WEBVTT 00:00.000 --> 00:09.560 Hi, today I'd like to share my experience on how to relay NFC traffic for Tesla Model 3. 00:11.800 --> 00:15.440 So my name is Kevin2600. 00:15.440 --> 00:24.080 I'm currently working for a company called InGeek in Shanghai, China, and we're focused on research and pen testing for smart car security. 00:24.080 --> 00:29.980 We also built a project called CarSRC, which is China's first car security response center. 00:31.520 --> 00:43.320 So you're welcome to follow me on Twitter on Kevin2600 or just if you're interested and check out a barcode here for a company website, right? 00:43.400 --> 00:48.740 Okay, so here's our content for today. 00:48.740 --> 00:54.940 First, I'd like to talk about some basic knowledge and the applications regarding to NFC. 00:54.940 --> 00:58.240 And then I think maybe I should... 01:01.540 --> 01:08.860 And then I will talk about the key fobs architecture for Tesla Model 3. 01:08.860 --> 01:19.160 And eventually, I will walk through the challenge we have faced and how do we bypass it during the NFC relay research, right? 01:19.460 --> 01:22.080 So NFC 101. 01:22.100 --> 01:30.120 I don't think we need to talk about too much on this at this point because a lot of people already know about NFC. 01:30.120 --> 01:34.120 But basically, NFC stands for Near Field Communication. 01:34.120 --> 01:42.220 It's most likely operating on passive mode and it's really working in close range. 01:42.220 --> 01:44.340 We are talking about centimeters here. 01:44.340 --> 01:50.200 And the operation frequency is usually going to be 13.56 MHz. 01:50.200 --> 01:57.160 And you can use things called NDEF to change the data back and forth, right? 01:57.160 --> 02:02.400 So the NFC technology is already widely developed, right? 02:02.400 --> 02:07.020 So we can see a lot of applications based on it in today's world. 02:07.020 --> 02:19.380 So for example, our payment system, our passport, and our card for access our business buildings are all most likely NFC or RFID based. 02:20.480 --> 02:25.200 And then there's a new trend for using NFC for car keys. 02:25.260 --> 02:28.340 And here's some of car manufacturers already using it. 02:28.340 --> 02:37.540 As we can see, like BMW or BYD and like our main target today, Tesla, they're using it. 02:37.540 --> 02:42.520 And they come with different size of forms, right? 02:42.520 --> 02:49.160 So interestingly, even Apple has enabled a new feature called car key for the latest. 02:49.720 --> 02:56.700 So yeah, I think the digital car keys is really the future. 02:57.160 --> 03:03.220 And now speaking of Tesla, Elon Musk, he's so proud of it. 03:03.220 --> 03:08.080 He mentioned that Tesla is a sophisticated computer on wheels, right? 03:08.080 --> 03:13.860 So if it's a computer, the hackers or security research will be interested in it. 03:14.240 --> 03:19.440 And so here's a small list that I grabbed from the Tesla website. 03:19.440 --> 03:27.340 As you can see, there are many researches, researchers has found vulnerability and report to Tesla for the past few years. 03:27.340 --> 03:29.500 And so for example... 03:31.980 --> 03:33.500 Oh, sorry. 03:33.920 --> 03:34.900 Okay. 03:34.900 --> 03:43.140 So for example, the famous hacks from Tencent King Labs, they were able to exploit the Wi-Fi stack on Tesla Model S. 03:43.140 --> 03:49.440 And then they also done a great experiment on Tesla Autopilot. 03:49.440 --> 03:53.040 So if you guys are interested, I recommend that you check it out. 03:53.080 --> 03:57.420 Also, there's some more independent researcher. 03:57.420 --> 04:03.880 So for example, one guy called Richard Zhu, he won the last year Pwn2Own competition. 04:03.880 --> 04:08.680 He basically able to pawn the Tesla IVI system. 04:08.780 --> 04:11.820 Also, there is another researcher from Belgian. 