1 00:00:10,800 --> 00:00:11,980 There we go. 2 00:00:12,160 --> 00:00:14,480 All right, welcome back everybody. 3 00:00:14,480 --> 00:00:18,260 We are here with another of our great DEF CON speakers. 4 00:00:18,260 --> 00:00:30,280 We have Patrick Kiley here, and you can check out his presentation on YouTube where he talked about reverse engineering the Tesla battery management system for more power. 5 00:00:30,280 --> 00:00:32,160 Welcome Patrick, how are you doing today? 6 00:00:32,560 --> 00:00:33,760 I'm great, how are you guys? 7 00:00:33,760 --> 00:00:35,440 Doing all right. 8 00:00:35,660 --> 00:00:36,400 Pretty good. 9 00:00:36,400 --> 00:00:41,200 So can you just kind of give us a little bit of an overview of who you are? 10 00:00:41,920 --> 00:00:49,320 Let people hear a little bit about your presentation just in case they haven't seen it or kind of give a little bit of an overview recap. 11 00:00:50,140 --> 00:00:53,220 Sure, so my name is Patrick Kiley. 12 00:00:53,220 --> 00:00:57,980 I'm a security consultant for Rapid7, part of the penetration testing team. 13 00:00:58,240 --> 00:01:08,180 And I got interested in this project back when I just started looking at how the Tesla kind of worked inside the Model S specifically. 14 00:01:08,180 --> 00:01:10,160 I'd seen how some people had hacked them. 15 00:01:10,520 --> 00:01:14,120 And once I got a chance to peek under the hood, I just wanted to learn more and more. 16 00:01:14,120 --> 00:01:17,800 I was already into car hacking and learning more about this. 17 00:01:17,800 --> 00:01:28,440 And once I realized that there was an upgrade that this car had that nobody had really researched and actually published information about, it kind of gave me a path forward. 18 00:01:28,440 --> 00:01:34,080 So I wanted to see like, okay, how did Tesla actually make this car capable of ludicrous? 19 00:01:34,080 --> 00:01:40,440 And it sent me down a path that was probably the most complicated project I've ever worked on. 20 00:01:40,940 --> 00:01:42,160 That's awesome. 21 00:01:42,320 --> 00:01:47,160 And I believe this is your first time being a main track speaker for DEF CON. 22 00:01:47,160 --> 00:01:47,800 Is that right? 23 00:01:47,800 --> 00:01:48,900 That's correct, yes. 24 00:01:48,900 --> 00:01:49,720 All right. 25 00:01:49,720 --> 00:01:54,980 Well, for anyone that is familiar with DEF CON, we have a tradition that you should be very familiar with by now. 26 00:01:54,980 --> 00:01:56,360 It's called Shot the New. 27 00:01:56,720 --> 00:02:03,620 New speakers are welcomed into the DEF CON speaker collective with a shot of a drink of their choice. 28 00:02:04,980 --> 00:02:11,240 It's to bring them into the community, celebrate their joining, the people that are giving back to the community knowledge. 29 00:02:11,620 --> 00:02:13,060 So thank you. 30 00:02:13,060 --> 00:02:14,000 Here's to you. 31 00:02:14,000 --> 00:02:14,660 Bottoms up. 32 00:02:14,660 --> 00:02:15,800 Cheers, congrats. 33 00:02:16,360 --> 00:02:17,360 Thank you. 34 00:02:21,020 --> 00:02:22,460 That's a mouthful. 35 00:02:23,840 --> 00:02:24,300 Okay. 36 00:02:24,660 --> 00:02:25,540 All right. 37 00:02:25,540 --> 00:02:25,900 Good. 38 00:02:25,900 --> 00:02:28,420 Loosen you up before the questions start getting serious. 39 00:02:29,560 --> 00:02:30,180 Okay. 40 00:02:30,180 --> 00:02:41,440 So first off, like I was blown away by the amount of different like techniques and skill sets that you cruised through in your talk. 41 00:02:41,440 --> 00:02:57,260 You had hardware reversing, hardware debugging, assembly reversing, decompiling, compiled Python, diagnosing obscure third-party issues, binary extraction, just like a crazy amount of things. 42 00:02:57,840 --> 00:03:00,940 Like, how did you go about like piecing all these things together? 43 00:03:00,940 --> 00:03:06,000 Like, how did you find your next steps to go through everything? 44 00:03:06,380 --> 00:03:07,560 Yeah, so piece by piece. 45 00:03:07,560 --> 00:03:10,640 I already had like the mechanical skills. 46 00:03:10,640 --> 00:03:21,440 So, you know, in the past, I've had like a Mustang that I've either replaced the heads on or put a supercharger on, or, you know, things along those lines, replaced exhaust systems on. 47 00:03:21,440 --> 00:03:22,980 So I had the mechanical knowledge already. 48 00:03:22,980 --> 00:03:26,360 I've been doing that for longer than I care to admit. 49 00:03:26,800 --> 00:03:34,000 I think even when I was a teenager, I was tinkering around with automobiles and taking them apart, taking carburetors apart. 50 00:03:34,000 --> 00:03:36,540 So complex, small items like that. 51 00:03:37,080 --> 00:03:43,260 And then just trying to take things apart and figure out how they work has been something I've been doing since I was a child. 52 00:03:43,260 --> 00:03:49,280 My parents told me about how the time I locked them out of the bathroom and then just proceeded to disassemble the toilet. 53 00:03:52,020 --> 00:03:58,240 And I don't remember that, but they remind me of it on pretty much every occasion when I talk about something I've been working on. 54 00:03:58,240 --> 00:04:00,340 So there's that. 55 00:04:00,340 --> 00:04:11,200 So really, once I started getting into it, I already had the reverse engineering skills from just doing some other stuff and had the CAN bus skills. 