1
00:00:00,000 --> 00:00:03,950
Twitch, please feel free to join the Discord.

2
00:00:06,460 --> 00:00:11,370
Https://discord.gg, Defcon, and join the conversation.

3
00:00:13,040 --> 00:00:20,280
All right, without further ado, let's discuss ClusterFuzz.

4
00:01:10,100 --> 00:01:13,920
Can, so you could potentially hack this vehicle.

5
00:01:13,940 --> 00:01:14,960
Please don't.

6
00:01:14,960 --> 00:01:16,980
It's great fun when it's driving.

7
00:01:16,980 --> 00:01:18,800
It's not fun when it's not.

8
00:01:19,080 --> 00:01:22,540
Um, a little disclaimer down the bottom there.

9
00:01:22,540 --> 00:01:24,960
Car hacking is done at your own risk.

10
00:01:25,000 --> 00:01:29,500
If you brick your own car, please do not blame me or the Car Hacking Village.

11
00:01:30,080 --> 00:01:32,900
So, on to my car hacking credentials.

12
00:01:32,980 --> 00:01:44,460
In 2007, I hacked my own vehicle, found an issue in the Hedge Unit, in which you could get access to personal information inside the Hedge Unit quite easily.

13
00:01:44,520 --> 00:01:47,760
I disclosed that information to the manufacturer itself.

14
00:01:47,760 --> 00:01:59,120
I then did a talk about it at Defcon Group in London, DC4420, B-side London Rookie Track, and Defcon 26 Car Hacking Village.

15
00:01:59,220 --> 00:02:08,280
In 2018, I was also invited to be one of 12 security researchers to go to Bug Crowd's live car hacking event.

16
00:02:08,620 --> 00:02:20,940
I then returned in 2019 to be one of 20 security researchers to go to the same event for the same manufacturer at their factory over in the US.

17
00:02:21,460 --> 00:02:31,760
Last year at Defcon 27, I was part of a Bug Crowd car hacking panel with Cyber Giddens and Spectres hosted by Chloe.

18
00:02:32,500 --> 00:02:50,620
I was also asked last year to go to the Auto Isaac Summit in Texas at Toyota's plant, where me and a couple of others were part of a car hacking vulnerability disclosure policy panel for HackerOne.

19
00:02:51,680 --> 00:02:55,640
I also now, for my sins, run the Car Hacking Village in the UK.

20
00:02:56,840 --> 00:03:06,460
I have my car in the box, PD0, which is all the electronics from a Peugeot 208 in a box, in quite a portable form.

21
00:03:06,640 --> 00:03:14,860
Not as portable as being globally movable, but last year I did about 13 events, one of which was in Europe.

22
00:03:15,040 --> 00:03:22,500
I have been asked to take it all the way around the world, India, Australia, Brazil, America, Egypt.

23
00:03:22,540 --> 00:03:26,440
The only continent I don't think I've been asked to go to is Antarctica.

24
00:03:27,080 --> 00:03:46,200
This year I was meant to do beside Stuttgart, beside Brussels, but things have happened, as we know, and there's been quite a few virtual conferences, which also means my car in the box will be available for the virtual.carhackingvillage.com CTF.

25
00:03:46,420 --> 00:03:53,380
If you look for PD0, there is two Raspberry Pis attached, one on two of the buses, one on the third.

26
00:03:53,480 --> 00:03:58,600
You can then basically hack that vehicle in a safe manner.

27
00:03:58,620 --> 00:04:02,220
You won't break anything really, unless you try really, really hard.

28
00:04:03,400 --> 00:04:10,580
It's quite good that it's actually going to be used at DEF CON without me leaving my own home.

29
00:04:11,100 --> 00:04:12,740
I will miss the people.

30
00:04:12,940 --> 00:04:16,760
However, travel is not really fun at the moment.

31
00:04:17,060 --> 00:04:26,280
So there are some hints and tips for the CTF for the Carhacking Village 101 in this presentation and the fuzzing that I will show you.

32
00:04:26,320 --> 00:04:34,840
You may want to pause and rewind some of this at a later time, but I'm not going to give you any more hints than that.

