start	end	text
10800	11980	There we go.
12160	14480	All right, welcome back everybody.
14480	18260	We are here with another of our great DEF CON speakers.
18260	20420	We have Patrick Kiley here,
20420	23660	and you can check out his presentation on YouTube
24360	26160	where he talked about reverse engineering
26160	30280	the Tesla battery management system for more power.
30280	32160	Welcome Patrick, how are you doing today?
32560	33760	I'm great, how are you guys?
33760	35440	Doing all right.
35660	36400	Pretty good.
36400	38560	So can you just kind of give us a little bit
38560	41200	of an overview of who you are?
41920	45280	Let people hear a little bit about your presentation
45280	46720	just in case they haven't seen it
46720	49320	or kind of give a little bit of an overview recap.
50140	53220	Sure, so my name is Patrick Kiley.
53220	56080	I'm a security consultant for Rapid7,
56080	57980	part of the penetration testing team.
58240	61020	And I got interested in this project
61600	64480	back when I just started looking at how the Tesla
64480	68180	kind of worked inside the Model S specifically.
68180	70160	I'd seen how some people had hacked them.
70520	72680	And once I got a chance to peek under the hood,
72680	74120	I just wanted to learn more and more.
74120	77800	I was already into car hacking and learning more about this.
77800	80580	And once I realized that there was an upgrade
80580	83500	that this car had that nobody had really researched
83500	86960	and actually published information about,
86960	88440	it kind of gave me a path forward.
88440	89500	So I wanted to see like, okay,
89500	94080	how did Tesla actually make this car capable of ludicrous?
94080	96080	And it sent me down a path
96080	99040	that was probably the most complicated project
99040	100440	I've ever worked on.
100940	102160	That's awesome.
102320	104240	And I believe this is your first time
104240	107160	being a main track speaker for DEF CON.
107160	107800	Is that right?
107800	108900	That's correct, yes.
108900	109720	All right.
109720	112320	Well, for anyone that is familiar with DEF CON,
112320	113860	we have a tradition that you should be
113860	114980	very familiar with by now.
114980	116360	It's called Shot the New.
116720	120480	New speakers are welcomed into the DEF CON speaker collective
120480	123620	with a shot of a drink of their choice.
124980	127000	It's to bring them into the community,
127000	128540	celebrate their joining,
128540	131240	the people that are giving back to the community knowledge.
131620	133060	So thank you.
133060	134000	Here's to you.
134000	134660	Bottoms up.
134660	135800	Cheers, congrats.
136360	137360	Thank you.
141020	142460	That's a mouthful.
143840	144300	Okay.
144660	145540	All right.
145540	145900	Good.
145900	148420	Loosen you up before the questions start getting serious.
149560	150180	Okay.
150180	152520	So first off, like I was blown away
152520	155760	by the amount of different
156720	159260	like techniques and skill sets
159260	161440	that you cruised through in your talk.
161440	165160	You had hardware reversing, hardware debugging,
165160	169420	assembly reversing, decompiling, compiled Python,
169420	174520	diagnosing obscure third-party issues, binary extraction,
174520	177260	just like a crazy amount of things.
177840	180080	Like, how did you go about like piecing
180080	180940	all these things together?
180940	182420	Like, how did you find your next steps
182980	186000	to go through everything?
186380	187560	Yeah, so piece by piece.
187560	190640	I already had like the mechanical skills.
190640	191940	So, you know, in the past,
191940	195640	I've had like a Mustang that I've either replaced
195640	198040	the heads on or put a supercharger on,
198040	200020	or, you know, things along those lines,
200020	201440	replaced exhaust systems on.
201440	202980	So I had the mechanical knowledge already.
202980	206360	I've been doing that for longer than I care to admit.
206800	208540	I think even when I was a teenager,
208540	210360	I was tinkering around with automobiles
210360	214000	and taking them apart, taking carburetors apart.
214000	216540	So complex, small items like that.
217080	219960	And then just trying to take things apart
219960	221380	and figure out how they work
221380	223260	has been something I've been doing since I was a child.
223260	224640	My parents told me about how the time
224640	226220	I locked them out of the bathroom
226220	229280	and then just proceeded to disassemble the toilet.