56 00:04:11,200 --> 00:04:16,840 If you look at some of the previous presentations I've done, I've been poking around CAN bus for some time. 57 00:04:17,620 --> 00:04:26,900 So having the DBC files, it was really trivial to just diagnose the stuff going on within the CAN bus. 58 00:04:26,960 --> 00:04:31,360 From there, it was just, okay, how do I do these other things? 59 00:04:31,360 --> 00:04:41,160 I know that CAN has this protocol that sits on top of the thing itself for running diagnosis called ODX. 60 00:04:41,160 --> 00:04:43,680 So I found those, or called UDS. 61 00:04:43,680 --> 00:04:51,260 I found those ODX files and worked with a car fucker who helped show me how to use them. 62 00:04:51,260 --> 00:04:54,060 He's one of the main guys for the car hacking village. 63 00:04:54,260 --> 00:04:58,620 He showed me how to actually import those into Vehicle Spy and play around with them. 64 00:04:59,420 --> 00:05:01,940 Helped me figure out some of the security access stuff. 65 00:05:01,940 --> 00:05:07,200 I'd already seen some of that from Greg Smith's work, where he figured out how to pop airbags on cars. 66 00:05:07,320 --> 00:05:10,980 So I knew about security access, I just didn't understand the algorithm. 67 00:05:11,400 --> 00:05:16,360 But Tesla's algorithm, fortunately for this vehicle, was incredibly simple. 68 00:05:16,360 --> 00:05:17,640 It's a static seed and key. 69 00:05:17,640 --> 00:05:19,740 There's no transform required. 70 00:05:19,740 --> 00:05:24,960 It's like you request the seed and you reply with a fixed reply and boom, you're in. 71 00:05:25,620 --> 00:05:27,260 So that made that part easy. 72 00:05:27,260 --> 00:05:41,800 And then the rest of it was just piece by piece, digging through the Python code, and then building a test bench, which for any reverse engineering project when you're dealing with a very expensive piece of hardware, try and replicate it on a bench because that was invaluable. 73 00:05:41,800 --> 00:05:51,540 I never would have attempted half the stuff I did if I hadn't proofed it out using a much cheaper variant of it that I just wired together and figured out how to work. 74 00:05:52,600 --> 00:06:04,500 There was one jump in particular that it was right after you had your Tesla towed home, not figuring out what those particular, like what was going on with there. 75 00:06:04,660 --> 00:06:09,540 Like, do you remember like what was the final thing that got you past that hump? 76 00:06:10,680 --> 00:06:12,620 Oh, I remember it really well. 77 00:06:12,620 --> 00:06:14,900 I imagine that there was some stress involved there. 78 00:06:14,900 --> 00:06:15,660 So, yeah. 79 00:06:15,660 --> 00:06:18,860 So, I mean, I was into day two of trying to... 80 00:06:19,900 --> 00:06:20,560 Oh. 81 00:06:22,220 --> 00:06:27,000 Having a little video loss, might be some Wi-Fi interference or something. 82 00:06:27,400 --> 00:06:30,100 I said, no, I'm not here for the weekend. 83 00:06:30,100 --> 00:06:31,560 I'm over in Irvine. 84 00:06:31,660 --> 00:06:33,000 We're here in Rancho Cucamonga. 85 00:06:33,000 --> 00:06:34,040 I'm not coming here. 86 00:06:34,360 --> 00:06:35,520 You can come on Monday. 87 00:06:35,520 --> 00:06:40,120 I'm like, no, I'm gonna bail out and figure the rest of this out at home. 88 00:06:40,120 --> 00:06:43,660 So, I only needed your garage to drop the battery and do that stuff. 89 00:06:44,320 --> 00:06:49,200 If I have to come back for that, I'm really in a SOL type situation. 90 00:06:49,200 --> 00:06:54,280 So, stressing out that for a day and a half, I just started capturing a bunch of logs. 91 00:06:54,280 --> 00:06:59,460 So, just from past experience, I was like, maybe the logs are telling me something. 92 00:06:59,460 --> 00:07:06,920 And the logs weren't great, but they did mention this one file and it was a firmware.rc. 93 00:07:06,920 --> 00:07:08,480 It mentioned that a couple of times. 94 00:07:08,480 --> 00:07:12,320 It kind of just had that around the point where it said error and I could see that it failed. 95 00:07:12,320 --> 00:07:21,500 So, basically, I time stamped, okay, when the car said, you know, fuck you, I'm not actually gonna upgrade or let you redeploy the software. 96 00:07:21,500 --> 00:07:26,680 I kind of noted where that time was and looked right there in the logs and saw an error about that. 97 00:07:26,920 --> 00:07:28,320 And then I just did some searching. 98 00:07:28,320 --> 00:07:34,220 It turns out the Tencent guys, when they did their Tesla gateway reversing, they mentioned that file. 99 00:07:34,220 --> 00:07:36,380 They mentioned how that file was loaded into memory. 100 00:07:36,780 --> 00:07:38,320 I'm like, I've never seen that file before. 101 00:07:38,320 --> 00:07:42,880 I've seen it mentioned, you know, I searched through all my stuff, found a couple references to it. 102 00:07:42,880 --> 00:07:47,120 And then I just like, well, let's just go to the gateway and see if it'll give it to me. 103 00:07:47,120 --> 00:07:50,720 And just to give you a little background, this is not while I have the car. 104 00:07:51,940 --> 00:07:53,280 I had already spent the two days. 105 00:07:53,280 --> 00:07:54,560 I was already flustered. 