at Gmail. So you'll see it right now. I have 182 00:07:58,580 --> 00:08:13,880 a separate video screen share to show you what's happening on the screen. And these two users 183 00:08:13,880 --> 00:08:18,300 have full access to the vehicle, as in they could unlock the car, honk the horn, flashlights, 184 00:08:18,500 --> 00:08:20,760 view everything, locate, like I said, locate the owners, look at the phone, look at the 185 00:08:20,780 --> 00:08:23,860 security, as well, and the vehicle where it's at. So they have kind of full control. There's no 186 00:08:23,860 --> 00:08:30,560 delegated access to the MySubaru account. So in essence, it's almost their car. So here's, here's 187 00:08:30,560 --> 00:08:35,320 a screen share of the adding authorized users and showing you that there isn't any users here. 188 00:08:35,940 --> 00:08:49,500 This is my vehicle 2017 WRX STI. So no authorized users. Go ahead and just refresh, just to show 189 00:08:49,500 --> 00:08:50,760 you guys that I'm not faking anything. So, here's my vehicle 2017 WRX STI. I'm not faking anything. 190 00:08:50,760 --> 00:09:03,880 You know? And I'll go ahead and run my Python script. Again, bypass authorization here. Takes a 191 00:09:03,880 --> 00:09:08,940 second. It's literally going through the Internet. It's going through AWS is what the provider has. 192 00:09:09,300 --> 00:09:17,120 So it takes about five to ten seconds for the calls to execute. So I added two users here. And 193 00:09:17,120 --> 00:09:20,740 then I'm unlocking the car. And you can see I have a, you can see I have a, you can see I have a 194 00:09:20,760 --> 00:09:29,460 an active session here and now I'm honking the horn and flashing the lights. And then it gives me a 195 00:09:29,460 --> 00:09:44,900 200 okay afterwards. Just a second. So it, it'll honk for 30 seconds. So now that we know we 196 00:09:44,900 --> 00:09:50,600 have two users added here, let's go ahead and log in as those two users. That have 197 00:09:50,600 --> 00:09:55,180 delegated access, or not delegated, but full control. So I'm Aaron here and I'm 198 00:09:55,180 --> 00:09:57,740 logging to, you see there's two different emails. 199 00:10:04,020 --> 00:10:10,720 Now here's a different browser logged in to my car hacking email account. They 200 00:10:10,720 --> 00:10:13,020 don't have to have a Subaru at all, by the way. 201 00:10:18,220 --> 00:10:25,060 So here's the remote services that they have access to. And again, lock, unlock, 202 00:10:25,360 --> 00:10:31,920 honk the horn, locate the vehicle. So that's, that's, those are the demos, those 203 00:10:31,920 --> 00:10:35,520 are the research, the research aspect of it. I'm going to show you kind of the 204 00:10:35,520 --> 00:10:40,740 methodology and the step-by-step process that I took to locate those and discover, 205 00:10:40,960 --> 00:10:43,000 you know, the exploits and how to 206 00:10:43,000 --> 00:10:45,640 locate those. So here's how the vulnerabilities arose. And again, I've 207 00:10:45,640 --> 00:10:53,960 dealt with Subaru at a small capacity last year. So introducing the Subaru WRX 208 00:10:53,960 --> 00:10:57,480 STI, world remote executable. It's all going through the internet, it's all 209 00:10:57,480 --> 00:11:01,060 going through cloud, it's always connected, it worked a hundred percent of 210 00:11:01,060 --> 00:11:04,860 the time. When I first found it, it was literally the week of RSA and I was on 211 00:11:04,860 --> 00:11:08,340 the airplane and I was looking at my camera, of course I have a camera in my 212 00:11:08,340 --> 00:11:11,040 garage, and I was still writing the script and it still worked a hundred, 213 00:11:11,040 --> 00:11:14,620 hundred and twenty percent of the time. And that's because there is a token that 214 00:11:14,620 --> 00:11:19,100 never ever expires and again, there are most service calls, it could be CSRF. So, 215 00:11:20,800 --> 00:11:25,880 so that's how it always worked and also to execute it for an attack, you'd have, 216 00:11:26,040 --> 00:11:32,340 you can utilize the cross-site scripting that I'll show in just a minute. So after, 217 00:11:32,440 --> 00:11:37,040 you know, there, you know, the, the exploits happen. About a beginning of 218 00:11:37,040 --> 00:11:40,860 June, there's some articles written about the research and again, they're, they're, 219 00:11:41,040 --> 00:11:44,900 they're simple, simple findings and we'll just go through them in just