1 00:00:00,000 --> 00:00:09,560 Hi, today I'd like to share my experience on how to relay NFC traffic for Tesla Model 3. 2 00:00:11,800 --> 00:00:15,440 So my name is Kevin2600. 3 00:00:15,440 --> 00:00:24,080 I'm currently working for a company called InGeek in Shanghai, China, and we're focused on research and pen testing for smart car security. 4 00:00:24,080 --> 00:00:29,980 We also built a project called CarSRC, which is China's first car security response center. 5 00:00:31,520 --> 00:00:43,320 So you're welcome to follow me on Twitter on Kevin2600 or just if you're interested and check out a barcode here for a company website, right? 6 00:00:43,400 --> 00:00:48,740 Okay, so here's our content for today. 7 00:00:48,740 --> 00:00:54,940 First, I'd like to talk about some basic knowledge and the applications regarding to NFC. 8 00:00:54,940 --> 00:00:58,240 And then I think maybe I should... 9 00:01:01,540 --> 00:01:08,860 And then I will talk about the key fobs architecture for Tesla Model 3. 10 00:01:08,860 --> 00:01:19,160 And eventually, I will walk through the challenge we have faced and how do we bypass it during the NFC relay research, right? 11 00:01:19,460 --> 00:01:22,080 So NFC 101. 12 00:01:22,100 --> 00:01:30,120 I don't think we need to talk about too much on this at this point because a lot of people already know about NFC. 13 00:01:30,120 --> 00:01:34,120 But basically, NFC stands for Near Field Communication. 14 00:01:34,120 --> 00:01:42,220 It's most likely operating on passive mode and it's really working in close range. 15 00:01:42,220 --> 00:01:44,340 We are talking about centimeters here. 16 00:01:44,340 --> 00:01:50,200 And the operation frequency is usually going to be 13.56 MHz. 17 00:01:50,200 --> 00:01:57,160 And you can use things called NDEF to change the data back and forth, right? 18 00:01:57,160 --> 00:02:02,400 So the NFC technology is already widely developed, right? 19 00:02:02,400 --> 00:02:07,020 So we can see a lot of applications based on it in today's world. 20 00:02:07,020 --> 00:02:19,380 So for example, our payment system, our passport, and our card for access our business buildings are all most likely NFC or RFID based. 21 00:02:20,480 --> 00:02:25,200 And then there's a new trend for using NFC for car keys. 22 00:02:25,260 --> 00:02:28,340 And here's some of car manufacturers already using it. 23 00:02:28,340 --> 00:02:37,540 As we can see, like BMW or BYD and like our main target today, Tesla, they're using it. 24 00:02:37,540 --> 00:02:42,520 And they come with different size of forms, right? 25 00:02:42,520 --> 00:02:49,160 So interestingly, even Apple has enabled a new feature called car key for the latest. 26 00:02:49,720 --> 00:02:56,700 So yeah, I think the digital car keys is really the future. 27 00:02:57,160 --> 00:03:03,220 And now speaking of Tesla, Elon Musk, he's so proud of it. 28 00:03:03,220 --> 00:03:08,080 He mentioned that Tesla is a sophisticated computer on wheels, right? 29 00:03:08,080 --> 00:03:13,860 So if it's a computer, the hackers or security research will be interested in it. 30 00:03:14,240 --> 00:03:19,440 And so here's a small list that I grabbed from the Tesla website. 31 00:03:19,440 --> 00:03:27,340 As you can see, there are many researches, researchers has found vulnerability and report to Tesla for the past few years. 32 00:03:27,340 --> 00:03:29,500 And so for example... 33 00:03:31,980 --> 00:03:33,500 Oh, sorry. 34 00:03:33,920 --> 00:03:34,900 Okay. 35 00:03:34,900 --> 00:03:43,140 So for example, the famous hacks from Tencent King Labs, they were able to exploit the Wi-Fi stack on Tesla Model S. 36 00:03:43,140 --> 00:03:49,440 And then they also done a great experiment on Tesla Autopilot. 