106 00:07:54,720 --> 00:07:59,300 I had to buy a last minute ticket home, flew home, and I was messing around on my bench. 107 00:07:59,360 --> 00:08:04,060 So I was like, I went to my bench version that had a gateway and said, give me firmware.rc. 108 00:08:04,060 --> 00:08:05,060 It gave it to me. 109 00:08:05,060 --> 00:08:06,380 I'm like, cool. 110 00:08:06,560 --> 00:08:08,200 Okay, you've got this BMS error. 111 00:08:08,200 --> 00:08:10,060 I've already replicated that. 112 00:08:11,200 --> 00:08:12,620 Looked at the values in it. 113 00:08:12,620 --> 00:08:21,800 And I actually have a copy of the map here, but there's no real way to share it, but there's basically a tab separated value file. 114 00:08:21,860 --> 00:08:27,780 And within that file, it tells you the firmware that that particular battery pack ID needs. 115 00:08:27,800 --> 00:08:31,020 And it has a little CRC code. 116 00:08:31,020 --> 00:08:34,120 That CRC code needs to be in that firmware.rc file. 117 00:08:34,120 --> 00:08:44,760 And once that was updated with the correct CRC code and the BMS I knew was firmware version of firmware, I could also see that CRC code being broadcast by the BMS again. 118 00:08:45,120 --> 00:08:46,180 I did that. 119 00:08:46,180 --> 00:08:48,760 And then I was like, okay, well, there's this final CRC file. 120 00:08:48,760 --> 00:08:50,220 How do I figure that out? 121 00:08:50,740 --> 00:08:52,960 I asked some people that I knew. 122 00:08:52,960 --> 00:08:58,380 It's like, hey, I don't know a ton about CRC 32s, but here's what I have. 123 00:08:58,380 --> 00:09:02,000 And here's the file itself with the CRC value. 124 00:09:02,000 --> 00:09:04,440 And then someone said, yo, it's a jam CRC. 125 00:09:04,440 --> 00:09:05,240 Here's a file. 126 00:09:05,240 --> 00:09:08,300 Here's a website you can go to to recreate it. 127 00:09:08,300 --> 00:09:15,400 So I recreated the last CRC line, uploaded it back to the gateway, rebooted the gateway, and the error cleared. 128 00:09:15,400 --> 00:09:17,460 So I'm like, good, I've got a path forward. 129 00:09:17,460 --> 00:09:21,260 I can't wait for the car to actually try all this. 130 00:09:21,260 --> 00:09:27,140 And the car was basically being an asshole as well because the battery wasn't engaging. 131 00:09:27,140 --> 00:09:28,880 It was just dealing with 12 volts. 132 00:09:29,080 --> 00:09:32,640 So a lot of the components, it would just basically shut down after a little while. 133 00:09:32,640 --> 00:09:36,200 So I basically had to make sure it had a good battery maintain on it. 134 00:09:36,360 --> 00:09:41,180 So it sat there for a few minutes to make sure that the 12 volts had enough juice. 135 00:09:41,180 --> 00:09:44,380 And then I tried to get the gateway to go through its process. 136 00:09:44,380 --> 00:09:51,480 And as soon as that car woke up and I heard the clicks of the contactors in the rear, it was like, hallelujah, I figured it out. 137 00:09:52,920 --> 00:09:58,380 There was one other thing that you said you'd missed that you would only say over drinks. 138 00:09:58,380 --> 00:10:00,120 We did just have a drink. 139 00:10:00,240 --> 00:10:01,260 Can you tell us? 140 00:10:01,260 --> 00:10:02,220 No, okay. 141 00:10:02,400 --> 00:10:10,420 It was basically me messing around with the car and putting on a feature that it didn't really need to have that was causing the error. 142 00:10:10,420 --> 00:10:15,340 It's just, you know, different times I was screwing around with something I shouldn't have been. 143 00:10:15,460 --> 00:10:19,640 So it was my own fault is really the crux of what I want to say there. 144 00:10:19,720 --> 00:10:22,260 Fair, so it was to catch you in person over drinks. 145 00:10:22,440 --> 00:10:26,280 Like, I tried to slip that in, didn't expect it to really work. 146 00:10:26,280 --> 00:10:27,400 That was pretty sly. 147 00:10:28,780 --> 00:10:29,900 Nice try, Paisley. 148 00:10:30,640 --> 00:10:31,280 Yep. 149 00:10:32,900 --> 00:10:34,440 Go ahead, go ahead. 150 00:10:34,560 --> 00:10:41,700 Got one question coming in for you that you would have had to pay Tesla about $5,000 to make this transition. 151 00:10:41,700 --> 00:10:44,800 What was the approximate cost for you to do it yourself? 152 00:10:47,920 --> 00:10:49,480 Counting the towing or not? 153 00:10:49,480 --> 00:10:53,520 Let's say not, because maybe somebody will learn from your lesson. 154 00:10:53,800 --> 00:11:05,980 So the fuse itself, where I found on the used market for about 350 bucks, I found the contactors for about 200. 155 00:11:06,280 --> 00:11:10,000 The rest of that was just basically my time and effort and labor. 156 00:11:10,480 --> 00:11:13,400 So just basically meaning my labor. 157 00:11:14,860 --> 00:11:19,200 The rest of the stuff didn't really cost me anything other than just time. 158 00:11:19,200 --> 00:11:22,320 And then of course there were all the components to my bench. 159 00:11:22,500 --> 00:11:30,080 You can buy a Tesla MCU for about $1,700 to $1,000 on eBay or some of the other markets. 