a second. So 220 00:11:44,900 --> 00:11:49,900 let's go through the timeline. So again, I purchased a vehicle late January, got the 221 00:11:49,900 --> 00:11:54,960 car delivered a couple days later. I actually, I actually pinged a semi-cam 222 00:11:54,960 --> 00:11:59,680 car and I was like, dude, I got a new car, let's hack it. And about an hour 223 00:11:59,680 --> 00:12:04,580 later, verbatim, I was like, he was like, okay cool, he's all, send me some dumps 224 00:12:04,580 --> 00:12:07,520 and we'll work on something. He was like, alright, I'm just doing some burp-sweet 225 00:12:07,520 --> 00:12:10,560 things, I'm practicing the calls. So then an hour later, 226 00:12:11,040 --> 00:12:13,460 I was like, actually dude, it looks pretty simple to do from the mobile and web app. 227 00:12:13,840 --> 00:12:17,820 Found an off-bypass, system fixation, XSS, and a way to add a user to my 228 00:12:17,820 --> 00:12:22,420 account who can also unlock my, who can also unlock my, my car. Going to script it 229 00:12:22,420 --> 00:12:27,560 up. He was like, dude, nice. So then I created a video three days later at a 230 00:12:27,560 --> 00:12:30,820 park, but I was like, ah, you know, I went to RSA, came back, I felt like I could do 231 00:12:30,820 --> 00:12:36,600 better. So I recorded a video right there in Santa Monica about a couple, you know, 232 00:12:36,600 --> 00:12:41,020 week and a half later. So that's when, once I created the videos, I disclosed 233 00:12:41,040 --> 00:12:45,400 the vulnerabilities to Subaru. They're easy to work with once I found the right peoples 234 00:12:45,400 --> 00:12:54,580 to talk, people to talk to. Subaru acknowledged right away. And about a month from disclosing 235 00:12:54,580 --> 00:13:01,040 the bugs, they fixed the critical findings that were located or discovered, which is 236 00:13:01,040 --> 00:13:06,160 pretty fast for any company really, especially a car manufacturer who doesn't have a security 237 00:13:06,160 --> 00:13:09,400 team. So, but again, they were easy to work with, they were very open. 238 00:13:11,040 --> 00:13:15,640 And even to suggestions as well. They definitely came back, we had some dialogue. So they weren't 239 00:13:15,640 --> 00:13:21,580 closed off to the community at all. About a couple weeks, a few weeks later, they released 240 00:13:21,580 --> 00:13:27,260 a new My Subaru app for Android and iOS. So basically almost all redone, but they still 241 00:13:27,260 --> 00:13:33,400 had the original web application that I was showing. So during that time, I gave a talk 242 00:13:33,400 --> 00:13:38,800 over at a in Australia on an embedded subject. And that's when I got in touch with a journalist 243 00:13:40,120 --> 00:13:41,020 who basically said, hey, I want to talk to you about this. And I was like, okay, I'm 244 00:13:41,040 --> 00:13:43,980 happy to talk to you about this. So I went back and forth with Subaru to verify. And 245 00:13:43,980 --> 00:13:47,800 around the same time, literally the same day that the article published, they also pushed 246 00:13:47,800 --> 00:13:52,500 a new web application, similar to mobile applications. So I don't know if there was 247 00:13:52,500 --> 00:13:56,920 some correlation there. But again, they were easy to work with. They were very 248 00:13:56,920 --> 00:14:01,840 embracive to the community. I usually like to point them in the right direction as well. 249 00:14:02,320 --> 00:14:05,660 So again, pretty, you know, not too bad of a timeline, especially when they were fixed. 250 00:14:05,780 --> 00:14:11,020 The critical bugs, that is. You know, they also gave me some credit on the fact that, you know, 251 00:14:11,020 --> 00:14:16,180 I'm not a big fan of the Android and iOS app. So when I first started looking at this, 252 00:14:16,220 --> 00:14:21,920 when trying to tackle this problem, not this problem, but trying to research a connected 253 00:14:21,920 --> 00:14:27,420 vehicle, you know, I've read the news. I've read the car hacking handbook. I know web 254 00:14:27,420 --> 00:14:34,040 app and mobile hardware hacking. So I knew they had Bluetooth. I started with a threat 255 00:14:34,040 --> 00:14:40,180 model. I knew it had Bluetooth. I knew it had 4G. They ran over AT&T. I knew it had RF for the 256 00:14:40,180 --> 00:14:46,180 key fobs. I knew there was an SD card. I knew there was, I could do something with OBD2, go on 257 00:14:46,180 --> 00:14:49,720 the