04:11.820 --> 04:19.900 He's able to successfully crack the key, the encryptions used by Tesla Model S. 04:19.900 --> 04:26.080 And then he's able to successfully clone the entire key. 04:26.260 --> 04:30.400 So I think this is quite cool, right? 04:32.700 --> 04:39.480 However, it turns out that not just the hackers or security researchers are interested in Tesla. 04:39.480 --> 04:43.220 So are those professional thieves, right? 04:43.220 --> 04:48.040 But they don't care about how to write perfect exploits for RCE. 04:48.040 --> 04:53.080 They only want to steal the vehicles or something left inside, right? 04:53.080 --> 04:57.040 So they only want some very simple way. 04:57.240 --> 05:02.140 And it turns out that one of the simplest ways for them is called a key file relay attack. 05:02.140 --> 05:08.100 I think this is all over the news for the past few months or even last year. 05:09.280 --> 05:23.640 You're going to see some guy come to your neighborhood with some mystery device that it can amplify your key file and then somehow turn on your vehicles and drive away. 05:23.760 --> 05:28.720 And this is also the reason why we start to research on Tesla. 05:28.820 --> 05:35.980 Because we must try to see if it's possible to do the NFC relay for the Tesla Model 3, right? 05:36.640 --> 05:42.740 Okay, so Tesla key file architecture. 05:42.740 --> 05:44.320 So let's talk about this. 05:44.500 --> 05:50.100 Okay, so before I start, I'd like to talk about some research procedures. 05:51.360 --> 05:58.400 The first, usually when we start to research something, we usually start with some reconnaissance, right? 05:58.580 --> 06:05.980 So basically, at this stage, we try to read as many as possible the menus regarding your target. 06:06.120 --> 06:17.500 And also you can sit down with your friends, your colleagues, and to do some brainstorm to see what kind of attack factors that you can have, right? 06:17.500 --> 06:25.640 And once you have that ready, then you can really just sit down and actually implement some attack plans. 06:25.640 --> 06:31.060 And then you can go to actually doing it, right? 06:31.060 --> 06:43.340 So usually when we're testing for like Tesla here, we are not expecting that it will success in the first time. 06:43.340 --> 06:46.480 So usually it will fail, but that's okay. 06:46.480 --> 06:48.240 We just try harder and repeat. 06:48.240 --> 06:50.340 Eventually, we'll find something, right? 06:50.340 --> 06:51.500 Cool. 06:52.400 --> 07:02.860 So for Tesla, now in order to access the Model 3, Tesla has provided us three different ways, right? 07:02.860 --> 07:16.520 For example, we can use NFC tag, and Tesla also provided mobile apps for us to try to control your car through Bluetooth. 07:16.860 --> 07:25.500 And later, they also provided the physical key fob, also have been using Bluetooth and NFC here, okay? 07:26.020 --> 07:32.740 And just like any other radio device, Tesla key fobs, we can find a thing called FCCID. 07:32.880 --> 07:44.040 So this is important for us at a recon stage, because first we need to know as much as possible regarding your target, right? 07:44.040 --> 08:00.980 So from here, we search the FCCID to the website, and then we can find, say, for example, we can find that Tesla Model 3 key fob using a CC2640 chipset. 08:01.440 --> 08:10.280 And also, this is also for key fob reader, the reader module, and also having to using CC2640. 08:10.280 --> 08:22.920 So by this information, really, we can have even without even actually open the... even without own one of these vehicles, you already know something about it, right? 08:22.920 --> 08:24.200 That's pretty cool. 08:24.360 --> 08:48.900 Now, regarding the NFC key tag itself, actually, it's just like any other NFC tag, it supports ISO 14443 type A, and also ISO 7864 standards. 08:48.900 --> 08:51.520 And basically, it's a Java smart cards. 08:51.520 --> 09:02.840 So we can use in some already already exist application to group graph this information, right? 