232020	233320	And I don't remember that,
233320	236060	but they remind me of it on pretty much every occasion
236060	238240	when I talk about something I've been working on.
238240	240340	So there's that.
240340	243360	So really, once I started getting into it,
243360	246800	I already had the reverse engineering skills
246800	248240	from just doing some other stuff
248240	251200	and had the CAN bus skills.
251200	254260	If you look at some of the previous presentations I've done,
254260	256840	I've been poking around CAN bus for some time.
257620	260320	So having the DBC files,
260320	263720	it was really trivial to just diagnose
264380	266900	the stuff going on within the CAN bus.
266960	270020	From there, it was just, okay,
270020	271360	how do I do these other things?
271360	274180	I know that CAN has this protocol
274180	279000	that sits on top of the thing itself
279000	281160	for running diagnosis called ODX.
281160	283680	So I found those, or called UDS.
283680	287980	I found those ODX files and worked with a car fucker
287980	291260	who helped show me how to use them.
291260	294060	He's one of the main guys for the car hacking village.
294260	296320	He showed me how to actually import those
296320	298620	into Vehicle Spy and play around with them.
299420	301940	Helped me figure out some of the security access stuff.
301940	304260	I'd already seen some of that from Greg Smith's work,
304260	307200	where he figured out how to pop airbags on cars.
307320	309140	So I knew about security access,
309140	310980	I just didn't understand the algorithm.
311400	315060	But Tesla's algorithm, fortunately for this vehicle,
315060	316360	was incredibly simple.
316360	317640	It's a static seed and key.
317640	319740	There's no transform required.
319740	321560	It's like you request the seed
321560	324960	and you reply with a fixed reply and boom, you're in.
325620	327260	So that made that part easy.
327260	330140	And then the rest of it was just piece by piece,
330140	331740	digging through the Python code,
331740	334060	and then building a test bench,
334060	335960	which for any reverse engineering project
335960	338340	when you're dealing with a very expensive piece of hardware,
338340	341800	try and replicate it on a bench because that was invaluable.
341800	344220	I never would have attempted half the stuff I did
344220	346020	if I hadn't proofed it out
346020	348860	using a much cheaper variant of it
348860	351540	that I just wired together and figured out how to work.
352600	354800	There was one jump in particular
355380	359220	that it was right after you had your Tesla towed home,
359220	362680	not figuring out what those particular,
362680	364500	like what was going on with there.
364660	368040	Like, do you remember like what was the final thing
368040	369540	that got you past that hump?
370680	372620	Oh, I remember it really well.
372620	374900	I imagine that there was some stress involved there.
374900	375660	So, yeah.
375660	378860	So, I mean, I was into day two of trying to...
379900	380560	Oh.
382220	384020	Having a little video loss,
384020	387000	might be some Wi-Fi interference or something.
387400	390100	I said, no, I'm not here for the weekend.
390100	391560	I'm over in Irvine.
391660	393000	We're here in Rancho Cucamonga.
393000	394040	I'm not coming here.
394360	395520	You can come on Monday.
395520	398820	I'm like, no, I'm gonna bail out
398820	400120	and figure the rest of this out at home.
400120	401280	So, I only needed your garage
401280	403660	to drop the battery and do that stuff.
404320	405660	If I have to come back for that,
405660	409200	I'm really in a SOL type situation.
409200	412400	So, stressing out that for a day and a half,
412400	414280	I just started capturing a bunch of logs.
414280	417360	So, just from past experience,
417360	419460	I was like, maybe the logs are telling me something.
419460	421080	And the logs weren't great,
421080	424100	but they did mention this one file
424620	426920	and it was a firmware.rc.
426920	428480	It mentioned that a couple of times.
428480	430360	It kind of just had that around the point
430360	432320	where it said error and I could see that it failed.
432320	434540	So, basically, I time stamped,
434540	437380	okay, when the car said, you know, fuck you,
437380	439620	I'm not actually gonna upgrade
439620	441500	or let you redeploy the software.
441500	443620	I kind of noted where that time was
443620	444880	and looked right there in the logs
444880	446680	and saw an error about that.
446920	448320	And then I just did some searching.
448320	450160	It turns out the Tencent guys,
450160	453240	when they did their Tesla gateway reversing,
453240	454220	they mentioned that file.