Canvas research, which is kind of what everybody's doing. I kind of want to do something 258 00:14:49,720 --> 00:14:56,220 different. And I knew I could mess with the ECU or use a third party like Cobb, who basically 259 00:14:56,220 --> 00:15:02,020 flashes the ECU for tuning, which is an area of research that I'm going to get into if anybody 260 00:15:02,020 --> 00:15:07,040 wants to help out. And also infotainment systems. So these are all areas that are kind of 261 00:15:07,040 --> 00:15:10,160 familiar already within the car hacking community. So I'm going to talk a little bit more about the 262 00:15:10,180 --> 00:15:16,060 community or whatever you want to call it. But there's also the easy stuff. And for me, it's 263 00:15:16,060 --> 00:15:24,680 easy stuff, is the apps. Android app, iOS app, and the web app. And for me, you know, this is the 264 00:15:24,680 --> 00:15:31,640 best part about anything connected is it's basically, you know, the attack surface is huge. So 265 00:15:32,120 --> 00:15:37,980 we love IOT, right? It's easy because why? Hard work sucks. I just picked the easiest, weakest 266 00:15:37,980 --> 00:15:40,160 link, you know, with the internet. So I just picked the easiest, weakest link, you know, with the 267 00:15:40,180 --> 00:15:45,380 whole attack surface here. And for me, what's the quickest and fastest without spending so much 268 00:15:45,380 --> 00:15:52,780 time and effort? I figured I'm going to look at the apps first. Granted, if it's an ECU type of 269 00:15:52,780 --> 00:15:56,320 vulnerability or infotainment, sometimes, you know, it will have to go through a whole recall 270 00:15:56,320 --> 00:16:02,940 depending on the severity. But I'm fine with that. I'm fine with going through the mobile apps. So 271 00:16:02,940 --> 00:16:08,260 again, hard work sucks. I'm going to the easiest, weakest link for me, which is the AppSec area. 272 00:16:10,180 --> 00:16:14,200 So where does everybody start in any type of AppSec if you're familiar with mobile? Android, 273 00:16:14,400 --> 00:16:20,220 easiest. So I just assembled the APK, analyzed the classes, methods, see what has any 274 00:16:20,220 --> 00:16:25,880 vulnerabilities, monitored the activities, the services, the intents. I also checked my 275 00:16:25,880 --> 00:16:31,760 last year's findings from that I reported to Subaru. They had some OAuth issues with hard 276 00:16:31,760 --> 00:16:37,140 coding the client secret and client ID. So if anybody's familiar with OAuth, that's another 277 00:16:37,140 --> 00:16:40,160 entry point into getting access. So I'm going to take a look at that. And then I'm going to go 278 00:16:40,180 --> 00:16:44,560 to the next slide. So that was fixed, which was cool. I reviewed the third-party libraries. I 279 00:16:44,560 --> 00:16:50,600 found out it was a hybrid app, so they were using Cordova, OKCTP. So I knew they weren't, you 280 00:16:50,600 --> 00:16:55,520 know, pinning, SSL pinning, so I could proxy. This is before I even touched, you know, installed 281 00:16:55,520 --> 00:17:02,120 the app yet. So afterwards, well, next is actually installing the app and running it. Once I 282 00:17:02,120 --> 00:17:07,320 found some issues within this area, disassembling, monitoring the classes and methods, so I 283 00:17:07,320 --> 00:17:10,160 proxied all the important API calls. And then I took a look at the API calls and I found that 284 00:17:10,180 --> 00:17:15,780 again, logging in, logging out, unlocking, locking the vehicle, honking the horn, flashing the 285 00:17:15,780 --> 00:17:21,440 lights, locating the vehicle and the owner, and adding users. So I'm just doing a recon. I'm not 286 00:17:21,440 --> 00:17:25,920 doing any, you know, injection attack. I'm literally going and burping, categorizing the API 287 00:17:25,920 --> 00:17:34,620 calls. Then I move on to iOS. Similar thing. I just assembled the IPA, dumped and analyzed the 288 00:17:34,620 --> 00:17:40,160 classes and methods, analyzed the runtime behavior. I checked my last year's, you know, 289 00:17:40,180 --> 00:17:47,940 iOS findings. And they had an auto login handoff token, which had been resolved last year when I 290 00:17:47,940 --> 00:17:56,280 talked at IoT Village. Somehow it got re-merged and it is not resolved. So that's a key item here 291 00:17:56,280 --> 00:18:02,360 for me, because any token that's inherently trusted from what it was, it was inherently 292 00:18:02,360 --> 00:18:09,120 trusted from the mobile app to all basically the APIs to everything, basically. So I noted that 293 00:18:09,120 --> 00:18:10,160 down. It wasn't fixed. So I'm going to go ahead and run it. I'm going to go ahead and run it. 294 00:18:10,180 --> 00:18:15,980 I also reported that caching of all requests and responses were occurring. It was kind of resolved. 