09:02.840 --> 09:05.580 There's a lot of application can do as you can see here. 09:06.020 --> 09:14.540 Yeah, the difference between those two ISO standards, one is contact, and one is contacts. 09:14.540 --> 09:16.580 They are very similar. 09:16.580 --> 09:22.280 And on top of application layer, they all the same, just using APTU to talk to your car. 09:23.300 --> 09:39.100 Okay, so and, and then I recommend that people serious about researching on RFID security, you definitely need to go get one of the PM ProSmart 3. 09:39.760 --> 09:42.140 Yeah, I think this is very important. 09:42.140 --> 09:50.940 So basically, we can use in PM3 to, to identify your, your targets, which is key file here. 09:50.940 --> 10:03.220 And I can see identify as an XP MyFair DeathFire 4k EV1 type card. 10:03.220 --> 10:07.880 Okay, so and here's a little summary here. 10:07.880 --> 10:10.960 So the test NFC key tag is seven bytes. 10:11.700 --> 10:13.760 He uses seven byte UID. 10:13.920 --> 10:16.840 And it is a Java based card. 10:17.800 --> 10:25.720 The most important part is here is the actually using the ECDH for a challenge response for authentication. 10:26.200 --> 10:35.400 So and as I mentioned, ProSmart 3 is really helpful during the research, as you can see the picture right here. 10:35.640 --> 10:45.780 I, we are able to use in ProSmart 3 to talk to, to send different commands, APTU commands to your target, to the tag. 10:45.780 --> 10:58.440 And we can able to get some information out, for example, a public key, or different Java updates, like sending different AID to require different Java update to do some testing. 10:58.440 --> 10:59.560 So yeah. 11:00.780 --> 11:02.680 And right. 11:03.960 --> 11:07.600 So now I think it's time for some real hacks, right? 11:07.600 --> 11:08.580 Cool. 11:08.620 --> 11:18.780 Um, so since our goal here is actually to get NIC relay working, and there are many research has done great jobs in this area already. 11:18.780 --> 11:23.340 So in beginning, we don't want to reinvent the wheels. 11:23.340 --> 11:32.080 So we've, we just do some research and find there's a very cool application called NLC gate. 11:32.100 --> 11:40.700 And NLC gate is basically is Android application is the mean for capture, analyzing, or even modified NLC traffic on file. 11:40.700 --> 11:42.440 So basically, it's pretty cool. 11:42.440 --> 11:44.800 It's perfect for us, right? 11:44.800 --> 11:51.300 And he operated it, basically, we need to mobile phone at running the NLC gate. 11:51.560 --> 11:55.780 And we need to set our Wi Fi server in the middle, right? 11:55.780 --> 12:00.660 So can true to send to relay through the traffic. 12:01.380 --> 12:15.060 Um, so yeah, so for the first for the test run, um, we're, we're trying to target our credit card system to see if we can buy a coffee for free, right? 12:15.060 --> 12:19.040 So with someone's, with my colleague's card, basically. 12:19.040 --> 12:22.960 So, and so here's the result I would like to show you. 12:24.380 --> 12:38.440 Right, so basically, we try to was one of the colleague to pretend to be a bad guys and me just try to read out the someone else's card, right? 12:45.630 --> 12:49.010 Yeah, as you can see, the traffic is already go through. 12:52.110 --> 12:58.030 We're successfully to buy, to get coffee for free. 12:58.690 --> 13:02.550 And by this point, we're very, yeah. 13:02.650 --> 13:05.010 Yeah, by this point, we're very happy. 13:05.010 --> 13:11.350 So we run to a parking lot for hours to test the Model 3. 13:14.070 --> 13:17.890 Unfortunately, it failed for the first attempt, right? 13:17.890 --> 13:22.130 As I mentioned, usually it will fail for the first time. 13:22.610 --> 13:26.730 But let's find out why it happened. 13:26.730 --> 13:28.870 What happened exactly, right? 