160 00:11:30,100 --> 00:11:33,360 And the BMS is running anywhere between 150 and 300. 161 00:11:33,920 --> 00:11:36,480 I wanted to make sure I got a BMS with the shunt. 162 00:11:36,480 --> 00:11:37,360 That was a little bit harder. 163 00:11:37,360 --> 00:11:39,260 I just happened to get lucky and saw one. 164 00:11:41,240 --> 00:11:46,380 But the bench parts, I guess you could consider, were major portions of that all. 165 00:11:46,840 --> 00:11:56,340 And then there is a second kit that I bought just to be safe that was actually the exact part number that Tesla used to do the upgrade. 166 00:11:56,340 --> 00:12:00,580 So basically people would pay for this kit and it would be part of their whole upgrade package. 167 00:12:00,580 --> 00:12:03,580 I bought one of those as well to make sure there wasn't something I was missing. 168 00:12:03,580 --> 00:12:05,200 And that was about another $1,000. 169 00:12:05,720 --> 00:12:12,120 Can people just go to their local junkyard and pull pieces themselves to create a test bench? 170 00:12:12,120 --> 00:12:17,820 And if so, do you think the junkyards really understand the value of this equipment that you're using? 171 00:12:18,760 --> 00:12:21,820 Well, so many people are doing weird things with Teslas. 172 00:12:21,820 --> 00:12:28,180 So I'm sure they can, but I'm not sure how many junkyards you'll be able to find that actually have Teslas out there. 173 00:12:28,620 --> 00:12:35,580 I found the secondary market to be really all, but if you can get one, if you can get to a junkyard and you have one that has an MCU, great. 174 00:12:35,580 --> 00:12:38,520 Getting the BMS would be a pain in the... 175 00:12:38,520 --> 00:12:40,100 I don't even want to think about it. 176 00:12:40,100 --> 00:12:45,160 You basically have to drop the battery pack out of the vehicle to get at that BMS. 177 00:12:45,160 --> 00:12:47,780 There's no way to get at it from any other means. 178 00:12:47,780 --> 00:12:50,020 So doing that in a junkyard would be problematic. 179 00:12:50,160 --> 00:13:00,480 But if you can get that center display and it's not already been snagged, that's the part that you would start with with any test bench, because that's where you learn how to route the card. 180 00:13:00,480 --> 00:13:02,900 That's where you learn to do all the changes. 181 00:13:02,900 --> 00:13:04,540 That's where the gateway is stored. 182 00:13:04,680 --> 00:13:07,880 It really is kind of a central hub of the vehicle. 183 00:13:08,020 --> 00:13:09,620 Yes, go ahead, please. 184 00:13:09,620 --> 00:13:12,740 I was going to say, I keep hearing you mention the gateway. 185 00:13:13,100 --> 00:13:16,100 Like what exactly is the gateway in the car? 186 00:13:16,100 --> 00:13:17,220 Can you talk about that? 187 00:13:17,220 --> 00:13:21,860 Is it like actually like a network router or is this something else? 188 00:13:21,920 --> 00:13:24,240 So it's called the security gateway. 189 00:13:24,840 --> 00:13:29,140 It's a function you'll see on newer CAN bus automobiles. 190 00:13:29,530 --> 00:13:37,440 It basically is a device that kind of exists like a firewall, but not sort of like a firewall that exists between multiple CAN buses. 191 00:13:37,860 --> 00:13:42,060 And in this place, the infotainment unit, the part that actually connects to the internet. 192 00:13:42,060 --> 00:13:48,060 So it acts as a ethernet to CAN bus gateway. 193 00:13:48,700 --> 00:13:53,700 So the ethernet side is what connects to the central display, connects to the instrument cluster. 194 00:13:53,700 --> 00:14:09,620 And then from the central display, there's like the cellular connection, the Wi-Fi connection, a Bluetooth connection, the USB ports, and then has all the logic for how it communicates out on the internet and the rest of it communicates with the rest of the Tesla mothership. 195 00:14:10,260 --> 00:14:13,220 But then the gateway also bridges the various CAN buses. 196 00:14:13,220 --> 00:14:22,420 So it can take a message from say the powertrain CAN bus and copy it onto either the ethernet CAN bus or the chassis CAN bus. 197 00:14:22,420 --> 00:14:27,980 Consequently, it can take messages from those other CAN buses and push them onto the BMS as well. 198 00:14:27,980 --> 00:14:31,820 Because sometimes devices that are not on the same bus need to communicate with one another. 199 00:14:32,420 --> 00:14:40,760 So when you're requesting the firmware, is it coming directly from the gateway or is the gateway like asking these sub devices to say, hey, send me your firmware? 200 00:14:42,980 --> 00:14:49,660 So when, just to clarify your question, are you talking about the firmware file or are you talking about the firmware itself? 201 00:14:49,700 --> 00:14:50,980 Well, kind of both. 202 00:14:50,980 --> 00:14:54,880 I think you did both in your, throughout your talk. 203 00:14:54,900 --> 00:15:02,080 There was one particular place where I noticed that you were issuing a command line to retrieve a file and then you made some changes. 204 00:15:02,080 --> 00:15:07,540 I think it was, you even used VIM, which represent, and then you pushed it back. 205 00:15:07,960 --> 00:15:10,380 Yeah, so that was all from the CID. 206 00:15:10,380 --> 00:15:16,180 So the CID on the vehicle that we're talking about is a NVIDIA Tegra running Ubuntu. 