295 00:18:16,060 --> 00:18:21,000 They took off the sensitive items when caching, but they still cached a lot. It's like, okay, you 296 00:18:21,000 --> 00:18:27,380 know. From there, I continued to analyze storage, P lists, SQLite databases, local storage, 297 00:18:27,700 --> 00:18:32,880 Realm databases as well. Then from there, I proxied the API calls again, similar to the 298 00:18:32,880 --> 00:18:39,100 Android app. Again, log in, log out, unlock, honk the horn, flashlights, locate the vehicle and 299 00:18:39,100 --> 00:18:39,320 owner. 300 00:18:40,980 --> 00:18:46,880 As well as adding users. And there were some different API calls that were made between each 301 00:18:46,880 --> 00:18:51,800 app. So that made me think that, you know, there might be some problems for them to keep 302 00:18:51,800 --> 00:18:59,940 state. So I just noted that down, added a comment and burp. Now, let me demo what I 303 00:18:59,940 --> 00:19:09,260 found last year here for you guys. Just so you guys have some context. It's about a minute 304 00:19:09,260 --> 00:19:10,160 long. So this is a caching app. It's a little bit more complex than the previous one. It's a 305 00:19:10,180 --> 00:19:15,420 caching of all requests and responses here. You can't see, but there's a handoff token that I'm 306 00:19:15,420 --> 00:19:21,560 pointing to. It's very hard to see, but in essence, it's cached. Again, all requests and 307 00:19:21,560 --> 00:19:28,240 responses. So it was sent over the URL. You know, that's a no-no. So then it's in the 308 00:19:28,240 --> 00:19:35,560 cached database for iOS. So what I do is go ahead and, you know, see what tables I have, click in 309 00:19:35,560 --> 00:19:39,380 the middle of any SQLite database, because that's what I always do, just click in the middle. 310 00:19:40,900 --> 00:19:46,760 It's in hex right here, but I'll go ahead and change to text. And again, the handoff token is 311 00:19:46,760 --> 00:19:54,800 right here again. This video was sent to Subaru, by the way, as well, so last year, when it was 312 00:19:54,800 --> 00:20:03,480 fixed. So just copied and pasted it, auto-logged in to the account. This is my old vehicle, by 313 00:20:03,480 --> 00:20:08,660 the way, that wasn't connected. So look, it says I'm logged out. Just copy and paste it again. 314 00:20:10,180 --> 00:20:14,400 Back logged in. You know, back to being logged in, without username, password, or anything. 315 00:20:14,580 --> 00:20:21,700 Just totally copy and paste. So again, that had been fixed, and then was re-merged somehow. 316 00:20:23,840 --> 00:20:31,760 Somehow. So I used that, obviously. I want to gain a valid session into a vehicle account. And 317 00:20:31,760 --> 00:20:39,500 so my next step was to do some recon on the web application. Similar steps, just proxying all, 318 00:20:40,180 --> 00:20:45,120 basically every call I can find within the web application. So I had more capabilities. You 319 00:20:45,120 --> 00:20:52,740 could also change what's called a pin, a four-digit pin. Security questions, as well. Personal data, 320 00:20:52,900 --> 00:20:58,140 and seeing how injection attacks work within the personal data. We'll get to that. This is all 321 00:20:58,140 --> 00:21:03,240 just the recon stage. And again, noted everything down and the differences between API calls and 322 00:21:03,240 --> 00:21:08,360 burp. So from there, I noticed some potential roadblocks between each application and how it 323 00:21:08,860 --> 00:21:10,060 communicated with the server. 324 00:21:11,000 --> 00:21:16,940 I noticed there was unique session IDs, almost as a CSRF token for the mobile apps. I couldn't find 325 00:21:16,940 --> 00:21:23,720 where they were originating from. It didn't look like it was coming from the mobile apps. And it 326 00:21:23,720 --> 00:21:30,840 wasn't coming from the server. I was proxying the request. So I was also, I just moved on. I was in 327 00:21:30,840 --> 00:21:35,800 fear of session expiration, randomization. I wanted to basically have persistent access all the time 328 00:21:35,800 --> 00:21:40,120 and make sure my request always worked and executed. So even if I did a 329 00:21:40,180 --> 00:21:48,060 CSRF in anybody's car, it would still work. And then so if the user configures email alerts, 330 00:21:48,300 --> 00:21:52,000 they would get an email for each remote service call. So unlocking the vehicle, for example. 