37 00:03:49,440 --> 00:03:53,040 So if you guys are interested, I recommend that you check it out. 38 00:03:53,080 --> 00:03:57,420 Also, there's some more independent researcher. 39 00:03:57,420 --> 00:04:03,880 So for example, one guy called Richard Zhu, he won the last year Pwn2Own competition. 40 00:04:03,880 --> 00:04:08,680 He basically able to pawn the Tesla IVI system. 41 00:04:08,780 --> 00:04:11,820 Also, there is another researcher from Belgian. 42 00:04:11,820 --> 00:04:19,900 He's able to successfully crack the key, the encryptions used by Tesla Model S. 43 00:04:19,900 --> 00:04:26,080 And then he's able to successfully clone the entire key. 44 00:04:26,260 --> 00:04:30,400 So I think this is quite cool, right? 45 00:04:32,700 --> 00:04:39,480 However, it turns out that not just the hackers or security researchers are interested in Tesla. 46 00:04:39,480 --> 00:04:43,220 So are those professional thieves, right? 47 00:04:43,220 --> 00:04:48,040 But they don't care about how to write perfect exploits for RCE. 48 00:04:48,040 --> 00:04:53,080 They only want to steal the vehicles or something left inside, right? 49 00:04:53,080 --> 00:04:57,040 So they only want some very simple way. 50 00:04:57,240 --> 00:05:02,140 And it turns out that one of the simplest ways for them is called a key file relay attack. 51 00:05:02,140 --> 00:05:08,100 I think this is all over the news for the past few months or even last year. 52 00:05:09,280 --> 00:05:23,640 You're going to see some guy come to your neighborhood with some mystery device that it can amplify your key file and then somehow turn on your vehicles and drive away. 53 00:05:23,760 --> 00:05:28,720 And this is also the reason why we start to research on Tesla. 54 00:05:28,820 --> 00:05:35,980 Because we must try to see if it's possible to do the NFC relay for the Tesla Model 3, right? 55 00:05:36,640 --> 00:05:42,740 Okay, so Tesla key file architecture. 56 00:05:42,740 --> 00:05:44,320 So let's talk about this. 57 00:05:44,500 --> 00:05:50,100 Okay, so before I start, I'd like to talk about some research procedures. 58 00:05:51,360 --> 00:05:58,400 The first, usually when we start to research something, we usually start with some reconnaissance, right? 59 00:05:58,580 --> 00:06:05,980 So basically, at this stage, we try to read as many as possible the menus regarding your target. 60 00:06:06,120 --> 00:06:17,500 And also you can sit down with your friends, your colleagues, and to do some brainstorm to see what kind of attack factors that you can have, right? 61 00:06:17,500 --> 00:06:25,640 And once you have that ready, then you can really just sit down and actually implement some attack plans. 62 00:06:25,640 --> 00:06:31,060 And then you can go to actually doing it, right? 63 00:06:31,060 --> 00:06:43,340 So usually when we're testing for like Tesla here, we are not expecting that it will success in the first time. 64 00:06:43,340 --> 00:06:46,480 So usually it will fail, but that's okay. 65 00:06:46,480 --> 00:06:48,240 We just try harder and repeat. 66 00:06:48,240 --> 00:06:50,340 Eventually, we'll find something, right? 67 00:06:50,340 --> 00:06:51,500 Cool. 68 00:06:52,400 --> 00:07:02,860 So for Tesla, now in order to access the Model 3, Tesla has provided us three different ways, right? 69 00:07:02,860 --> 00:07:16,520 For example, we can use NFC tag, and Tesla also provided mobile apps for us to try to control your car through Bluetooth. 70 00:07:16,860 --> 00:07:25,500 And later, they also provided the physical key fob, also have been using Bluetooth and NFC here, okay? 71 00:07:26,020 --> 00:07:32,740 And just like any other radio device, Tesla key fobs, we can find a thing called FCCID. 