33
00:04:35,400 --> 00:04:37,400
So where do we start?

34
00:04:37,760 --> 00:04:39,780
The assumption is you all know what CAN is.

35
00:04:39,780 --> 00:04:41,280
Controller Area Network.

36
00:04:41,280 --> 00:04:55,560
It's a differential signalling communication system that allows lots of devices on a single bus to communicate, and has an arbitration system to allow the most important message to go out first.

37
00:04:56,240 --> 00:05:06,340
You don't really need to know much more about that, but if you want to have a read on Carhacker's Handbook by Craig Smith, it is a good read.

38
00:05:06,820 --> 00:05:10,100
So first things first, you need a cheap CAN adapter.

39
00:05:11,040 --> 00:05:13,300
I will go into those in a second.

40
00:05:13,460 --> 00:05:17,020
Once you have a cheap CAN adapter, you could try reading your own car.

41
00:05:17,040 --> 00:05:19,100
Be very careful if you do.

42
00:05:19,200 --> 00:05:29,040
I plugged in one of my own home-built CAN adapters into my 2017 Jaguar XE and managed to make the car lose its gearbox.

43
00:05:29,580 --> 00:05:36,520
Yeah, that was one of those moments where I was thinking, oops, I probably shouldn't have done that, and I was thinking pound signs.

44
00:05:37,360 --> 00:05:44,600
I did manage to get it back eventually, but it involves disconnecting the power for a considerable length of time, about 20 minutes.

45
00:05:44,900 --> 00:05:47,920
Plugging it back in, all the messages were then reset.

46
00:05:48,460 --> 00:06:01,700
However, the next morning when I went to drive it, it took about three and a half weeks to learn how to change gear again, because it had the automatic ZF gearbox as used in a lot of automatic vehicles these days.

47
00:06:02,380 --> 00:06:11,140
So slightly easier and slightly less dangerous is testing something that you can actually use outside of the vehicle.

48
00:06:11,200 --> 00:06:20,320
Do not test on your own vehicle, because if you break your own car and can't get Johnny to school in the morning, your missus will kill you and you will be doing the walk of shame in the rain.

49
00:06:20,320 --> 00:06:21,700
Not a good idea.

50
00:06:21,700 --> 00:06:26,400
So I'm going to show you an instrument cluster that I have.

51
00:06:26,400 --> 00:06:37,160
I will show you how to interpret a wiring diagram, what then is required for power supply, and then some tools that you can use.

52
00:06:37,420 --> 00:06:45,480
And I will show you some fuzzing, and you can see some results on the screen of what's actually happening.

53
00:06:45,960 --> 00:06:49,700
So first things first is the NanoCan adapter.

54
00:06:49,700 --> 00:06:54,820
I use this device as the PCB itself as my business card.

55
00:06:54,820 --> 00:07:06,200
I started doing it in early 2018 when I first started the Car Hacking Village, in that it was something I could give away at the conference to say, here's a way to start doing car hacking.

56
00:07:06,200 --> 00:07:24,080
All you need is five, ten dollars worth of components, which include an Arduino Nano, an MCP2515 module, a bit of wire, the PCB, and the OBD2 plug as shown there.

57
00:07:25,980 --> 00:07:33,480
What you would then do is solder it all together as shown on the GitHub instructions.

58
00:07:33,480 --> 00:07:41,920
You then can program the Arduino Nano with a basic sketch that reads all messages, and you get an output like this.

59
00:07:42,360 --> 00:07:53,180
You can reprogram it with other sketches that allow you to read and write data, but unless you know what you're doing, have a play with something first listening and not sending.

60
00:07:53,360 --> 00:08:00,160
Here is the same output but using Putty to interpret the data instead of the Arduino IDE.

61
00:08:00,560 --> 00:08:10,300
Again, if anyone wants one of these PCBs, hit me up on Slack or on Twitter or email me if you want to.

62
00:08:11,000 --> 00:08:12,900
I will put it in the post.