454220	456380	They mentioned how that file was loaded into memory.
456780	458320	I'm like, I've never seen that file before.
458320	459360	I've seen it mentioned, you know,
459360	460640	I searched through all my stuff,
460640	462880	found a couple references to it.
462880	464880	And then I just like, well, let's just go to the gateway
464880	467120	and see if it'll give it to me.
467120	468500	And just to give you a little background,
468500	470720	this is not while I have the car.
471940	473280	I had already spent the two days.
473280	474560	I was already flustered.
474720	477300	I had to buy a last minute ticket home, flew home,
477300	479300	and I was messing around on my bench.
479360	481880	So I was like, I went to my bench version
481880	484060	that had a gateway and said, give me firmware.rc.
484060	485060	It gave it to me.
485060	486380	I'm like, cool.
486560	488200	Okay, you've got this BMS error.
488200	490060	I've already replicated that.
491200	492620	Looked at the values in it.
492620	495180	And I actually have a copy of the map here,
495180	497380	but there's no real way to share it,
497380	501800	but there's basically a tab separated value file.
501860	504220	And within that file, it tells you the firmware
504220	507780	that that particular battery pack ID needs.
507800	511020	And it has a little CRC code.
511020	514120	That CRC code needs to be in that firmware.rc file.
514120	516840	And once that was updated with the correct CRC code
516840	520960	and the BMS I knew was firmware version of firmware,
520960	523120	I could also see that CRC code being broadcast
523120	524760	by the BMS again.
525120	526180	I did that.
526180	528760	And then I was like, okay, well, there's this final CRC file.
528760	530220	How do I figure that out?
530740	532960	I asked some people that I knew.
532960	536340	It's like, hey, I don't know a ton about CRC 32s,
537040	538380	but here's what I have.
538380	542000	And here's the file itself with the CRC value.
542000	544440	And then someone said, yo, it's a jam CRC.
544440	545240	Here's a file.
545240	548300	Here's a website you can go to to recreate it.
548300	552260	So I recreated the last CRC line,
552260	553580	uploaded it back to the gateway,
553580	555400	rebooted the gateway, and the error cleared.
555400	557460	So I'm like, good, I've got a path forward.
557460	561260	I can't wait for the car to actually try all this.
561260	564800	And the car was basically being an asshole as well
564800	567140	because the battery wasn't engaging.
567140	568880	It was just dealing with 12 volts.
569080	570680	So a lot of the components,
570680	572640	it would just basically shut down after a little while.
572640	573620	So I basically had to make sure
573620	576200	it had a good battery maintain on it.
576360	578180	So it sat there for a few minutes
578180	581180	to make sure that the 12 volts had enough juice.
581180	582980	And then I tried to get the gateway
582980	584380	to go through its process.
584380	586100	And as soon as that car woke up
586100	588320	and I heard the clicks of the contactors in the rear,
588320	591480	it was like, hallelujah, I figured it out.
592920	595780	There was one other thing that you said you'd missed
595780	598380	that you would only say over drinks.
598380	600120	We did just have a drink.
600240	601260	Can you tell us?
601260	602220	No, okay.
602400	605080	It was basically me messing around with the car
605080	609180	and putting on a feature that it didn't really need to have
609180	610420	that was causing the error.
610420	612740	It's just, you know, different times
612740	615340	I was screwing around with something I shouldn't have been.
615460	618200	So it was my own fault is really the crux
618200	619640	of what I want to say there.
619720	622260	Fair, so it was to catch you in person over drinks.
622440	624400	Like, I tried to slip that in,
624870	626280	didn't expect it to really work.
626280	627400	That was pretty sly.
628780	629900	Nice try, Paisley.
630640	631280	Yep.
632900	634440	Go ahead, go ahead.
634560	636600	Got one question coming in for you
637110	639700	that you would have had to pay Tesla about $5,000
639700	641700	to make this transition.
641700	644800	What was the approximate cost for you to do it yourself?
647920	649480	Counting the towing or not?
649480	650680	Let's say not,
650680	653520	because maybe somebody will learn from your lesson.
653800	659920	So the fuse itself,
659920	663480	where I found on the used market for about 350 bucks,
663480	665980	I found the contactors for about 200.