72 00:07:32,880 --> 00:07:44,040 So this is important for us at a recon stage, because first we need to know as much as possible regarding your target, right? 73 00:07:44,040 --> 00:08:00,980 So from here, we search the FCCID to the website, and then we can find, say, for example, we can find that Tesla Model 3 key fob using a CC2640 chipset. 74 00:08:01,440 --> 00:08:10,280 And also, this is also for key fob reader, the reader module, and also having to using CC2640. 75 00:08:10,280 --> 00:08:22,920 So by this information, really, we can have even without even actually open the... even without own one of these vehicles, you already know something about it, right? 76 00:08:22,920 --> 00:08:24,200 That's pretty cool. 77 00:08:24,360 --> 00:08:48,900 Now, regarding the NFC key tag itself, actually, it's just like any other NFC tag, it supports ISO 14443 type A, and also ISO 7864 standards. 78 00:08:48,900 --> 00:08:51,520 And basically, it's a Java smart cards. 79 00:08:51,520 --> 00:09:02,840 So we can use in some already already exist application to group graph this information, right? 80 00:09:02,840 --> 00:09:05,580 There's a lot of application can do as you can see here. 81 00:09:06,020 --> 00:09:14,540 Yeah, the difference between those two ISO standards, one is contact, and one is contacts. 82 00:09:14,540 --> 00:09:16,580 They are very similar. 83 00:09:16,580 --> 00:09:22,280 And on top of application layer, they all the same, just using APTU to talk to your car. 84 00:09:23,300 --> 00:09:39,100 Okay, so and, and then I recommend that people serious about researching on RFID security, you definitely need to go get one of the PM ProSmart 3. 85 00:09:39,760 --> 00:09:42,140 Yeah, I think this is very important. 86 00:09:42,140 --> 00:09:50,940 So basically, we can use in PM3 to, to identify your, your targets, which is key file here. 87 00:09:50,940 --> 00:10:03,220 And I can see identify as an XP MyFair DeathFire 4k EV1 type card. 88 00:10:03,220 --> 00:10:07,880 Okay, so and here's a little summary here. 89 00:10:07,880 --> 00:10:10,960 So the test NFC key tag is seven bytes. 90 00:10:11,700 --> 00:10:13,760 He uses seven byte UID. 91 00:10:13,920 --> 00:10:16,840 And it is a Java based card. 92 00:10:17,800 --> 00:10:25,720 The most important part is here is the actually using the ECDH for a challenge response for authentication. 93 00:10:26,200 --> 00:10:35,400 So and as I mentioned, ProSmart 3 is really helpful during the research, as you can see the picture right here. 94 00:10:35,640 --> 00:10:45,780 I, we are able to use in ProSmart 3 to talk to, to send different commands, APTU commands to your target, to the tag. 95 00:10:45,780 --> 00:10:58,440 And we can able to get some information out, for example, a public key, or different Java updates, like sending different AID to require different Java update to do some testing. 96 00:10:58,440 --> 00:10:59,560 So yeah. 97 00:11:00,780 --> 00:11:02,680 And right. 98 00:11:03,960 --> 00:11:07,600 So now I think it's time for some real hacks, right? 99 00:11:07,600 --> 00:11:08,580 Cool. 100 00:11:08,620 --> 00:11:18,780 Um, so since our goal here is actually to get NIC relay working, and there are many research has done great jobs in this area already. 101 00:11:18,780 --> 00:11:23,340 So in beginning, we don't want to reinvent the wheels. 102 00:11:23,340 --> 00:11:32,080 So we've, we just do some research and find there's a very cool application called NLC gate. 103 00:11:32,100 --> 00:11:40,700 And NLC gate is basically is Android application is the mean for capture, analyzing, or even modified NLC traffic on file. 104 00:11:40,700 --> 00:11:42,440 So basically, it's pretty cool. 105 00:11:42,440 --> 00:11:44,800 It's perfect for us, right? 