63
00:08:12,900 --> 00:08:20,200
If you're a distance away it might cost you the postage, which isn't that expensive.

64
00:08:20,200 --> 00:08:29,740
However, at the moment postage around the world is getting silly because of COVID costing extra money, but hit me up anyway.

65
00:08:29,740 --> 00:08:36,480
I will be online after this talk on the Discord channels for questions etc.

66
00:08:36,720 --> 00:08:40,160
Here's a second one of my adapters that I built.

67
00:08:40,160 --> 00:08:42,760
That is a PoundCoin 4Scale.

68
00:08:42,760 --> 00:08:57,740
That little device there is based on an ATTiny 1614 processor which costs about 50 pence or about 50 cents, maybe a little bit less if you buy quantity.

69
00:08:57,740 --> 00:09:11,460
It uses the same MCP2515 CAN controller and a SN65HVD230 CAN transceiver from Texas Instruments.

70
00:09:11,460 --> 00:09:13,300
The other two are from Microchip.

71
00:09:13,880 --> 00:09:22,060
This will allow you to build a CAN device for probably less than three dollars for all the components there.

72
00:09:22,080 --> 00:09:27,640
However, you need some extra parts to actually connect it to the vehicle if you want to connect it to the vehicle.

73
00:09:27,960 --> 00:09:30,180
There are two versions of this board.

74
00:09:31,060 --> 00:09:33,520
The red board is the main brains.

75
00:09:33,520 --> 00:09:41,740
The other board behind it, the little blue board you can see there, has the power supply and the connectivity onto the CAN bus.

76
00:09:41,940 --> 00:09:51,860
This one here is for nefarious purposes in that you can program the board at the top to listen for certain messages.

77
00:09:51,960 --> 00:09:56,100
When it sees a certain message it can then start sending messages back onto the bus.

78
00:09:56,200 --> 00:09:58,520
This is powered from the CAN bus port.

79
00:09:58,580 --> 00:10:11,660
The blue PCB in the middle has the power supply that brings it down from 12 volts to 3.3 and the plug at the back will then go into the OBD2 port and allow you to do various things.

80
00:10:12,300 --> 00:10:16,760
Be careful when you're doing this, again you could break things unless you know what you're doing.

81
00:10:17,000 --> 00:10:21,300
The other version of the TinyCAN adapter is here.

82
00:10:21,660 --> 00:10:23,900
This is a green board in the middle.

83
00:10:23,900 --> 00:10:29,720
This green board has an extra connector for a USB to TTL adapter.

84
00:10:29,980 --> 00:10:41,620
This adapter allows you to connect it to a Linux system using SL-CAN, so serial line CAN and socket CAN and CAN utils.

85
00:10:41,660 --> 00:10:50,580
You can then send messages from the Linux system using CAN utils which I will go into in a second.

86
00:10:50,820 --> 00:10:55,360
This again, all of the hardware there is probably about seven dollars worth of hardware.

87
00:10:55,360 --> 00:11:00,940
At some point in the future I will put this up on GitHub as another repository.

88
00:11:03,080 --> 00:11:06,600
If you want me to, just pester me, I'll do it quicker.

89
00:11:08,960 --> 00:11:15,560
Another cheaper CAN adapter you can use if you've got a Raspberry Pi lying around doing not a lot.

90
00:11:15,760 --> 00:11:18,500
Here is the PiCAN for Raspberry Pi.

91
00:11:18,500 --> 00:11:22,020
This is made by SK Pang in the UK.

92
00:11:22,840 --> 00:11:36,360
It uses the similar Microchip CAN transceiver and CAN controller, however it's got a DB9 adapter to connect it to the CAN OBD2 port on the vehicle.

93
00:11:36,360 --> 00:11:38,420
You can also use the screw terminals.

94
00:11:38,800 --> 00:11:43,660
One little hint is just behind the DB9 connector are some solder pads.

95
00:11:43,740 --> 00:11:52,720
You have to solder them in such a way that it uses the correct pins, because there are two different versions of the same cable that may or may not work.