207 00:15:18,580 --> 00:15:21,540 And so it's basically, it's an ARM version of Ubuntu. 208 00:15:21,680 --> 00:15:28,260 All the firmware for all the modules of the vehicle sit within that firmware image. 209 00:15:28,260 --> 00:15:35,840 And then when people talk about how their Tesla gets updates, it has all new firmware and it pushes out firmware updates to all the various modules that need it. 210 00:15:36,020 --> 00:15:45,480 Some module way over here may not need an update so it may not get updated, but that's part of what the gateway and the main system do when they do an update. 211 00:15:45,800 --> 00:15:52,000 The gateway itself does store a few files, but it doesn't store a copy of the entire vehicle's firmware. 212 00:15:52,000 --> 00:16:00,260 The entire vehicle's firmware is stored on the central display, you know, on that Tegra-based Ubuntu system on that little eMMC chip. 213 00:16:00,540 --> 00:16:09,920 That's the same eMMC that people complain about wearing out because of all the logging that's going on, but the image itself has that entire copy of the firmware. 214 00:16:09,920 --> 00:16:24,720 The gateway only has things like the firmware.rc file, the internal.dat file, and a few others, layers like hwids.ecq, which is all the hardware IDs of the vehicle, and it gets that from the CAN bus. 215 00:16:24,720 --> 00:16:35,660 So the gateway does queries during an upgrade, but there are also some crash files that are stored on the gateway because it's easier for it to store on the gateway. 216 00:16:35,660 --> 00:16:45,700 I don't know why it does that, but some of the crash files are stored there as well because I saw on my bench system some images right before the vehicle was crashed. 217 00:16:46,740 --> 00:16:53,080 Okay, so when you say crash, it's not like software crashing, it's like black box from the actual crash. 218 00:16:53,080 --> 00:17:00,260 Yeah, I think there's another actual black box device, but the gateway stores quite a bit of that. 219 00:17:00,340 --> 00:17:08,040 I'm not going to pretend to understand how the whole emergency data recorder function of the vehicle works, but it's there. 220 00:17:08,040 --> 00:17:09,720 Some of the files are on the gateway. 221 00:17:09,720 --> 00:17:16,760 Yeah, that might be an interesting future talk for someone, just reversing the black box of Tesla. 222 00:17:19,340 --> 00:17:23,440 So you also do a lot of stuff with the Car Hacking Village. 223 00:17:23,440 --> 00:17:31,800 Is there anything interesting going on that you want to sort of announce while you're here to get people to come and show up in the Car Hacking Village? 224 00:17:33,180 --> 00:17:34,620 Anything like that? 225 00:17:34,620 --> 00:17:39,540 Your question broke up right at the point where you asked the critical part, so do you mind repeating it? 226 00:17:39,540 --> 00:17:40,380 Oh, yeah, sorry, sorry. 227 00:17:40,380 --> 00:17:43,800 So you're very active in the Car Hacking Village. 228 00:17:43,820 --> 00:17:53,660 Is there anything like interesting going on, like maybe Tesla related or related to your talk that you're going to continue working on, something that you want to like pimp out? 229 00:17:54,020 --> 00:18:01,400 So tomorrow at 10 o'clock, I've got a deep dive into many of the techniques that I covered in the main doc. 230 00:18:01,740 --> 00:18:08,800 And that's basically because, you know, due to the whole change in the online format, some of the stuff got cut off to the talk. 231 00:18:08,800 --> 00:18:16,920 So I have some of the stuff that was cut from my talk itself, but then I also expanded on some additional topics as well. 232 00:18:16,920 --> 00:18:19,820 So I go into some of the binary analysis. 233 00:18:19,820 --> 00:18:22,880 I load up the firmware inside IDA. 234 00:18:23,340 --> 00:18:26,940 I don't get very far, but I show that I was able to load it in IDA. 235 00:18:28,000 --> 00:18:36,240 I do some of the like live UDS techniques, you know, the security access as well as the shunt calibration. 236 00:18:36,660 --> 00:18:39,640 And then it's just another brief overview. 237 00:18:39,640 --> 00:18:42,580 So it's like three different things that I'm kind of talking about. 238 00:18:42,580 --> 00:18:45,180 And then, you know, there's some canned BBC stuff as well. 239 00:18:45,180 --> 00:18:59,540 Other than like the setting up a bench itself, is there any particular like software that or tools that people are required to do this kind of like investigation and playgrounds work with car hacking? 240 00:18:59,800 --> 00:19:06,620 So I was using a not free tool called Vehicle Spy, only because it was very powerful and made it a lot easier. 241 00:19:07,540 --> 00:19:14,420 Canned utils and some of the other stuff out there pretty much make it possible to do whatever you want to out there. 242 00:19:14,420 --> 00:19:16,540 There are a ton of CAN bus interfaces out there. 243 00:19:16,540 --> 00:19:18,020 One of my favorites is the Panda. 244 00:19:18,040 --> 00:19:24,980 So for this, I'm going to give a shout out to the Commodite AI folks for actually making such an awesome CAN bus interface. 