106 00:11:44,800 --> 00:11:51,300 And he operated it, basically, we need to mobile phone at running the NLC gate. 107 00:11:51,560 --> 00:11:55,780 And we need to set our Wi Fi server in the middle, right? 108 00:11:55,780 --> 00:12:00,660 So can true to send to relay through the traffic. 109 00:12:01,380 --> 00:12:15,060 Um, so yeah, so for the first for the test run, um, we're, we're trying to target our credit card system to see if we can buy a coffee for free, right? 110 00:12:15,060 --> 00:12:19,040 So with someone's, with my colleague's card, basically. 111 00:12:19,040 --> 00:12:22,960 So, and so here's the result I would like to show you. 112 00:12:24,380 --> 00:12:38,440 Right, so basically, we try to was one of the colleague to pretend to be a bad guys and me just try to read out the someone else's card, right? 113 00:12:45,630 --> 00:12:49,010 Yeah, as you can see, the traffic is already go through. 114 00:12:52,110 --> 00:12:58,030 We're successfully to buy, to get coffee for free. 115 00:12:58,690 --> 00:13:02,550 And by this point, we're very, yeah. 116 00:13:02,650 --> 00:13:05,010 Yeah, by this point, we're very happy. 117 00:13:05,010 --> 00:13:11,350 So we run to a parking lot for hours to test the Model 3. 118 00:13:14,070 --> 00:13:17,890 Unfortunately, it failed for the first attempt, right? 119 00:13:17,890 --> 00:13:22,130 As I mentioned, usually it will fail for the first time. 120 00:13:22,610 --> 00:13:26,730 But let's find out why it happened. 121 00:13:26,730 --> 00:13:28,870 What happened exactly, right? 122 00:13:29,310 --> 00:13:51,730 Okay, so and again, we brought out our Porsche Model 3 and start to capture and compare the NX traffic between the actual Tesla key tag and the other which relate by the NFC gate to do some, to see if there's anything I'm, we were missed. 123 00:13:53,650 --> 00:14:03,930 And yeah, so here are the traffic data we captured by PM3, Porsche Model 3. 124 00:14:04,190 --> 00:14:08,010 And also here are the traffic we captured by NFC gate itself. 125 00:14:08,010 --> 00:14:10,470 It has a logging file function. 126 00:14:10,470 --> 00:14:30,390 So as you can see, one of the response by the tag is it can convert back to convert the hex string to something we can read as a Tesla logic, which indicate that it is Tesla's NFC key tag. 127 00:14:30,530 --> 00:14:40,530 Okay, so let's walk through some those hex strings, try to understand what's going on here. 128 00:14:40,530 --> 00:14:44,790 So first, yeah, so this is important here, right? 129 00:14:44,790 --> 00:14:46,830 So first, the 130 00:14:50,290 --> 00:15:08,310 the reader, the sorry, the reader will send out a request asking for Tesla logic AID for like TBK, which stands for Tesla phone key. 131 00:15:08,730 --> 00:15:25,490 But because we are actually using the NFC key tag, our reader, our tag will respond with 6D00, which means instruction invalid, which is, which means this particular AID doesn't exist. 132 00:15:25,850 --> 00:15:34,630 So and then the Tesla will send another request, will send another request asking for TKC, which is Tesla key card. 133 00:15:34,630 --> 00:15:40,390 And yes, executed successfully by like 9T00. 134 00:15:40,770 --> 00:15:46,650 And because we are using Tesla key card, so yeah, it does exist. 135 00:15:46,650 --> 00:15:51,430 So then the reader will send and select this particular AID. 136 00:15:51,430 --> 00:15:56,630 Okay, now, like this is a Tesla logic update list, right? 137 00:15:56,630 --> 00:16:02,630 And then the reader will send out authentication command for this particular AID. 138 00:16:02,630 --> 00:16:09,210 And like they send out a vehicle public key and followed by a 16-byte challenge. 139 00:16:09,210 --> 00:16:16,190 Now for the tag itself, we have to respond with a 16-byte response. 