13:29.310 --> 13:51.730 Okay, so and again, we brought out our Porsche Model 3 and start to capture and compare the NX traffic between the actual Tesla key tag and the other which relate by the NFC gate to do some, to see if there's anything I'm, we were missed. 13:53.650 --> 14:03.930 And yeah, so here are the traffic data we captured by PM3, Porsche Model 3. 14:04.190 --> 14:08.010 And also here are the traffic we captured by NFC gate itself. 14:08.010 --> 14:10.470 It has a logging file function. 14:10.470 --> 14:30.390 So as you can see, one of the response by the tag is it can convert back to convert the hex string to something we can read as a Tesla logic, which indicate that it is Tesla's NFC key tag. 14:30.530 --> 14:40.530 Okay, so let's walk through some those hex strings, try to understand what's going on here. 14:40.530 --> 14:44.790 So first, yeah, so this is important here, right? 14:44.790 --> 14:46.830 So first, the 14:50.290 --> 15:08.310 the reader, the sorry, the reader will send out a request asking for Tesla logic AID for like TBK, which stands for Tesla phone key. 15:08.730 --> 15:25.490 But because we are actually using the NFC key tag, our reader, our tag will respond with 6D00, which means instruction invalid, which is, which means this particular AID doesn't exist. 15:25.850 --> 15:34.630 So and then the Tesla will send another request, will send another request asking for TKC, which is Tesla key card. 15:34.630 --> 15:40.390 And yes, executed successfully by like 9T00. 15:40.770 --> 15:46.650 And because we are using Tesla key card, so yeah, it does exist. 15:46.650 --> 15:51.430 So then the reader will send and select this particular AID. 15:51.430 --> 15:56.630 Okay, now, like this is a Tesla logic update list, right? 15:56.630 --> 16:02.630 And then the reader will send out authentication command for this particular AID. 16:02.630 --> 16:09.210 And like they send out a vehicle public key and followed by a 16-byte challenge. 16:09.210 --> 16:16.190 Now for the tag itself, we have to respond with a 16-byte response. 16:16.830 --> 16:30.990 And once we have that sorted out, then we are authenticated to the reader and then we can do action like open the car, open the door or close the door and stuff, something like that, right? 16:31.190 --> 16:38.250 So as you can see, the whole authentication process is kind of simple. 16:38.410 --> 16:43.910 But why we endlessly read a tag on credit card system, it works. 16:43.910 --> 16:45.890 The Model 3 is not. 16:45.950 --> 16:56.550 And turns out, the reason is the payment terminal, the POR system is not required to stop the transaction if it takes longer time. 16:56.930 --> 17:01.130 But the Tesla, on the other hand, has more restriction on timing. 17:01.130 --> 17:05.990 It has to respond in a very specific time. 17:06.090 --> 17:07.910 Otherwise, it will be time out. 17:08.050 --> 17:14.450 If we say, if we didn't respond to the correct answer on AID on time and then it failed, right? 17:14.450 --> 17:25.230 So because we are related, remember we are related traffic through Wi-Fi network and there's a lot lot of things can happen during this transaction. 17:25.730 --> 17:33.130 So now our job is to increase our speed. 17:33.230 --> 17:36.270 And luckily, there's a great researcher called Stefano. 17:36.270 --> 17:39.710 He is kind enough to give us some advice. 17:40.550 --> 17:45.850 But unfortunately, this second attempt also failed. 17:45.850 --> 17:47.930 But thanks for him. 17:49.450 --> 17:51.390 Let's try harder, right? 17:51.390 --> 17:52.370 Let's see. 17:53.770 --> 18:07.950 And then my colleague, Alex, he came up with some idea to verify because at that point, we're not really sure if it is a timing issue only or maybe something else blocked the way. 18:08.050 --> 18:22.150 So his idea is instead related traffic by Wi-Fi, maybe we're using the USB cables because all the traffic then you transfer locally. 