666280	667820	The rest of that was just basically
667820	670000	my time and effort and labor.
670480	673400	So just basically meaning my labor.
674860	677380	The rest of the stuff didn't really cost me anything
677380	679200	other than just time.
679200	682320	And then of course there were all the components to my bench.
682500	687440	You can buy a Tesla MCU for about $1,700 to $1,000
688000	690080	on eBay or some of the other markets.
690100	693360	And the BMS is running anywhere between 150 and 300.
693920	696480	I wanted to make sure I got a BMS with the shunt.
696480	697360	That was a little bit harder.
697360	699260	I just happened to get lucky and saw one.
701240	703980	But the bench parts, I guess you could consider,
703980	706380	were major portions of that all.
706840	709840	And then there is a second kit that I bought
709840	713640	just to be safe that was actually the exact part number
713640	716340	that Tesla used to do the upgrade.
716340	717980	So basically people would pay for this kit
717980	720580	and it would be part of their whole upgrade package.
720580	721620	I bought one of those as well
721620	723580	to make sure there wasn't something I was missing.
723580	725200	And that was about another $1,000.
725720	728420	Can people just go to their local junkyard
728420	732120	and pull pieces themselves to create a test bench?
732120	734380	And if so, do you think the junkyards
734380	736360	really understand the value of this equipment
736360	737820	that you're using?
738760	741820	Well, so many people are doing weird things with Teslas.
741820	744760	So I'm sure they can,
744760	746400	but I'm not sure how many junkyards you'll be able to find
746400	748180	that actually have Teslas out there.
748620	750800	I found the secondary market to be really all,
750800	752520	but if you can get one, if you can get to a junkyard
752520	755580	and you have one that has an MCU, great.
755580	758520	Getting the BMS would be a pain in the...
758520	760100	I don't even want to think about it.
760100	762320	You basically have to drop the battery pack
762320	765160	out of the vehicle to get at that BMS.
765160	767780	There's no way to get at it from any other means.
767780	770020	So doing that in a junkyard would be problematic.
770160	771500	But if you can get that center display
771500	773740	and it's not already been snagged,
773740	776660	that's the part that you would start with
776660	778080	with any test bench,
778080	780480	because that's where you learn how to route the card.
780480	782900	That's where you learn to do all the changes.
782900	784540	That's where the gateway is stored.
784680	787880	It really is kind of a central hub of the vehicle.
788020	789620	Yes, go ahead, please.
789620	792740	I was going to say, I keep hearing you mention the gateway.
793100	796100	Like what exactly is the gateway in the car?
796100	797220	Can you talk about that?
797220	800280	Is it like actually like a network router
800280	801860	or is this something else?
801920	804240	So it's called the security gateway.
804840	809140	It's a function you'll see on newer CAN bus automobiles.
809530	812620	It basically is a device that kind of exists like a firewall,
812620	814400	but not sort of like a firewall
815020	817440	that exists between multiple CAN buses.
817860	819780	And in this place, the infotainment unit,
819780	822060	the part that actually connects to the internet.
822060	828060	So it acts as a ethernet to CAN bus gateway.
828700	831960	So the ethernet side is what connects to the central display,
831960	833700	connects to the instrument cluster.
833700	835300	And then from the central display,
835300	836560	there's like the cellular connection,
836560	839060	the Wi-Fi connection, a Bluetooth connection,
839060	843380	the USB ports, and then has all the logic
843380	845500	for how it communicates out on the internet
845500	846640	and the rest of it communicates
846640	849620	with the rest of the Tesla mothership.
850260	853220	But then the gateway also bridges the various CAN buses.
853220	856260	So it can take a message from say the powertrain CAN bus
856780	859720	and copy it onto either the ethernet CAN bus
859720	862420	or the chassis CAN bus.
862420	865140	Consequently, it can take messages from those other CAN buses
865140	867980	and push them onto the BMS as well.
867980	870240	Because sometimes devices that are not on the same bus
870240	871820	need to communicate with one another.
872420	874100	So when you're requesting the firmware,
874100	875760	is it coming directly from the gateway
875760	878740	or is the gateway like asking these sub devices
878740	880760	to say, hey, send me your firmware?