96
00:11:53,300 --> 00:12:02,820
It took me a while to work that one out, but this will cost you probably about 35 to 40 dollars, 35 to 40 UK pounds.

97
00:12:02,940 --> 00:12:10,120
The website there is in the UK, but I believe he sells them in the US as well through other outlets.

98
00:12:11,000 --> 00:12:19,260
Here again is a screenshot of CANdump showing CAN messages from the CAN bus.

99
00:12:19,260 --> 00:12:30,860
And finally out of the cheaper end of the CAN adapters is the CANtact, which is by Eric Evencheck, linked down the bottom there.

100
00:12:31,060 --> 00:12:38,800
This I believe is based on the STM32 and inbuilt CAN controller and CAN transceiver.

101
00:12:39,480 --> 00:12:47,960
This has got the same 9-pin adapter on the end, a large USB-B connector.

102
00:12:48,960 --> 00:12:58,380
These retail I believe around 75 dollars, which is okay if you're in America, but if you're in the UK you get stuck with customs and VAT.

103
00:12:58,720 --> 00:13:05,500
The jumpers in the middle there are for changing which pins go to where, slightly similar to the PiCan.

104
00:13:05,780 --> 00:13:21,320
He's currently on Kickstarter though doing the CANtact Pro, which uses a slightly different processor that gives you two isolated CAN FD channels.

105
00:13:22,800 --> 00:13:27,240
Worth a look if you're interested in backing a Kickstarter.

106
00:13:27,320 --> 00:13:32,840
I might end up backing it myself if I haven't already done by then, by the time this goes out.

107
00:13:33,260 --> 00:13:36,600
So on to the instrument cluster itself.

108
00:13:36,600 --> 00:13:38,040
Here is the instrument cluster.

109
00:13:38,040 --> 00:13:41,280
It came from a Citroën DS3.

110
00:13:41,640 --> 00:13:43,760
They are not sold in the US.

111
00:13:43,760 --> 00:13:47,920
None of Citroën's group vehicles are sold in the US.

112
00:13:49,700 --> 00:13:59,120
This cost me about £30, which is probably about 25-ish dollars.

113
00:13:59,120 --> 00:14:06,780
You can get these from eBay, Scrapyard yourself, Vehicle Dismantler, Recycler etc.

114
00:14:07,180 --> 00:14:11,420
This one has an OBD2 port underneath in the middle there.

115
00:14:11,420 --> 00:14:14,900
This is because I use it for training purposes.

116
00:14:16,000 --> 00:14:24,200
So this is a very similar instrument cluster with regard to messages as my car in the box.

117
00:14:24,200 --> 00:14:26,460
A little hint here, listen up.

118
00:14:27,500 --> 00:14:33,560
The car in the box is based on a Peugeot 208, which is a similar sized vehicle to a DS3.

119
00:14:33,740 --> 00:14:36,900
However, it's just got a slightly different cluster.

120
00:14:37,000 --> 00:14:41,520
The message structures are very similar, if not the same.

121
00:14:42,540 --> 00:14:44,840
Here's the back of the instrument cluster.

122
00:14:45,440 --> 00:14:48,800
As you can see, there's some screw holes which hold it into the vehicle.

123
00:14:48,820 --> 00:14:54,720
One of which screw holes is blocked up with a barrel jack socket.

124
00:14:55,980 --> 00:15:00,780
You've then got a 18-pin connector for the device.

125
00:15:00,820 --> 00:15:19,840
If you are purchasing it from a vehicle recycler or scrapyard, see if you can get the cable as well because it's always easier to attach something to a cable that goes in specifically to that device, as opposed to DuPont cables and trying to select the right cable.

126
00:15:21,080 --> 00:15:24,240
Just zoom in on the plug itself.

127
00:15:24,540 --> 00:15:26,640
It's 18 pins.

128
00:15:27,140 --> 00:15:49,160
Pin 1 is bottom right, pin 9 is top right, pin 10 is bottom left, pin 18 is top left, and as you can see there, pin 8 is CAN HIGH, pin 9 is CAN LOW, pin 15 is 12V, and pin 18 is GROUND.