18:22.150 --> 18:25.690 So it's supposed to be very very fast, right? 18:25.690 --> 18:28.190 Let's see if that works. 18:28.870 --> 18:32.270 So here's our first video. 18:32.670 --> 18:38.610 You can always check out YouTube on this for later, right? 18:39.210 --> 18:41.070 Yeah, cool. 18:41.070 --> 18:45.030 As you can see, we actually relay by the USB. 18:45.030 --> 18:46.170 It works. 18:46.170 --> 18:48.510 So it is timing. 18:48.510 --> 18:53.570 It is where you have to find a way to increase the speed. 18:54.050 --> 18:55.470 But how? 18:58.660 --> 19:11.520 And then, yes, we found another trick from the same guy, Salvador, which is inspiring us a lot. 19:11.520 --> 19:17.920 Because basically, he has given a talk at DEF CON 26. 19:17.920 --> 19:27.480 Basically, he was able to bypass the payment limit by simply replacing a certain value during the transaction. 19:27.700 --> 19:30.460 And also, he can able to replay. 19:30.660 --> 19:44.520 Also, again, same trick, replace different values in order to instead of using EMV, he actually turned to using MACDRIVE for payment systems. 19:44.520 --> 19:46.580 So let's get us thinking. 19:46.800 --> 19:48.600 Can we do the same? 19:51.160 --> 19:58.300 So let's go back to the traffic we captured by ProSmart 3. 20:00.260 --> 20:09.380 So basically, remember we mentioned that the first reader will send out... 20:10.000 --> 20:15.640 they're asking for a particular Java update AID, which never exists. 20:15.640 --> 20:17.780 It actually starts at 4. 20:17.800 --> 20:22.800 And then, because it doesn't exist, it will be failed. 20:22.800 --> 20:29.520 So they send another request asking for another Java update called Star Wars 74. 20:29.880 --> 20:34.060 So can we do something about here? 20:36.420 --> 20:38.760 And definitely, yes. 20:38.760 --> 20:46.760 So let's... sorry, I draw a very ugly picture here, but let me try to explain what happened. 20:46.760 --> 20:56.960 So basically, first, Test.mod3 will send out... the reader will send out a request looking for a Java update F4. 20:56.960 --> 21:09.060 But because it doesn't exist, the tag will reply response with 60.0.0, so it doesn't exist. 21:09.780 --> 21:19.620 And so that... instead we redirect the 60.0.0, we send... 21:22.720 --> 21:29.130 we actually forwarding... instead of looking for F4, we're forwarding that... 21:30.060 --> 21:35.320 you're asking for 74, because we know that 74, a Java update, does exist. 21:35.680 --> 21:50.120 And because... and then, obviously, tag will receive this request, will say, okay, you are... you're asking for 74, then we... it doesn't exist, and then we just respond with 90.0.0. 21:50.120 --> 21:51.100 And you will... 21:51.100 --> 22:00.480 and then we're using another MVC gate to send those response back. 22:00.480 --> 22:03.300 Because... and that takes some time here. 22:03.300 --> 22:15.820 So by the time we're processing this command, the Test.mod3 will send another request looking for... the actual request sending... looking for 74. 22:15.820 --> 22:21.520 And that's the one actual... the real one sent by the models, read module. 22:22.120 --> 22:27.760 But we... because we are in the middle, so we drop it, right? 22:27.900 --> 22:30.600 We don't need a second 74. 22:30.640 --> 22:39.600 So now by the time we finish... we've done this, the 90.0.0 has already arrived. 22:39.640 --> 22:44.700 So by this end, so we can just forward it to the Test.mod3. 22:44.700 --> 22:46.320 And once Test.mod3... 22:46.880 --> 22:48.520 seems interesting here now. 22:48.520 --> 22:52.000 Once they... we bypass those 22:55.400 --> 23:01.560 AID selection, we go to a challenge response stage. 23:01.560 --> 23:09.360 At this stage, it seems... it seems like during the test, it seems like we don't have any time limit anymore. 23:09.360 --> 23:13.920 We can send and wait as long as we want, right? 