331 00:21:53,820 --> 00:21:57,240 And I said for most, because if you locate the vehicle, you don't get a notification. 332 00:21:57,600 --> 00:22:02,220 So that's kind of a safety thing there. So those are some of the roadblocks, 333 00:22:02,240 --> 00:22:03,900 this one being the most important here. 334 00:22:07,580 --> 00:22:10,160 So some other observations. Again, authorizing, 335 00:22:10,180 --> 00:22:13,500 the car owner delegates, the authorized users, who the car owner delegates, has full control over 336 00:22:13,500 --> 00:22:20,480 the remote, the remote services. The owner does not get notified of adding users. The authorized 337 00:22:20,480 --> 00:22:26,460 users. I found a cross-site scripting in the vehicle name. So that was key, actually. So token 338 00:22:26,460 --> 00:22:34,400 and cross-site scripting is a way to attack, make this weaponized. That's what I did. There was no 339 00:22:34,400 --> 00:22:38,740 no anti-CSRF tokens for any state-changing configurations, so anything for the pins, 340 00:22:38,980 --> 00:22:48,660 for the security questions, there was no CSRF tokens. And that's for mobile web, all mobile 341 00:22:48,660 --> 00:22:53,800 apps and all web as well, only web app. And notice, obviously, the token never expires. 342 00:22:54,020 --> 00:22:57,560 It didn't even expire after logging out, and we showed that, and even changing the 343 00:22:57,560 --> 00:23:02,480 password. So they had some ACL issues there, some authorization, authentication issues. 344 00:23:02,480 --> 00:23:11,380 And then once you logged into your MySubaru account with a new device, so I have, like, 345 00:23:11,380 --> 00:23:17,160 five, six devices, you would get a new handoff token. So a new handoff token for a token 346 00:23:17,160 --> 00:23:23,160 that never expires, it kind of, you know, expands that attack surface, and I'll show you in 347 00:23:23,160 --> 00:23:28,040 just a bit how that looks like. So not very hard to grab. Again, again, and even if they 348 00:23:28,040 --> 00:23:32,460 change the password, you'll still have access with this handoff token. So, again, 349 00:23:32,460 --> 00:23:37,720 essentially, that's the auth bypass. All you need is the handoff token, which does 350 00:23:37,720 --> 00:23:43,180 not require a username or password. And then, again, URL rewrite everywhere. Everything 351 00:23:43,180 --> 00:23:52,200 over get request, again, which is a no-no for any APIs. So here's the vehicle name 352 00:23:52,200 --> 00:24:00,640 cross-site scripting, unweaponized, but just to show you guys the ability to. And here's 353 00:24:00,640 --> 00:24:02,440 an example of this. 354 00:24:02,460 --> 00:24:06,540 This is my car hacking email account. This is ‑‑ I logged in with three different 355 00:24:06,540 --> 00:24:11,840 devices here. I have three separate tokens that are valid for the account. Again, that 356 00:24:11,840 --> 00:24:18,100 don't expire. And here's car hacking email one. Logged in with three different devices. 357 00:24:18,700 --> 00:24:23,660 Also has three different tokens. So ‑‑ and remember, I added these two users to my 358 00:24:23,660 --> 00:24:28,420 account. So these users can also ‑‑ these tokens are also valid for my account. So 359 00:24:28,420 --> 00:24:32,440 it's, like, kind of, you know, daisy chained almost. So that's not cool. 360 00:24:34,580 --> 00:24:40,520 So some other observations that I found. Again, we talked about get request everywhere. 