245 00:19:25,980 --> 00:19:33,800 Commodite AI is a open source self-driving tool that I'll just let people go out and check it out on their own. 246 00:19:33,800 --> 00:19:35,620 But they also they make a tool called the Panda. 247 00:19:35,740 --> 00:19:37,020 Works really well with the Tesla. 248 00:19:37,020 --> 00:19:39,160 It can connect to three CAN buses at once. 249 00:19:39,780 --> 00:19:43,680 A lot of people that have done hacking on the Tesla use that. 250 00:19:43,680 --> 00:19:45,340 I'm very impressed with it. 251 00:19:45,340 --> 00:19:48,640 It's a very inexpensive tool that'll give you a physical interface. 252 00:19:48,780 --> 00:19:51,600 And from that, you can connect over Wi-Fi or USB. 253 00:19:52,040 --> 00:19:57,060 And from there, directly start messing around with Linux tools that are all free. 254 00:19:57,060 --> 00:19:59,000 And those are all in CAN utils. 255 00:19:59,660 --> 00:20:00,520 That's cool. 256 00:20:00,700 --> 00:20:07,780 What's been Tesla's reaction to the kind of work that you've been doing to get your car to ludicrous speed? 257 00:20:07,860 --> 00:20:15,500 Yeah, so when this talk was accepted, I actually reached out several times and Tesla was very supportive. 258 00:20:15,500 --> 00:20:20,020 They actually just asked to review the slides to make sure there weren't any surprises. 259 00:20:20,020 --> 00:20:22,500 I kind of told them, hey, I'm going to talk about this, this and this. 260 00:20:22,500 --> 00:20:24,360 And they said, yeah, just do us a favor. 261 00:20:24,360 --> 00:20:27,420 Send us a copy of your slides, white paper, et cetera. 262 00:20:27,440 --> 00:20:29,820 So we'll make sure there aren't any gotchas in there. 263 00:20:29,820 --> 00:20:31,680 And they said, yep, everything looks good. 264 00:20:31,680 --> 00:20:32,800 You're good to go. 265 00:20:32,980 --> 00:20:34,360 So very supportive. 266 00:20:34,560 --> 00:20:40,460 They actually have a program called the Security Vehicle Research Program in addition to their bug mounting. 267 00:20:40,460 --> 00:20:48,580 So a vehicle that you're interested in doing security research on can be registered with them and you won't violate any warranties. 268 00:20:48,580 --> 00:20:51,580 So basically, and supposedly, I haven't tried this. 269 00:20:51,580 --> 00:20:54,600 They'll even help you with with some bricking situations. 270 00:20:55,240 --> 00:21:00,600 Didn't need their help on this one, fortunately, but they do do some of the other stuff. 271 00:21:00,860 --> 00:21:01,760 Sorry, excuse me. 272 00:21:01,760 --> 00:21:03,640 I've got a really annoying thing going on. 273 00:21:03,660 --> 00:21:04,780 There we go. 274 00:21:05,620 --> 00:21:07,580 Sorry for anyone that was on the stream. 275 00:21:07,580 --> 00:21:11,700 I'm just constantly getting calendar alerts for the next things that I'm responsible for. 276 00:21:12,140 --> 00:21:26,720 Are there any other things that you're aware of in a Tesla that you could possibly try to unlock or bypass or anything else that either you want to look into or you think that other people might want to look into to build upon your research? 277 00:21:28,800 --> 00:21:30,680 I'd have to think about that one for a bit. 278 00:21:30,680 --> 00:21:36,320 Yeah, there are some things I would like to see where the actual limits are in the BMS. 279 00:21:36,320 --> 00:21:43,880 I would like to understand those, but I don't really have a desire to push past them because you're starting to get into dangerous territory at that point. 280 00:21:43,940 --> 00:21:45,580 I just want to find where they are. 281 00:21:45,580 --> 00:21:49,400 So it's like, all right, here's the variable that actually controls max power. 282 00:21:49,400 --> 00:22:00,340 Here's the power curve that's basically defined state of charge, battery temperature and how much power is available for the various drive inverters and the battery itself. 283 00:22:01,020 --> 00:22:02,760 I'd like to find those. 284 00:22:02,760 --> 00:22:05,720 Hence the additional IDA stuff. 285 00:22:06,040 --> 00:22:13,940 And then just more or less actually get more underneath the hood of how the battery management itself and the drive inverters work. 286 00:22:13,940 --> 00:22:23,960 The drive inverters are not something that I actually have hardware on a bench for, but because they're very expensive, the whole drive inverter is inside the drive unit. 287 00:22:23,960 --> 00:22:30,820 The drive unit is a multi-thousand dollar piece of equipment, but yeah, that's where I would like to go from there. 288 00:22:30,820 --> 00:22:37,040 I want to see where the steps are for the P90D and the P100D because those cars are faster. 289 00:22:38,120 --> 00:22:50,480 So we did get a really good question that was, for those not familiar with the whole gateway CAN bus stuff, would the car be able to phone home after you've made the ludicrous speed modification? 290 00:22:51,140 --> 00:23:02,000 Yeah, so the vehicle within its firmware itself has a function where actually it uploads the config to Tesla on a regular basis. 291 00:23:02,060 --> 00:23:05,680 I think it's like vitals.json and puts it in JSON format. 