882980	885500	So when, just to clarify your question,
885500	886980	are you talking about the firmware file
887440	889660	or are you talking about the firmware itself?
889700	890980	Well, kind of both.
890980	894880	I think you did both in your, throughout your talk.
894900	896880	There was one particular place where I noticed
896880	900660	that you were issuing a command line to retrieve a file
900660	902080	and then you made some changes.
902080	904820	I think it was, you even used VIM, which represent,
905940	907540	and then you pushed it back.
907960	910380	Yeah, so that was all from the CID.
910380	913580	So the CID on the vehicle that we're talking about
913580	916180	is a NVIDIA Tegra running Ubuntu.
918580	921540	And so it's basically, it's an ARM version of Ubuntu.
921680	925040	All the firmware for all the modules of the vehicle
925820	928260	sit within that firmware image.
928260	930880	And then when people talk about how their Tesla gets updates,
930880	933960	it has all new firmware and it pushes out firmware updates
933960	935840	to all the various modules that need it.
936020	938200	Some module way over here may not need an update
938200	939500	so it may not get updated,
939500	941240	but that's part of what the gateway
941240	945480	and the main system do when they do an update.
945800	949020	The gateway itself does store a few files,
949020	952000	but it doesn't store a copy of the entire vehicle's firmware.
952000	954020	The entire vehicle's firmware is stored
954020	955680	on the central display,
955680	957900	you know, on that Tegra-based Ubuntu system
957900	960260	on that little eMMC chip.
960540	963380	That's the same eMMC that people complain about wearing out
963380	964920	because of all the logging that's going on,
964920	969920	but the image itself has that entire copy of the firmware.
969920	974140	The gateway only has things like the firmware.rc file,
974140	977360	the internal.dat file, and a few others,
977360	980700	layers like hwids.ecq,
981140	983100	which is all the hardware IDs of the vehicle,
983100	984720	and it gets that from the CAN bus.
984720	987600	So the gateway does queries during an upgrade,
987600	992580	but there are also some crash files
992580	993580	that are stored on the gateway
993580	995660	because it's easier for it to store on the gateway.
995660	996820	I don't know why it does that,
996820	999460	but some of the crash files are stored there as well
999460	1002020	because I saw on my bench system
1002020	1005700	some images right before the vehicle was crashed.
1006740	1008540	Okay, so when you say crash,
1008540	1009900	it's not like software crashing,
1009900	1013080	it's like black box from the actual crash.
1013080	1017680	Yeah, I think there's another actual black box device,
1017680	1020260	but the gateway stores quite a bit of that.
1020340	1022280	I'm not going to pretend to understand
1022280	1025840	how the whole emergency data recorder function
1025840	1028040	of the vehicle works, but it's there.
1028040	1029720	Some of the files are on the gateway.
1029720	1033200	Yeah, that might be an interesting future talk for someone,
1033200	1036760	just reversing the black box of Tesla.
1039340	1043440	So you also do a lot of stuff with the Car Hacking Village.
1043440	1045900	Is there anything interesting going on
1045900	1048960	that you want to sort of announce while you're here
1048960	1051800	to get people to come and show up in the Car Hacking Village?
1053180	1054620	Anything like that?
1054620	1056620	Your question broke up right at the point
1056620	1058340	where you asked the critical part,
1058340	1059540	so do you mind repeating it?
1059540	1060380	Oh, yeah, sorry, sorry.
1060380	1063800	So you're very active in the Car Hacking Village.
1063820	1066480	Is there anything like interesting going on,
1066480	1068520	like maybe Tesla related or related to your talk
1068520	1071780	that you're going to continue working on,
1071780	1073660	something that you want to like pimp out?
1074020	1078280	So tomorrow at 10 o'clock,
1078280	1080180	I've got a deep dive into many of the techniques
1080180	1081400	that I covered in the main doc.
1081740	1084280	And that's basically because, you know,
1084280	1086540	due to the whole change in the online format,
1087100	1088800	some of the stuff got cut off to the talk.
1088800	1093200	So I have some of the stuff that was cut from my talk itself,
1093200	1096040	but then I also expanded on some additional topics
1096040	1099820	as well. So I go into some of the binary analysis.
1099820	1102880	I load up the firmware inside IDA.