361 00:24:42,220 --> 00:24:46,240 But those get requests did not have ‑‑ well, they can't see SRF, but they didn't 362 00:24:46,240 --> 00:24:50,000 have any session IDs that I was worried about for the mobile apps. And that's how I was 363 00:24:50,000 --> 00:24:55,620 able to see SRF all the web service calls, the remote service calls. I could just literally 364 00:24:56,010 --> 00:25:02,360 a template them out and enter the values, and they would execute. Again, solves a unique 365 00:25:02,460 --> 00:25:07,620 session ID problems we had with the mobile apps. And then the web application did not 366 00:25:07,620 --> 00:25:13,580 require security questions to execute remote service calls. But the mobile apps did. So 367 00:25:13,580 --> 00:25:21,500 ‑‑ and once you have ‑‑ well, actually, the car pin is a four‑digit pin. It didn't 368 00:25:21,500 --> 00:25:26,280 always have to be sent. It's trusted after for a number of minutes. But it can be changed 369 00:25:26,280 --> 00:25:30,660 without validating the previous pin. As you can see here, it just says create pin and 370 00:25:30,660 --> 00:25:32,120 confirm pin. And then ‑‑ 371 00:25:33,100 --> 00:25:38,180 Here are the security questions. So either way, I mean, you can change those if they 372 00:25:38,180 --> 00:25:42,080 are required, if at some point ‑‑ you can always change those, because they don't ask 373 00:25:42,080 --> 00:25:46,300 you for the pin already, the previous pin. And they don't ask you for the previous security 374 00:25:46,300 --> 00:25:49,620 questions. They ask you just to update them and put new ones in there. 375 00:25:51,880 --> 00:25:56,100 The car is also vulnerable to replay attacks. So the API ‑‑ there was no rate limiting. 376 00:25:56,980 --> 00:26:02,040 You can execute as many as you want. Except not while driving. I know people probably 377 00:26:02,040 --> 00:26:02,220 ‑‑ 378 00:26:02,460 --> 00:26:08,480 I'm thinking that. But not while driving the remote service calls work. But you had to wait 379 00:26:08,480 --> 00:26:13,880 five seconds again because of the Internet. Going through from my connection to AWS and back 380 00:26:13,880 --> 00:26:20,880 to my car via 4G. So at this point, I felt like I had a lot to go off of. I have a token that 381 00:26:20,880 --> 00:26:28,560 never expires. I have cross‑site scripting. I can CSRF my way. I was flying. So at this 382 00:26:28,560 --> 00:26:32,440 point, okay, so I have to chain some of these vulnerabilities together. We're going to have to 383 00:26:32,440 --> 00:26:36,140 do a couple of different things. I created a malicious page with a cross‑site scripting 384 00:26:36,140 --> 00:26:42,300 payload to gain the valid session to acquire the token. And then from there, I added the 385 00:26:42,300 --> 00:26:48,560 users via CSRF. And then I remade the remote service calls via CSRF. So I automated this. 386 00:26:49,480 --> 00:26:54,060 But you can also do it manually and change the pin and change the security questions, 387 00:26:54,180 --> 00:26:59,980 like I mentioned earlier. And also just track the owner. They're not going to get notified 388 00:26:59,980 --> 00:27:02,420 when you log in. And there's no concurrent log in. You're going to have to make a new 389 00:27:02,420 --> 00:27:07,860 so you can log in with 20 different users and the owner would never know or 390 00:27:07,860 --> 00:27:14,300 add as many users as well this was just earlier today this is my car this is me 391 00:27:14,300 --> 00:27:18,840 this is how you could track a user cars over here in California but anyways 392 00:27:18,840 --> 00:27:22,540 it's lovely because it gives you this little location thing here where opens 393 00:27:22,540 --> 00:27:27,380 up maps and it gives you directions right to the vehicle so you can always 394 00:27:27,380 --> 00:27:31,360 basically know where they're at and there's also API API calls for this as 395 00:27:31,360 --> 00:27:35,680 well so you can just use JSON for example JSON output and just over time 396 00:27:35,680 --> 00:27:41,060 track so here are some attack scenarios that people are probably wondering and 397 00:27:41,060 --> 00:27:45,620 again I always use the cross-site scripting as the easiest one to get 398 00:27:45,620 --> 00:27:50,300 executed you can look at the victims logs you can back up the mobile devices 399 00:27:50,300 --> 00:27:57,760 to view or to get access to the handoff token for example you can use you know 400 00:27:57,760 --> 00:28:00,200 any type of man in the middle to victim the trap 401 00:28:00,200 --> 00:28:00,900 to 402 00:28:01,420 --> 00:28:06,320 man-in-the-middle the victim traffic again you can use you can export this 403 00:28:06,320 --> 00:28:12,520 cache TV file via iPhone box for iOS so since these are all over get requests if 404 00:28:12,520 --> 00:28:17,220 you're logged into your my Subaru account over a network that logs or 405 00:28:17,220 --> 00:28:20,960 horror does man-in-the-middle your connections and enterprise that's going 406 00:28:20,960 --> 00:28:25,900 to be leaked any you know type of you know