292 00:23:05,680 --> 00:23:15,660 So basically they take the vehicle's config and whenever, I think it's when the car goes to sleep, it actually uploads that information to Tesla. 293 00:23:15,660 --> 00:23:29,360 So anytime someone makes a change that wasn't done by someone else, or I'm sure even when the service center makes a change, that is going to be seen on Tesla's end, unless of course you figure out a way around that. 294 00:23:30,760 --> 00:23:37,720 I imagine that you're probably no longer under warranty as soon as you root the front panel or something like that. 295 00:23:37,720 --> 00:23:42,180 Um, you know, Magnuson Moss Act protects a lot of stuff. 296 00:23:42,180 --> 00:23:46,800 So, but I'm not a lawyer, so I'm not even going to go there and try and figure it out. 297 00:23:47,300 --> 00:23:54,420 But, you know, it's like, if you root the center display, and you have a problem with your brakes, how are the two related? 298 00:23:55,620 --> 00:23:56,600 You know? 299 00:23:56,600 --> 00:23:57,560 Yeah, fair. 300 00:23:57,640 --> 00:24:04,500 But if you if you root your center display, and you break your center display, it's a totally different situation, right? 301 00:24:04,500 --> 00:24:08,320 That's all a great legal area that I'm not even going to dare go. 302 00:24:09,300 --> 00:24:19,240 And to follow up on that question, if Tesla does get made aware of this bypass that you put into place, could they then reverse it and remove it from you? 303 00:24:20,100 --> 00:24:21,120 I'm sure they have. 304 00:24:21,120 --> 00:24:32,880 I mean, there are stories out there about how people had a ludicrous speed vehicle, and then after they purchased it, it was removed because Tesla said they audited it and found out that it shouldn't have had it and removed it. 305 00:24:33,640 --> 00:24:37,240 And then of course, the person who bought the vehicle was pretty pissed off. 306 00:24:37,240 --> 00:24:40,820 So don't know what the resolution on that was. 307 00:24:40,820 --> 00:24:44,680 But that's also there's there's a huge amount of controversy around the whole supercharging thing. 308 00:24:44,680 --> 00:24:51,140 So if you buy a salvage Tesla, it has supercharging disabled. 309 00:24:52,380 --> 00:24:57,680 Tesla does that it's you know, their prerogatives, their supercharger network, but it makes it very difficult to go on trips. 310 00:24:57,720 --> 00:25:02,740 And people figured out using the same techniques that I'm talking about here on how to re enable that again. 311 00:25:03,520 --> 00:25:12,060 And then there was a thing that came out recently, which basically says, you know, you're opening yourselves up to getting sued by us because you're basically getting something that you shouldn't be. 312 00:25:13,040 --> 00:25:27,540 My only suggestion for Tesla is like, why not verify the safety of it and then only enable it to where they have to pay for it is now you've got a source of revenue, but That was that was going to be my next question, because I know that the after a certain point, 313 00:25:27,540 --> 00:25:32,060 they stopped allowing superchargers to be free for Tesla's. 314 00:25:32,060 --> 00:25:36,020 But it sounds like it's completely disabled on these on salvage vehicles. 315 00:25:36,020 --> 00:25:36,940 It's disabled. 316 00:25:37,220 --> 00:25:42,920 The the way I understand it is if the vehicle has free supercharging, it has free supercharging. 317 00:25:42,940 --> 00:25:46,500 But as soon as the vehicle sold back to Tesla, it's lost. 318 00:25:47,400 --> 00:25:55,440 This particular vehicle has free supercharging because it was purchased with free supercharging, so it should always have that. 319 00:25:55,440 --> 00:25:59,000 But , you know, as I understand, they haven't taken it away from anywhere. 320 00:25:59,000 --> 00:26:06,620 They said, you know, this vehicle will have free supercharging for life unless it has been in an accident and been totaled out by an insurance company. 321 00:26:07,940 --> 00:26:13,520 So it wasn't just like Tesla purchasing it back and then reselling it with it disabled or something like that. 322 00:26:14,740 --> 00:26:17,900 It's like, you know, people trade in their cars, people trade in their Tesla's. 323 00:26:17,900 --> 00:26:20,260 I think when they sell them out again, they don't have free supercharging. 324 00:26:20,260 --> 00:26:20,840 I don't know. 325 00:26:21,000 --> 00:26:21,980 That makes sense. 326 00:26:21,980 --> 00:26:23,260 I don't keep track of their money. 327 00:26:24,180 --> 00:26:25,260 I didn't know. 328 00:26:25,260 --> 00:26:28,940 It seems like a really kind of sketchy area. 329 00:26:28,940 --> 00:26:31,760 So any kind of details that I can pull out of you? 330 00:26:32,180 --> 00:26:33,360 Yeah , their frog is. 331 00:26:33,500 --> 00:26:34,000 Yeah. 332 00:26:34,120 --> 00:26:42,100 So it seems as though with where electric cars are going now, that this is going to be a really great area of research. 333 00:26:42,100 --> 00:26:48,220 And what kind of advice would you give to people that want to get started with car hacking research? 334 00:26:48,220 --> 00:26:51,440 Like if somebody wants to start from the ground up, what sorts of things could they do? 335 00:26:51,440 --> 00:26:52,700 Where should they start looking? 