23:13.920 --> 23:28.400 So yeah, basically we just dropped one... instead of looking for two different AIDs, like F4 and 74, we just dropped one of them, and sent in... looking for 74 directly. 23:29.200 --> 23:39.420 We will simply... by doing this, we successfully bypass the time limit, right? 23:39.420 --> 23:48.580 So and here's... we just play this... we do the demo to show the whole process, okay? 23:56.290 --> 24:07.330 As you can see, we... because it's a traffic relayed by Wi-Fi, and you can experience a little bit slow, but it still works, right? 24:07.330 --> 24:09.910 As you can see, it will open, 24:14.440 --> 24:22.980 and you can check out the current phone... the firmware, right? 24:26.720 --> 24:28.520 And then we drop... 24:30.980 --> 24:33.160 and driving away. 24:35.580 --> 24:37.140 Okay, cool. 24:37.960 --> 24:52.040 Now, because we want to see how practical this NFC relay attack is, so we're testing with a lot of... we want to see if it works in long distance, right? 24:52.040 --> 25:00.860 So here's another video I want to show... demo I want to show you, as we are actually testing in kind of far away. 25:02.020 --> 25:06.260 Let's see the results, right? 25:06.880 --> 25:11.660 So as you can see, my car is kind of far away in the parking lot. 25:11.800 --> 25:14.740 Yeah, it still works, right? 25:14.920 --> 25:18.220 Cool, beautiful. 25:19.100 --> 25:38.840 So by this stage, we're very happy and report our founding to Tesla, and however, Tesla replied our email and said that the relay attack are no limitation for their systems. 25:38.860 --> 25:47.200 And we recommend customers who are concerned about relay attack enable pin-to-drive. 25:47.200 --> 26:02.020 So basically, there's no bounty, and they know the vulnerability exists, but they don't think it's very important, because they think they already have something called a pin-to-drive ready. 26:02.020 --> 26:05.160 So here's our work result. 26:09.500 --> 26:21.180 So first, basically, even... so basically, what we need to... I need to address here is pin-to-drive is actually not protecting from the relay attack. 26:21.180 --> 26:24.160 It's only protecting you... once you open the... 26:24.160 --> 26:27.560 we open the door, you cannot stop engine. 26:27.560 --> 26:30.320 You have to enter in some pin, right? 26:30.320 --> 26:34.480 But we are still able to open the door. 26:35.020 --> 26:37.660 And so basically, the risk is still there, right? 26:37.660 --> 27:02.920 So once we get in, or bad guy get in, they can't... yes, they may not able to steal your vehicle, but they still can steal some stuff inside your car, or even worse, they can put something in, spare camera, or some cheap... and yeah, so I think the pin-to-drive is really a debatable solution from Tesla. 27:02.920 --> 27:10.400 But anyway, we apply a CVE, and we get a CVE here, and we're happy enough, right? 27:11.400 --> 27:14.500 But what is pin-to-drive anyway? 27:15.760 --> 27:23.000 So basically, I found this pin-to-drive description from the Tesla website. 27:23.000 --> 27:33.000 The most interesting part here is that pin-to-drive allows you to set a secure four-digit modification, right? 27:33.000 --> 27:34.200 Four digits. 27:34.820 --> 27:39.240 So what could possibly go wrong there, right ? 27:39.240 --> 27:41.260 Only four-digit numbers. 27:41.600 --> 27:51.300 Now, we also, during the research, we found there's no pin position randomization, so it's always fixed in the middle. 27:51.600 --> 28:15.820 Now, at least, because this research has been done for some time now, and at the time we're testing on different firmware version, we can, at least at that moment, there's no brute force rate limitation and no brute force back-off time. 28:16.520 --> 28:22.840 But maybe they are fixed now, but a lot of time, it doesn't have anything. 