140 00:16:16,830 --> 00:16:30,990 And once we have that sorted out, then we are authenticated to the reader and then we can do action like open the car, open the door or close the door and stuff, something like that, right? 141 00:16:31,190 --> 00:16:38,250 So as you can see, the whole authentication process is kind of simple. 142 00:16:38,410 --> 00:16:43,910 But why we endlessly read a tag on credit card system, it works. 143 00:16:43,910 --> 00:16:45,890 The Model 3 is not. 144 00:16:45,950 --> 00:16:56,550 And turns out, the reason is the payment terminal, the POR system is not required to stop the transaction if it takes longer time. 145 00:16:56,930 --> 00:17:01,130 But the Tesla, on the other hand, has more restriction on timing. 146 00:17:01,130 --> 00:17:05,990 It has to respond in a very specific time. 147 00:17:06,090 --> 00:17:07,910 Otherwise, it will be time out. 148 00:17:08,050 --> 00:17:14,450 If we say, if we didn't respond to the correct answer on AID on time and then it failed, right? 149 00:17:14,450 --> 00:17:25,230 So because we are related, remember we are related traffic through Wi-Fi network and there's a lot lot of things can happen during this transaction. 150 00:17:25,730 --> 00:17:33,130 So now our job is to increase our speed. 151 00:17:33,230 --> 00:17:36,270 And luckily, there's a great researcher called Stefano. 152 00:17:36,270 --> 00:17:39,710 He is kind enough to give us some advice. 153 00:17:40,550 --> 00:17:45,850 But unfortunately, this second attempt also failed. 154 00:17:45,850 --> 00:17:47,930 But thanks for him. 155 00:17:49,450 --> 00:17:51,390 Let's try harder, right? 156 00:17:51,390 --> 00:17:52,370 Let's see. 157 00:17:53,770 --> 00:18:07,950 And then my colleague, Alex, he came up with some idea to verify because at that point, we're not really sure if it is a timing issue only or maybe something else blocked the way. 158 00:18:08,050 --> 00:18:22,150 So his idea is instead related traffic by Wi-Fi, maybe we're using the USB cables because all the traffic then you transfer locally. 159 00:18:22,150 --> 00:18:25,690 So it's supposed to be very very fast, right? 160 00:18:25,690 --> 00:18:28,190 Let's see if that works. 161 00:18:28,870 --> 00:18:32,270 So here's our first video. 162 00:18:32,670 --> 00:18:38,610 You can always check out YouTube on this for later, right? 163 00:18:39,210 --> 00:18:41,070 Yeah, cool. 164 00:18:41,070 --> 00:18:45,030 As you can see, we actually relay by the USB. 165 00:18:45,030 --> 00:18:46,170 It works. 166 00:18:46,170 --> 00:18:48,510 So it is timing. 167 00:18:48,510 --> 00:18:53,570 It is where you have to find a way to increase the speed. 168 00:18:54,050 --> 00:18:55,470 But how? 169 00:18:58,660 --> 00:19:11,520 And then, yes, we found another trick from the same guy, Salvador, which is inspiring us a lot. 170 00:19:11,520 --> 00:19:17,920 Because basically, he has given a talk at DEF CON 26. 171 00:19:17,920 --> 00:19:27,480 Basically, he was able to bypass the payment limit by simply replacing a certain value during the transaction. 172 00:19:27,700 --> 00:19:30,460 And also, he can able to replay. 173 00:19:30,660 --> 00:19:44,520 Also, again, same trick, replace different values in order to instead of using EMV, he actually turned to using MACDRIVE for payment systems. 174 00:19:44,520 --> 00:19:46,580 So let's get us thinking. 175 00:19:46,800 --> 00:19:48,600 Can we do the same? 176 00:19:51,160 --> 00:19:58,300 So let's go back to the traffic we captured by ProSmart 3. 177 00:20:00,260 --> 00:20:09,380 So basically, remember we mentioned that the first reader will send out... 178 00:20:10,000 --> 00:20:15,640 they're asking for a particular Java update AID, which never exists. 179 00:20:15,640 --> 00:20:17,780 It actually starts at 4. 