129
00:15:49,280 --> 00:15:52,980
Some of the other pins do things, some of the other pins do not.

130
00:15:52,980 --> 00:15:58,320
But be careful because you may break things if you send the wrong voltage up the wrong pin.

131
00:15:59,260 --> 00:16:01,940
So how do you work out what pin does what?

132
00:16:01,940 --> 00:16:03,720
You have to get the wiring diagram.

133
00:16:03,920 --> 00:16:11,860
This is the wiring diagram for the DS3 for the head unit and infotainment system.

134
00:16:12,820 --> 00:16:20,680
If you zoom in right in the middle of there, there is the device that is the instrument cluster.

135
00:16:20,680 --> 00:16:27,580
As you can see it has a little microprocessor and a couple of dials that basically shows you what's inside it.

136
00:16:27,580 --> 00:16:32,440
It means it's got some brains and it is a cluster.

137
00:16:32,880 --> 00:16:47,100
There is a key that tells you 0004 is an instrument cluster, however it might be called something else as in the language that it was originally written in, say in French.

138
00:16:47,280 --> 00:16:53,200
Looking at the wiring it says 18V which means it's 18 pins.

139
00:16:53,200 --> 00:17:02,620
BA means the color of the plug which I believe is white.

140
00:17:02,620 --> 00:17:03,640
I can't remember.

141
00:17:04,000 --> 00:17:08,360
I may be wrong but pin 18 or green is ground.

142
00:17:08,360 --> 00:17:10,840
Pin yellow is switched live.

143
00:17:11,980 --> 00:17:16,520
Pins 8 and 9 are CAN HIGH and CAN LOW.

144
00:17:16,740 --> 00:17:18,420
It's sort of potluck on that one.

145
00:17:18,420 --> 00:17:20,680
You might get it right first time, you might not.

146
00:17:20,680 --> 00:17:26,720
But if you don't get any messages back out of the device, swap them over and see what happens.

147
00:17:27,280 --> 00:17:28,880
So power supply.

148
00:17:28,880 --> 00:17:31,580
This power supply here came from Amazon.

149
00:17:31,620 --> 00:17:35,800
It's a USB to 12V barrel jack.

150
00:17:35,800 --> 00:17:40,140
So USB at 5V at one end, it's got a boost converter in the middle.

151
00:17:40,360 --> 00:17:44,480
That then can step it up to the 12V that is required for the cluster.

152
00:17:45,160 --> 00:17:53,540
Technically you need 13 point something volts if it was running with the alternator at full chat, but 12V should be enough.

153
00:17:53,860 --> 00:18:01,160
You could potentially use an ATX power supply, but I think it's overkill to have something that could potentially put 40 amps through it.

154
00:18:01,160 --> 00:18:03,600
So this is slightly safer.

155
00:18:04,380 --> 00:18:07,020
So on to the Linux software.

156
00:18:07,580 --> 00:18:12,880
When using CAN under Linux you need the package that is called CANutils.

157
00:18:13,460 --> 00:18:18,700
If you're running on a Raspberry Pi, install CANutils.

158
00:18:18,700 --> 00:18:21,460
It will then install all these components here.

159
00:18:22,360 --> 00:18:30,300
CANdump, it will basically output all CAN messages from the bus that is currently coming off the CAN bus.

160
00:18:30,300 --> 00:18:35,740
CANsniffer shows all messages that are changing on the bus.

161
00:18:35,800 --> 00:18:40,440
It does not show by default any message that is static.

162
00:18:40,440 --> 00:18:44,240
It will remove them from the screen, only shows you stuff that's changing.

163
00:18:44,240 --> 00:18:49,440
You can then make it highlight things to show when things change and when things don't.

164
00:18:50,120 --> 00:18:54,940
You can make it show all messages, but it's just one of the options.

165
00:18:55,600 --> 00:18:59,180
CANsend allows sending of a single CAN message.

166
00:18:59,800 --> 00:19:06,040
If you're very good at shell scripting you may be able to use that to send multiple messages in a for loop.

167
00:19:06,860 --> 00:19:13,620
It's not that easy to do unless you're really shithot at doing bash scripts.