1103340	1106940	I don't get very far, but I show that I was able to load it in IDA.
1108000	1112380	I do some of the like live UDS techniques,
1112380	1116240	you know, the security access as well as the shunt calibration.
1116660	1119640	And then it's just another brief overview.
1119640	1122580	So it's like three different things that I'm kind of talking about.
1122580	1125180	And then, you know, there's some canned BBC stuff as well.
1125180	1129820	Other than like the setting up a bench itself,
1129820	1133580	is there any particular like software that or tools that people are required
1133580	1139540	to do this kind of like investigation and playgrounds work with car hacking?
1139800	1144160	So I was using a not free tool called Vehicle Spy,
1144160	1146620	only because it was very powerful and made it a lot easier.
1147540	1151260	Canned utils and some of the other stuff out there pretty much
1151760	1154420	make it possible to do whatever you want to out there.
1154420	1156540	There are a ton of CAN bus interfaces out there.
1156540	1158020	One of my favorites is the Panda.
1158040	1161320	So for this, I'm going to give a shout out to the Commodite AI folks
1161320	1164980	for actually making such an awesome CAN bus interface.
1165980	1170840	Commodite AI is a open source self-driving tool
1170840	1173800	that I'll just let people go out and check it out on their own.
1173800	1175620	But they also they make a tool called the Panda.
1175740	1177020	Works really well with the Tesla.
1177020	1179160	It can connect to three CAN buses at once.
1179780	1183680	A lot of people that have done hacking on the Tesla use that.
1183680	1185340	I'm very impressed with it.
1185340	1188640	It's a very inexpensive tool that'll give you a physical interface.
1188780	1191600	And from that, you can connect over Wi-Fi or USB.
1192040	1197060	And from there, directly start messing around with Linux tools that are all free.
1197060	1199000	And those are all in CAN utils.
1199660	1200520	That's cool.
1200700	1203960	What's been Tesla's reaction to the kind of work
1203960	1207780	that you've been doing to get your car to ludicrous speed?
1207860	1211020	Yeah, so when this talk was accepted,
1211020	1215500	I actually reached out several times and Tesla was very supportive.
1215500	1220020	They actually just asked to review the slides to make sure there weren't any surprises.
1220020	1222500	I kind of told them, hey, I'm going to talk about this, this and this.
1222500	1224360	And they said, yeah, just do us a favor.
1224360	1227420	Send us a copy of your slides, white paper, et cetera.
1227440	1229820	So we'll make sure there aren't any gotchas in there.
1229820	1231680	And they said, yep, everything looks good.
1231680	1232800	You're good to go.
1232980	1234360	So very supportive.
1234560	1238800	They actually have a program called the Security Vehicle Research Program
1238800	1240460	in addition to their bug mounting.
1240460	1246220	So a vehicle that you're interested in doing security research on can be registered with them
1246220	1248580	and you won't violate any warranties.
1248580	1251580	So basically, and supposedly, I haven't tried this.
1251580	1254600	They'll even help you with with some bricking situations.
1255240	1260600	Didn't need their help on this one, fortunately, but they do do some of the other stuff.
1260860	1263640	Sorry, excuse me. I've got a really annoying thing going on.
1263660	1264780	There we go.
1265620	1267580	Sorry for anyone that was on the stream.
1267580	1271700	I'm just constantly getting calendar alerts for the next things that I'm responsible for.
1272140	1279620	Are there any other things that you're aware of in a Tesla that you could possibly try to unlock or bypass
1279620	1286720	or anything else that either you want to look into or you think that other people might want to look into to build upon your research?
1288800	1290680	I'd have to think about that one for a bit.
1290680	1296320	Yeah, there are some things I would like to see where the actual limits are in the BMS.
1296320	1303880	I would like to understand those, but I don't really have a desire to push past them because you're starting to get into dangerous territory at that point.
1303940	1305580	I just want to find where they are.
1305580	1309400	So it's like, all right, here's the variable that actually controls max power.
1309400	1320340	Here's the power curve that's basically defined state of charge, battery temperature and how much power is available for the various drive inverters and the battery itself.
1321020	1322760	I'd like to find those.
1322760	1325720	Hence the additional IDA stuff.