180 00:20:17,800 --> 00:20:22,800 And then, because it doesn't exist, it will be failed. 181 00:20:22,800 --> 00:20:29,520 So they send another request asking for another Java update called Star Wars 74. 182 00:20:29,880 --> 00:20:34,060 So can we do something about here? 183 00:20:36,420 --> 00:20:38,760 And definitely, yes. 184 00:20:38,760 --> 00:20:46,760 So let's... sorry, I draw a very ugly picture here, but let me try to explain what happened. 185 00:20:46,760 --> 00:20:56,960 So basically, first, Test.mod3 will send out... the reader will send out a request looking for a Java update F4. 186 00:20:56,960 --> 00:21:09,060 But because it doesn't exist, the tag will reply response with 60.0.0, so it doesn't exist. 187 00:21:09,780 --> 00:21:19,620 And so that... instead we redirect the 60.0.0, we send... 188 00:21:22,720 --> 00:21:29,130 we actually forwarding... instead of looking for F4, we're forwarding that... 189 00:21:30,060 --> 00:21:35,320 you're asking for 74, because we know that 74, a Java update, does exist. 190 00:21:35,680 --> 00:21:50,120 And because... and then, obviously, tag will receive this request, will say, okay, you are... you're asking for 74, then we... it doesn't exist, and then we just respond with 90.0.0. 191 00:21:50,120 --> 00:21:51,100 And you will... 192 00:21:51,100 --> 00:22:00,480 and then we're using another MVC gate to send those response back. 193 00:22:00,480 --> 00:22:03,300 Because... and that takes some time here. 194 00:22:03,300 --> 00:22:15,820 So by the time we're processing this command, the Test.mod3 will send another request looking for... the actual request sending... looking for 74. 195 00:22:15,820 --> 00:22:21,520 And that's the one actual... the real one sent by the models, read module. 196 00:22:22,120 --> 00:22:27,760 But we... because we are in the middle, so we drop it, right? 197 00:22:27,900 --> 00:22:30,600 We don't need a second 74. 198 00:22:30,640 --> 00:22:39,600 So now by the time we finish... we've done this, the 90.0.0 has already arrived. 199 00:22:39,640 --> 00:22:44,700 So by this end, so we can just forward it to the Test.mod3. 200 00:22:44,700 --> 00:22:46,320 And once Test.mod3... 201 00:22:46,880 --> 00:22:48,520 seems interesting here now. 202 00:22:48,520 --> 00:22:52,000 Once they... we bypass those 203 00:22:55,400 --> 00:23:01,560 AID selection, we go to a challenge response stage. 204 00:23:01,560 --> 00:23:09,360 At this stage, it seems... it seems like during the test, it seems like we don't have any time limit anymore. 205 00:23:09,360 --> 00:23:13,920 We can send and wait as long as we want, right? 206 00:23:13,920 --> 00:23:28,400 So yeah, basically we just dropped one... instead of looking for two different AIDs, like F4 and 74, we just dropped one of them, and sent in... looking for 74 directly. 207 00:23:29,200 --> 00:23:39,420 We will simply... by doing this, we successfully bypass the time limit, right? 208 00:23:39,420 --> 00:23:48,580 So and here's... we just play this... we do the demo to show the whole process, okay? 209 00:23:56,290 --> 00:24:07,330 As you can see, we... because it's a traffic relayed by Wi-Fi, and you can experience a little bit slow, but it still works, right? 210 00:24:07,330 --> 00:24:09,910 As you can see, it will open, 211 00:24:14,440 --> 00:24:22,980 and you can check out the current phone... the firmware, right? 212 00:24:26,720 --> 00:24:28,520 And then we drop... 213 00:24:30,980 --> 00:24:33,160 and driving away. 214 00:24:35,580 --> 00:24:37,140 Okay, cool. 215 00:24:37,960 --> 00:24:52,040 Now, because we want to see how practical this NFC relay attack is, so we're testing with a lot of... we want to see if it works in long distance, right? 