168
00:19:14,340 --> 00:19:21,960
CANgen is a slightly better version of the same thing, in that it can generate messages either randomly or with specified logic.

169
00:19:22,640 --> 00:19:25,280
Finally, the last part is CANplayer.

170
00:19:25,340 --> 00:19:31,100
Basically, this will replay messages that you have logged to a text file using CANdump.

171
00:19:33,260 --> 00:19:42,640
And then you can then record something on a vehicle, bring it back to your cluster, and then replay it and see what happens.

172
00:19:42,640 --> 00:19:53,400
And then by selectively grepping those messages, you could replay it and find out which message does the speed, which message does whatever, or just fuzz it and see what happens.

173
00:19:53,880 --> 00:19:55,940
So, shall we start fuzzing?

174
00:28:17,380 --> 00:28:21,680
Good morning, good afternoon, good evening, depending on which time zone you're in.

175
00:28:21,680 --> 00:28:24,140
I'm Ian Tabor, or atminternet.

176
00:28:24,520 --> 00:28:27,640
This is my talk about Car Hacking Village.

177
00:28:27,640 --> 00:28:31,600
Sorry, Ian, we accidentally restarted.

178
00:28:32,820 --> 00:28:35,080
First things first, who am I?

179
00:28:35,080 --> 00:28:37,260
You could sound the ultimate car hacker.

180
00:28:37,380 --> 00:28:39,960
I built this kit car 15 years ago now.

181
00:28:40,740 --> 00:28:45,400
But I think we can probably take questions, yeah?

182
00:28:46,160 --> 00:28:48,080
It was just about finished.

183
00:28:48,080 --> 00:28:56,260
You were working on the fuzzing of and showing the different possibilities to fuzz the...

184
00:29:28,900 --> 00:29:29,860
Okay.

185
00:29:32,140 --> 00:29:53,620
So, if you do have questions to MintyNed or to Ian, please go ahead, write them in the text, the support, the CHV 101 support text group, and we can answer them.

186
00:29:55,460 --> 00:30:07,060
Ian, can you describe to us a little bit about what you built up there with your test rig?

187
00:30:31,540 --> 00:30:35,470
Got a lot of wiring there.

188
00:30:35,470 --> 00:30:38,850
And it actually thinks it's a running vehicle.

189
00:30:38,850 --> 00:30:45,770
So, not only does the lights work, and there's an indicator to show you like something on and off, etc.

190
00:30:45,930 --> 00:30:53,720
The engine thinks it's rotating by the Arduino attached to the crank and cam sensors.

191
00:30:54,250 --> 00:31:03,430
And that is basically spoofing the correct waveform that is used by the crank and cam sensors to work out where the engine is in the firing order.

192
00:31:03,850 --> 00:31:09,310
And then an indicator showing the injectors and the fuel being fired.

193
00:31:09,310 --> 00:31:16,670
So, if you were here in person, you would actually be able to see the lights flashing to show spark going off.

194
00:31:17,370 --> 00:31:22,510
There are some other simulators being used as well.

195
00:31:22,510 --> 00:31:29,170
So, there's a couple of potentiometers for the fuel gauge and the water temperature gauge.

196
00:31:29,170 --> 00:31:35,430
So, if you twist the fuel gauge potentiometer, you can make the fuel gauge go up and down.

197
00:31:35,730 --> 00:31:39,430
But it's still connected to where the fuel gauge would normally be.

198
00:31:40,310 --> 00:31:49,470
There's also a O2 simulator, which is required to get rid of one of those annoying engine warning lights.

199
00:31:50,810 --> 00:31:57,830
But that uses a 555 timer to generate an AC wave on a DC offset.

200
00:31:57,830 --> 00:32:06,850
And basically, it just varies between mean, rich, mean, rich, mean, rich, for both the pre and post.

201
00:32:09,510 --> 00:32:12,110
So, that's that.

202
00:32:12,110 --> 00:32:17,250
The hardest one to actually simulate is actually to get the car to think it was moving.