28:22.860 --> 28:28.440 So, four-digit numbers, no brute force protections, yeah? 28:28.460 --> 28:29.420 You get the idea? 28:31.120 --> 28:33.040 So, oops. 28:33.080 --> 28:45.720 So, we actually built a hardware based on something called M5Stack. 28:46.600 --> 28:49.140 I named it pin-to-crack, right? 28:49.840 --> 28:53.000 So, basically, we can use that to... 28:54.660 --> 28:59.920 of course, we can do with, maybe we can do it with Raspberry Pi or with Arduino. 28:59.920 --> 29:01.800 It doesn't have to be M5Stack. 29:01.800 --> 29:10.460 Basically, the idea is just... instead we push the pin number itself, we can do it automatically, right? 29:10.780 --> 29:13.760 So, now, but there's a catch though. 29:13.800 --> 29:21.300 Oh, by the way, there's another guy doing a similar attack on his Tesla as well. 29:21.300 --> 29:27.220 But this is our solution, so similar, same idea. 29:27.660 --> 29:35.340 However, the catch is we have to finish the whole setup process under two minutes. 29:35.440 --> 29:39.460 Otherwise, we have to relay the Tesla key attack again. 29:39.620 --> 29:48.200 Now, by just... what we found is by just setting up those... because we have to focus on the exact position on the screen. 29:49.080 --> 29:53.860 By just setting up everything set up already, it's already a lot of times. 29:53.900 --> 30:03.540 So, we maybe... instead of using the device, we're just using our first fingers, right? 30:05.000 --> 30:10.580 So, here we're going to just show you the first finger will work. 30:10.640 --> 30:24.520 So, first, we are able to open the door, we get in, but because there's a pin to drive function already, we have to enter the pin, right? 30:24.520 --> 30:29.380 So, as you can see the firmware version, verify the firmware version, right? 30:30.140 --> 30:31.520 Yeah, the pin drive. 30:31.520 --> 30:41.760 So, as you can see, in the beginning we pretend we don't know anything about a pin, so we just randomly or brute force try to try our luck. 30:41.760 --> 30:47.880 Now, the point here is we can see there's no brute force protection. 30:47.880 --> 30:53.720 We can just run... maybe not random, we open... 30:53.720 --> 31:00.880 we just entering... keep entering a different pin, even try to see if we get a lock. 31:00.980 --> 31:05.860 So, let me speed up a little bit. 31:08.360 --> 31:10.140 Okay, okay. 31:10.140 --> 31:15.080 See, there's nothing stop us to keep entering the pin, right? 31:17.730 --> 31:18.430 Let me see... 31:24.250 --> 31:27.070 Let me see where's the... 31:34.300 --> 31:39.320 actually, I don't know where's the actual key, so I don't know where to start. 31:39.320 --> 31:41.760 Oh, see, here, we got it, right? 31:41.760 --> 31:52.540 So, as you can see, during this lock... this is only demonstration, the actual attack maybe take longer, but yeah, the point is they don't have anything protecting it, right? 31:52.540 --> 31:55.840 So, we can just, using our first finger, maybe you can get them. 31:56.160 --> 31:58.860 Yeah, so, good to go. 32:02.080 --> 32:05.500 Okay, all right. 32:06.780 --> 32:10.640 So, the summary here. 32:10.640 --> 32:15.520 So, really, the security by obscurity is not going to work, right? 32:15.520 --> 32:20.760 So, the 100% security does not exist. 32:20.760 --> 32:23.100 We have to test properly. 32:23.100 --> 32:41.760 We need to... even like, vehicles, you may think like those high-end cars are very secure, but once they implement some latest technology, then it actually opens more attack vectors for the attackers. 32:41.820 --> 32:45.800 So, we need to really think this carefully, okay? 32:48.220 --> 32:50.900 Yeah, so, here are some references. 32:50.900 --> 33:05.180 If you guys are interested to continue your research, I definitely recommend you can try those I just mentioned, and you go to... all those guys are very good in this area. 33:05.320 --> 33:10.980 Yeah, so, go check them out, all right? 33:10.980 --> 33:12.360 Okay, thank you. 33:12.360 --> 33:13.400 I'm done.