third parties whatever it may be 407 00:28:25,900 --> 00:28:31,200 social engineering you can have the victim log in to their my Subaru 408 00:28:31,360 --> 00:28:34,540 account on on your device and be like yeah just show me a lot your car from 409 00:28:34,540 --> 00:28:42,320 here and you could also again audit logs within not only the mobile apps but also 410 00:28:42,320 --> 00:28:47,740 within the browser or install via malicious applications there's a number 411 00:28:47,740 --> 00:28:51,980 of different techniques and ways you can you can exploit these vulnerabilities 412 00:28:51,980 --> 00:28:57,360 here here's the auto login literally I just press login and it ought to log me 413 00:28:57,360 --> 00:29:00,380 in so if I have you know a victim login with my phone 414 00:29:01,360 --> 00:29:04,560 all I have to do is just press login and I'll have the cache database and 415 00:29:04,560 --> 00:29:10,540 it'll be fine I'll always have access so some other post exploitation scenarios 416 00:29:10,540 --> 00:29:15,320 once I do have access and I did successfully attack a Subaru user or 417 00:29:15,320 --> 00:29:19,280 vehicle I think the obvious is still in the car contents what's in there 418 00:29:20,680 --> 00:29:24,500 sabotage the vehicle's engine pop open the engine and it could be expensive I 419 00:29:24,500 --> 00:29:30,280 know for my car you know it could run up pretty fast or retain persistence to 420 00:29:30,280 --> 00:29:30,840 a car's account 421 00:29:31,360 --> 00:29:35,600 without making any type of changes or adding just adding users in plan out a 422 00:29:35,600 --> 00:29:42,340 band tracker a Wi-Fi pineapple with GSM under the seat maybe in the trunk number 423 00:29:42,340 --> 00:29:45,060 different ways you can do that and you could also attack you know their local 424 00:29:45,060 --> 00:29:50,200 network you know reconnaissance or recon their own a corporate environment 425 00:29:50,200 --> 00:29:50,640 as well 426 00:30:01,360 --> 00:30:05,160 contents whatever's in the car but also themselves for locating for privacy 427 00:30:05,160 --> 00:30:09,780 purposes and there's a top there's a bunch more so as far as a post 428 00:30:09,780 --> 00:30:14,140 exploitation scenarios that you can do once you have access once you 429 00:30:14,140 --> 00:30:18,380 successfully exploited this vulnerability are these but the 430 00:30:18,380 --> 00:30:23,000 likelihood and impact is that okay only mid 2016 and up Subarus have telematics 431 00:30:23,000 --> 00:30:31,180 the owners have to purchase the Subaru Starlink services and it's kind of a 432 00:30:31,180 --> 00:30:33,800 targeted attack right you can't spray and pray this you kind of you have to 433 00:30:33,800 --> 00:30:39,020 know who has a Subaru it has a Subaru with telematics but that's similar to 434 00:30:39,020 --> 00:30:45,380 all IOT and car hacking for the most part it's also warmable via you know the 435 00:30:45,380 --> 00:30:50,720 authorized users that were added to the account so the impacts kind of low for 436 00:30:50,720 --> 00:30:55,340 now again it's the first year that they release this so you know and all their 437 00:30:55,340 --> 00:30:58,640 other vehicles from now you know moving forward are going to be 438 00:30:58,640 --> 00:31:01,160 connected so likelihood right now is it's kind 439 00:31:01,160 --> 00:31:05,080 of low but I see the impact as being high and again moving towards the 440 00:31:05,080 --> 00:31:09,980 future I think it's gonna you know continue to rise and have more features 441 00:31:09,980 --> 00:31:14,700 to be to be exploited for people like us and people like you guys as well you 442 00:31:14,700 --> 00:31:17,800 know just this is why I do the research and trying to share you know my 443 00:31:17,800 --> 00:31:20,940 methodology because you guys can do it too you can see how kind of simple it is 444 00:31:20,940 --> 00:31:24,880 as far as the tools are concerned of what I use feel free to ping me I'll 445 00:31:24,880 --> 00:31:30,900 definitely share those so as far as you know after the facts like I said Subaru 446 00:31:31,160 --> 00:31:36,000 was great to work with I have always tried to point vendors in the right 447 00:31:36,000 --> 00:31:40,220 direction when reporting bugs so I usually point them to disclosure policy 448 00:31:40,220 --> 00:31:46,440 ISO 29147 I point them to NHTSA best practices for modern vehicles the DOT's 449 00:31:46,440 --> 