216 00:24:52,040 --> 00:25:00,860 So here's another video I want to show... demo I want to show you, as we are actually testing in kind of far away. 217 00:25:02,020 --> 00:25:06,260 Let's see the results, right? 218 00:25:06,880 --> 00:25:11,660 So as you can see, my car is kind of far away in the parking lot. 219 00:25:11,800 --> 00:25:14,740 Yeah, it still works, right? 220 00:25:14,920 --> 00:25:18,220 Cool, beautiful. 221 00:25:19,100 --> 00:25:38,840 So by this stage, we're very happy and report our founding to Tesla, and however, Tesla replied our email and said that the relay attack are no limitation for their systems. 222 00:25:38,860 --> 00:25:47,200 And we recommend customers who are concerned about relay attack enable pin-to-drive. 223 00:25:47,200 --> 00:26:02,020 So basically, there's no bounty, and they know the vulnerability exists, but they don't think it's very important, because they think they already have something called a pin-to-drive ready. 224 00:26:02,020 --> 00:26:05,160 So here's our work result. 225 00:26:09,500 --> 00:26:21,180 So first, basically, even... so basically, what we need to... I need to address here is pin-to-drive is actually not protecting from the relay attack. 226 00:26:21,180 --> 00:26:24,160 It's only protecting you... once you open the... 227 00:26:24,160 --> 00:26:27,560 we open the door, you cannot stop engine. 228 00:26:27,560 --> 00:26:30,320 You have to enter in some pin, right? 229 00:26:30,320 --> 00:26:34,480 But we are still able to open the door. 230 00:26:35,020 --> 00:26:37,660 And so basically, the risk is still there, right? 231 00:26:37,660 --> 00:27:02,920 So once we get in, or bad guy get in, they can't... yes, they may not able to steal your vehicle, but they still can steal some stuff inside your car, or even worse, they can put something in, spare camera, or some cheap... and yeah, so I think the pin-to-drive is really a debatable solution from Tesla. 232 00:27:02,920 --> 00:27:10,400 But anyway, we apply a CVE, and we get a CVE here, and we're happy enough, right? 233 00:27:11,400 --> 00:27:14,500 But what is pin-to-drive anyway? 234 00:27:15,760 --> 00:27:23,000 So basically, I found this pin-to-drive description from the Tesla website. 235 00:27:23,000 --> 00:27:33,000 The most interesting part here is that pin-to-drive allows you to set a secure four-digit modification, right? 236 00:27:33,000 --> 00:27:34,200 Four digits. 237 00:27:34,820 --> 00:27:39,240 So what could possibly go wrong there, right ? 238 00:27:39,240 --> 00:27:41,260 Only four-digit numbers. 239 00:27:41,600 --> 00:27:51,300 Now, we also, during the research, we found there's no pin position randomization, so it's always fixed in the middle. 240 00:27:51,600 --> 00:28:15,820 Now, at least, because this research has been done for some time now, and at the time we're testing on different firmware version, we can, at least at that moment, there's no brute force rate limitation and no brute force back-off time. 241 00:28:16,520 --> 00:28:22,840 But maybe they are fixed now, but a lot of time, it doesn't have anything. 242 00:28:22,860 --> 00:28:28,440 So, four-digit numbers, no brute force protections, yeah? 243 00:28:28,460 --> 00:28:29,420 You get the idea? 244 00:28:31,120 --> 00:28:33,040 So, oops. 245 00:28:33,080 --> 00:28:45,720 So, we actually built a hardware based on something called M5Stack. 246 00:28:46,600 --> 00:28:49,140 I named it pin-to-crack, right? 247 00:28:49,840 --> 00:28:53,000 So, basically, we can use that to... 248 00:28:54,660 --> 00:28:59,920 of course, we can do with, maybe we can do it with Raspberry Pi or with Arduino. 249 00:28:59,920 --> 00:29:01,800 It doesn't have to be M5Stack. 250 00:29:01,800 --> 00:29:10,460 Basically, the idea is just... instead we push the pin number itself, we can do it automatically, right? 