1326040	1333940	And then just more or less actually get more underneath the hood of how the battery management itself and the drive inverters work.
1333940	1343960	The drive inverters are not something that I actually have hardware on a bench for, but because they're very expensive, the whole drive inverter is inside the drive unit.
1343960	1350820	The drive unit is a multi-thousand dollar piece of equipment, but yeah, that's where I would like to go from there.
1350820	1357040	I want to see where the steps are for the P90D and the P100D because those cars are faster.
1358120	1370480	So we did get a really good question that was, for those not familiar with the whole gateway CAN bus stuff, would the car be able to phone home after you've made the ludicrous speed modification?
1371140	1382000	Yeah, so the vehicle within its firmware itself has a function where actually it uploads the config to Tesla on a regular basis.
1382060	1385680	I think it's like vitals.json and puts it in JSON format.
1385680	1395660	So basically they take the vehicle's config and whenever, I think it's when the car goes to sleep, it actually uploads that information to Tesla.
1395660	1409360	So anytime someone makes a change that wasn't done by someone else, or I'm sure even when the service center makes a change, that is going to be seen on Tesla's end, unless of course you figure out a way around that.
1410760	1417720	I imagine that you're probably no longer under warranty as soon as you root the front panel or something like that.
1417720	1426800	Um, you know, Magnuson Moss Act protects a lot of stuff. So, but I'm not a lawyer, so I'm not even going to go there and try and figure it out.
1427300	1434420	But, you know, it's like, if you root the center display, and you have a problem with your brakes, how are the two related?
1435620	1436600	You know?
1436600	1437560	Yeah, fair.
1437640	1444500	But if you if you root your center display, and you break your center display, it's a totally different situation, right?
1444500	1448320	That's all a great legal area that I'm not even going to dare go.
1449300	1459240	And to follow up on that question, if Tesla does get made aware of this bypass that you put into place, could they then reverse it and remove it from you?
1460100	1472880	I'm sure they have. I mean, there are stories out there about how people had a ludicrous speed vehicle, and then after they purchased it, it was removed because Tesla said they audited it and found out that it shouldn't have had it and removed it.
1473640	1484680	And then of course, the person who bought the vehicle was pretty pissed off. So don't know what the resolution on that was. But that's also there's there's a huge amount of controversy around the whole supercharging thing.
1484680	1491140	So if you buy a salvage Tesla, it has supercharging disabled.
1492380	1497680	Tesla does that it's you know, their prerogatives, their supercharger network, but it makes it very difficult to go on trips.
1497720	1502740	And people figured out using the same techniques that I'm talking about here on how to re enable that again.
1503520	1512060	And then there was a thing that came out recently, which basically says, you know, you're opening yourselves up to getting sued by us because you're basically getting something that you shouldn't be.
1513040	1522020	My only suggestion for Tesla is like, why not verify the safety of it and then only enable it to where they have to pay for it is now you've got a source of revenue, but
1522660	1532060	That was that was going to be my next question, because I know that the after a certain point, they stopped allowing superchargers to be free for Tesla's.
1532060	1536020	But it sounds like it's completely disabled on these on salvage vehicles.
1536020	1542920	It's disabled. The the way I understand it is if the vehicle has free supercharging, it has free supercharging.
1542940	1546500	But as soon as the vehicle sold back to Tesla, it's lost.
1547400	1555440	This particular vehicle has free supercharging because it was purchased with free supercharging, so it should always have that.
1555440	1559000	But, you know, as I understand, they haven't taken it away from anywhere.
1559000	1566620	They said, you know, this vehicle will have free supercharging for life unless it has been in an accident and been totaled out by an insurance company.
1567940	1573520	So it wasn't just like Tesla purchasing it back and then reselling it with it disabled or something like that.
1574740	1577900	It's like, you know, people trade in their cars, people trade in their Tesla's.
1577900	1580260	I think when they sell them out again, they don't have free supercharging.
1580260	1580840	I don't know.
1581000	1581980	That makes sense.
1581980	1583260	I don't keep track of their money.
1584180	1585260	I didn't know.
1585260	1588940	It seems like a really kind of sketchy area.
1588940	1591760	So any kind of details that I can pull out of you?
1592180	1593360	Yeah, their frog is.