00:31:51,660 federal automated vehicle policy auto ISAC best practices and the 450 00:31:51,660 --> 00:31:55,020 observations and recommendations on connected vehicles connected vehicle 451 00:31:55,020 --> 00:31:59,680 security from cloud security lines most importantly I also point them to the 452 00:31:59,680 --> 00:32:00,720 five-star automotive cyber 453 00:32:01,160 --> 00:32:04,560 safety program for mine the Calvary definitely a great place good 454 00:32:04,560 --> 00:32:10,100 community you know if someone in the connected vehicle space wants to get 455 00:32:10,100 --> 00:32:14,380 involved I think we already have most of the manufacturers working on Subaru 456 00:32:14,380 --> 00:32:19,360 right now who are trying to get involved here or any of these areas but 457 00:32:19,360 --> 00:32:24,240 but moving in the right direction as far as connected vehicle space is concerned 458 00:32:24,920 --> 00:32:27,920 but some of the other lessons are you know learn from others mistakes 459 00:32:28,520 --> 00:32:30,520 continuous testing internal external 460 00:32:31,160 --> 00:32:34,180 some crowdsource pen testing like you know people are doing already with bug 461 00:32:34,180 --> 00:32:40,220 crowd for example or hacker one and similar similar organizations so Subaru 462 00:32:40,220 --> 00:32:44,440 took some steps after I reported those bugs they deployed their new their new 463 00:32:44,440 --> 00:32:48,380 applications they started output encoding they have a last logon message 464 00:32:48,380 --> 00:32:53,580 which is nice they don't send raw credentials over clear text or over HTTP 465 00:32:54,840 --> 00:32:58,720 and here's an example what they send when you're logging into your your 466 00:32:58,720 --> 00:33:00,280 account literally just 467 00:33:02,040 --> 00:33:06,560 stars asterisks but now you get you know you have an account lockout for 468 00:33:06,560 --> 00:33:12,400 incorrect pins you can also deauthorize devices here here's a lockout button 469 00:33:12,400 --> 00:33:16,720 your last log on and here's output encoding it's still like that by the way 470 00:33:16,720 --> 00:33:22,600 today so they're taking steps and that's good you know can't expect them to 471 00:33:22,600 --> 00:33:27,360 be perfect especially without a security team but it's great to see them you know 472 00:33:27,360 --> 00:33:30,260 embrace the culture in the community and trying to work towards 473 00:33:31,160 --> 00:33:35,200 a more you know a secure posture for connected vehicles and they're looking 474 00:33:35,200 --> 00:33:40,520 to get into space like I said so that's all I have before I you know get off the 475 00:33:40,520 --> 00:33:46,920 stage are there any questions one question yes 476 00:33:51,700 --> 00:33:55,460 yeah the question was how easy would this be to repeat for another vehicle 477 00:33:56,180 --> 00:34:01,020 very very simple I think it's happened before with Nissan Leaf similar a similar 478 00:34:01,160 --> 00:34:06,980 type of research but you know for mobile apps they're much simpler but code gets 479 00:34:06,980 --> 00:34:11,380 pushed much more often so and there's web applications so the attack surface is 480 00:34:11,380 --> 00:34:15,020 large so it's very it's very very likely impossible that at a time some 481 00:34:15,020 --> 00:34:19,360 manufacturers going to you know slip up but also fix those issues as well so 482 00:34:19,360 --> 00:34:25,860 it's definitely likely any other last questions yes 483 00:34:25,860 --> 00:34:31,140 What do you think will be the effect to the self-guided apps? 484 00:34:36,360 --> 00:34:41,140 Sure sure so the question was what would be the effect with like autonomous 485 00:34:41,140 --> 00:34:45,160 vehicles in the future for research like this well the well I think the 486 00:34:45,160 --> 00:34:48,940 likelihood will be would be higher because it'll be more more common and 487 00:34:48,940 --> 00:34:52,260 the impacts going to be critical it's going to be really really high and again 488 00:34:52,260 --> 00:34:55,580 it's just a matter of the the vendor turning around the patches quick enough 489 00:34:55,580 --> 00:34:58,900 because you know the risk is always going to be there it's about patching 490 00:34:58,900 --> 00:35:01,140 those vulnerabilities but then within a 491 00:35:01,160 --> 00:35:03,260 acceptable time so definitely likely 492 00:35:05,740 --> 00:35:07,140 alright guys well thank you so much