336 00:26:53,400 --> 00:26:54,620 Start learning CAN bus. 337 00:26:54,620 --> 00:26:57,420 That seems to be where a lot of it gets from there. 338 00:26:57,420 --> 00:27:03,860 Learn UDS and from there, learn about like binary reversing and just reverse engineering in general. 339 00:27:03,940 --> 00:27:11,240 Go to a junkyard, find a car that you find interesting, verify, you know, it has CAN bus and start ripping modules out. 340 00:27:11,240 --> 00:27:19,120 We did something with our company called a junkyard hackathon where a bunch of us went out and just ripped apart various vehicles. 341 00:27:19,120 --> 00:27:20,260 Craig Smith helped us. 342 00:27:20,260 --> 00:27:22,680 He's the writer, you know, the car hackers handbook. 343 00:27:22,740 --> 00:27:25,620 And we got like several vehicles worth of modules. 344 00:27:25,620 --> 00:27:33,060 Even if you just get one module, take it apart, figure out what CPU it has, you know, learn how to hardware hack it. 345 00:27:33,100 --> 00:27:34,900 And from there, have fun. 346 00:27:35,500 --> 00:27:41,160 Yeah, I thought I've seen in some of the videos with people hacking on electric cars. 347 00:27:42,260 --> 00:27:50,360 Maybe I'm remembering this wrong, but is there any risk to a car sitting in a junkyard still holding any kind of electrical charge that people should be aware of? 348 00:27:51,200 --> 00:27:55,120 Yeah, because high voltage is high voltage, it'll hurt you either way. 349 00:27:55,400 --> 00:27:58,500 I personally have never been to a junkyard where I've seen electric cars. 350 00:27:58,500 --> 00:28:04,380 I've only seen the salvage yards where they're like the warranty auction places. 351 00:28:04,380 --> 00:28:06,020 And you see those online. 352 00:28:06,360 --> 00:28:10,540 But the actual junkyards themselves, I don't think I've ever seen an electric vehicle in the junkyard. 353 00:28:10,640 --> 00:28:15,940 Even a hybrid would be dangerous, though, because the hybrid still has high voltage because it has an electric motor. 354 00:28:21,420 --> 00:28:24,060 We got one question, and it's kind of more like... 355 00:28:25,900 --> 00:28:31,020 Hawkeye is wondering if Tesla's have a problem with shutting down if their error messages reach a critical amount of storage space. 356 00:28:31,020 --> 00:28:36,120 I'm guessing that has to do with the EMMC logging thing or... 357 00:28:37,360 --> 00:28:39,840 I've never seen one run out of storage space. 358 00:28:39,840 --> 00:28:42,680 It's just the volume of logging. 359 00:28:42,820 --> 00:28:45,360 And I believe at a certain point it overwrites itself. 360 00:28:45,360 --> 00:28:52,980 But just it's the volume of constantly writing to the EMMC that wears it down, not for the device storage actually filling up. 361 00:28:53,840 --> 00:28:56,940 And it's unfortunate because it's like a $20 part. 362 00:28:56,940 --> 00:29:03,900 The EMMC module itself on that Jaguar is a very inexpensive part, but it's a $2,000 repair if you take it to a service center. 363 00:29:05,200 --> 00:29:05,980 Excellent. 364 00:29:07,120 --> 00:29:14,180 So as we start wrapping this up, what sorts of takeaways do you want people to have from your presentation? 365 00:29:14,180 --> 00:29:16,820 And what would be your call to action? 366 00:29:16,820 --> 00:29:23,260 Or what would you like to see come about based on your research and your presentation that you've put out there? 367 00:29:23,980 --> 00:29:35,160 Well, I'd love for someday for Tesla owners to be able to work on their own vehicles, for there to be like a consumer version of the tools that are used to work on and diagnose the vehicles. 368 00:29:35,160 --> 00:29:41,240 Because right now, you just have to take it to the garage and pay the service center to do that. 369 00:29:41,240 --> 00:29:44,580 I can understand why the high voltage components, why you want to do that. 370 00:29:44,580 --> 00:29:49,920 But as these cars age and continue to be out there in the fleet, there needs to be another method. 371 00:29:50,520 --> 00:29:54,560 You know, in addition to that, just this is kind of like the next version of hot rodding. 372 00:29:55,540 --> 00:29:57,180 People are going to figure this out. 373 00:29:57,500 --> 00:30:00,720 Now that, you know, kind of electric cars are becoming more and more mainstream. 374 00:30:01,520 --> 00:30:04,600 There are going to be people that want to buy them and make them faster. 375 00:30:04,600 --> 00:30:14,940 And you can make them faster by either lightening them or you make them faster by, you know, tweaking what's under the hood, just like you would on a, you know, standard internal combustion engine. 376 00:30:14,940 --> 00:30:18,020 So this is kind of like the next phase of where that's going to go. 377 00:30:18,380 --> 00:30:18,900 Awesome. 378 00:30:18,940 --> 00:30:20,420 Thank you so much for doing this. 379 00:30:20,420 --> 00:30:26,720 Thanks so much for your presentation that people can go see on the YouTube with the DEF CON channel. 380 00:30:26,720 --> 00:30:28,220 So thanks for doing this, Patrick. 381 00:30:28,220 --> 00:30:30,840 Really enjoyed you discussing this with us. 382 00:30:31,520 --> 00:30:31,860 All right. 383 00:30:31,860 --> 00:30:32,340 Thank you.