1593500	1594000	Yeah.
1594120	1602100	So it seems as though with where electric cars are going now, that this is going to be a really great area of research.
1602100	1608220	And what kind of advice would you give to people that want to get started with car hacking research?
1608220	1611440	Like if somebody wants to start from the ground up, what sorts of things could they do?
1611440	1612700	Where should they start looking?
1613400	1614620	Start learning CAN bus.
1614620	1617420	That seems to be where a lot of it gets from there.
1617420	1623860	Learn UDS and from there, learn about like binary reversing and just reverse engineering in general.
1623940	1631240	Go to a junkyard, find a car that you find interesting, verify, you know, it has CAN bus and start ripping modules out.
1631240	1639120	We did something with our company called a junkyard hackathon where a bunch of us went out and just ripped apart various vehicles.
1639120	1640260	Craig Smith helped us.
1640260	1642680	He's the writer, you know, the car hackers handbook.
1642740	1645620	And we got like several vehicles worth of modules.
1645620	1653060	Even if you just get one module, take it apart, figure out what CPU it has, you know, learn how to hardware hack it.
1653100	1654900	And from there, have fun.
1655500	1661160	Yeah, I thought I've seen in some of the videos with people hacking on electric cars.
1662260	1670360	Maybe I'm remembering this wrong, but is there any risk to a car sitting in a junkyard still holding any kind of electrical charge that people should be aware of?
1671200	1675120	Yeah, because high voltage is high voltage, it'll hurt you either way.
1675400	1678500	I personally have never been to a junkyard where I've seen electric cars.
1678500	1684380	I've only seen the salvage yards where they're like the warranty auction places.
1684380	1686020	And you see those online.
1686360	1690540	But the actual junkyards themselves, I don't think I've ever seen an electric vehicle in the junkyard.
1690640	1695940	Even a hybrid would be dangerous, though, because the hybrid still has high voltage because it has an electric motor.
1701420	1704060	We got one question, and it's kind of more like...
1705900	1711020	Hawkeye is wondering if Tesla's have a problem with shutting down if their error messages reach a critical amount of storage space.
1711020	1716120	I'm guessing that has to do with the EMMC logging thing or...
1717360	1719840	I've never seen one run out of storage space.
1719840	1722680	It's just the volume of logging.
1722820	1725360	And I believe at a certain point it overwrites itself.
1725360	1732980	But just it's the volume of constantly writing to the EMMC that wears it down, not for the device storage actually filling up.
1733840	1736940	And it's unfortunate because it's like a $20 part.
1736940	1743900	The EMMC module itself on that Jaguar is a very inexpensive part, but it's a $2,000 repair if you take it to a service center.
1745200	1745980	Excellent.
1747120	1754180	So as we start wrapping this up, what sorts of takeaways do you want people to have from your presentation?
1754180	1756820	And what would be your call to action?
1756820	1763260	Or what would you like to see come about based on your research and your presentation that you've put out there?
1763980	1775160	Well, I'd love for someday for Tesla owners to be able to work on their own vehicles, for there to be like a consumer version of the tools that are used to work on and diagnose the vehicles.
1775160	1781240	Because right now, you just have to take it to the garage and pay the service center to do that.
1781240	1784580	I can understand why the high voltage components, why you want to do that.
1784580	1789920	But as these cars age and continue to be out there in the fleet, there needs to be another method.
1790520	1794560	You know, in addition to that, just this is kind of like the next version of hot rodding.
1795540	1797180	People are going to figure this out.
1797500	1800720	Now that, you know, kind of electric cars are becoming more and more mainstream.
1801520	1804600	There are going to be people that want to buy them and make them faster.
1804600	1814940	And you can make them faster by either lightening them or you make them faster by, you know, tweaking what's under the hood, just like you would on a, you know, standard internal combustion engine.
1814940	1818020	So this is kind of like the next phase of where that's going to go.
1818380	1820420	Awesome. Thank you so much for doing this.
1820420	1826720	Thanks so much for your presentation that people can go see on the YouTube with the DEF CON channel.
1826720	1828220	So thanks for doing this, Patrick.
1828220	1830840	Really enjoyed you discussing this with us.
1831520	1832340	All right. Thank you.