251 00:29:10,780 --> 00:29:13,760 So, now, but there's a catch though. 252 00:29:13,800 --> 00:29:21,300 Oh, by the way, there's another guy doing a similar attack on his Tesla as well. 253 00:29:21,300 --> 00:29:27,220 But this is our solution, so similar, same idea. 254 00:29:27,660 --> 00:29:35,340 However, the catch is we have to finish the whole setup process under two minutes. 255 00:29:35,440 --> 00:29:39,460 Otherwise, we have to relay the Tesla key attack again. 256 00:29:39,620 --> 00:29:48,200 Now, by just... what we found is by just setting up those... because we have to focus on the exact position on the screen. 257 00:29:49,080 --> 00:29:53,860 By just setting up everything set up already, it's already a lot of times. 258 00:29:53,900 --> 00:30:03,540 So, we maybe... instead of using the device, we're just using our first fingers, right? 259 00:30:05,000 --> 00:30:10,580 So, here we're going to just show you the first finger will work. 260 00:30:10,640 --> 00:30:24,520 So, first, we are able to open the door, we get in, but because there's a pin to drive function already, we have to enter the pin, right? 261 00:30:24,520 --> 00:30:29,380 So, as you can see the firmware version, verify the firmware version, right? 262 00:30:30,140 --> 00:30:31,520 Yeah, the pin drive. 263 00:30:31,520 --> 00:30:41,760 So, as you can see, in the beginning we pretend we don't know anything about a pin, so we just randomly or brute force try to try our luck. 264 00:30:41,760 --> 00:30:47,880 Now, the point here is we can see there's no brute force protection. 265 00:30:47,880 --> 00:30:53,720 We can just run... maybe not random, we open... 266 00:30:53,720 --> 00:31:00,880 we just entering... keep entering a different pin, even try to see if we get a lock. 267 00:31:00,980 --> 00:31:05,860 So, let me speed up a little bit. 268 00:31:08,360 --> 00:31:10,140 Okay, okay. 269 00:31:10,140 --> 00:31:15,080 See, there's nothing stop us to keep entering the pin, right? 270 00:31:17,730 --> 00:31:18,430 Let me see... 271 00:31:24,250 --> 00:31:27,070 Let me see where's the... 272 00:31:34,300 --> 00:31:39,320 actually, I don't know where's the actual key, so I don't know where to start. 273 00:31:39,320 --> 00:31:41,760 Oh, see, here, we got it, right? 274 00:31:41,760 --> 00:31:52,540 So, as you can see, during this lock... this is only demonstration, the actual attack maybe take longer, but yeah, the point is they don't have anything protecting it, right? 275 00:31:52,540 --> 00:31:55,840 So, we can just, using our first finger, maybe you can get them. 276 00:31:56,160 --> 00:31:58,860 Yeah, so, good to go. 277 00:32:02,080 --> 00:32:05,500 Okay, all right. 278 00:32:06,780 --> 00:32:10,640 So, the summary here. 279 00:32:10,640 --> 00:32:15,520 So, really, the security by obscurity is not going to work, right? 280 00:32:15,520 --> 00:32:20,760 So, the 100% security does not exist. 281 00:32:20,760 --> 00:32:23,100 We have to test properly. 282 00:32:23,100 --> 00:32:41,760 We need to... even like, vehicles, you may think like those high-end cars are very secure, but once they implement some latest technology, then it actually opens more attack vectors for the attackers. 283 00:32:41,820 --> 00:32:45,800 So, we need to really think this carefully, okay? 284 00:32:48,220 --> 00:32:50,900 Yeah, so, here are some references. 285 00:32:50,900 --> 00:33:05,180 If you guys are interested to continue your research, I definitely recommend you can try those I just mentioned, and you go to... all those guys are very good in this area. 286 00:33:05,320 --> 00:33:10,980 Yeah, so, go check them out, all right? 287 00:33:10,980 --> 00:33:12,360 Okay, thank you. 288 00:33:12,360 --> 00:33:13,400 I'm done.