203
00:32:17,750 --> 00:32:22,430
So, originally, I tried to do it using an Arduino or something with a similar

204
00:32:26,870 --> 00:32:28,230
microcontroller.

205
00:32:28,310 --> 00:32:34,530
But I actually had to do it using a motor and a plastic disc.

206
00:32:34,530 --> 00:32:43,650
And it's actually a plastic disc with a reluctor ring that would normally be on your sub-axle attached to your wheel.

207
00:32:43,650 --> 00:32:49,230
So, there is a single motor with a reluctor ring attached to a plastic.

208
00:32:49,510 --> 00:32:53,250
Around that motor is four wheel speed sensors.

209
00:32:53,590 --> 00:33:06,670
And then there is an Arduino attached to that motor using PWM to vary the speed of that motor, and then thus vary the speed of the wheels that it thinks are rotating.

210
00:33:06,830 --> 00:33:17,750
There is then some feedback to that same circuitry that reads the speed of the can bus to see how fast it thinks it's going, try and match one to the other.

211
00:33:19,230 --> 00:33:23,390
But I was playing around with it earlier to try and fix it to make it slightly more accurate.

212
00:33:23,750 --> 00:33:26,150
And I worked with the encoder on the Arduino.

213
00:33:26,190 --> 00:33:29,390
So, I'm just really writing it as we speak.

214
00:33:30,030 --> 00:33:34,970
But I can get it to go full tilt, which means it goes at 181 miles an hour.

215
00:33:35,310 --> 00:33:40,470
And if you've ever seen a Project 208, I wouldn't want to do 181 now.

216
00:33:41,190 --> 00:33:45,870
I think it wrote itself a bit fast, but yeah.

217
00:33:46,250 --> 00:33:49,370
Disco mode is quite trippy.

218
00:33:50,270 --> 00:34:00,190
I have a couple of my little nano cans, or tiny cans, configured so that it sends it into Disco mode, makes all the dials go absolutely nuts.

219
00:34:01,150 --> 00:34:12,570
It's always good to show someone what you can do with CAN by just sending the right messages, but slightly faster, you would actually want to send them.

220
00:34:14,730 --> 00:34:18,630
My car in a box probably cost me about £2,000 to build.

221
00:34:20,230 --> 00:34:26,110
But I could have probably done it a bit cheaper by buying a whole car and saving the bits I didn't actually use.

222
00:34:26,270 --> 00:34:30,790
But then you've got the whole hassle of disposing of parts off the interior and body shells.

223
00:34:31,730 --> 00:34:34,710
I may be making another one again soon.

224
00:34:35,250 --> 00:34:37,210
But that's for my work.

225
00:34:43,670 --> 00:34:47,150
Which car are you thinking about doing next?

226
00:34:47,930 --> 00:34:50,150
I don't know, it depends on the budget.

227
00:34:51,070 --> 00:34:53,310
They won't tell me the budget yet.

228
00:34:55,830 --> 00:34:58,810
So if you can lend me one, I don't mind.

229
00:34:58,890 --> 00:35:00,690
I'll build one for you if you like.

230
00:35:01,590 --> 00:35:05,510
Well, I would really love for you to do it for me, actually.

231
00:35:07,210 --> 00:35:10,870
But I think this is something we'll have to talk about offline, huh?

232
00:35:11,230 --> 00:35:11,590
Yep.

233
00:35:11,650 --> 00:35:14,110
All right.

234
00:35:14,110 --> 00:35:15,330
Any more questions?

235
00:35:15,950 --> 00:35:19,750
Actually, I don't see so many questions in the chats.

236
00:35:23,890 --> 00:35:25,050
What's that?

237
00:35:25,390 --> 00:35:26,990
Apologies for the audio.

238
00:35:27,710 --> 00:35:30,450
I will be around tomorrow to talk over it.

239
00:35:31,570 --> 00:35:34,790
Yeah, it's pretty strange what happened.

240
00:35:34,790 --> 00:35:40,830
But it's, you know, this is part of the fun with our first virtual conference.

241
00:35:42,290 --> 00:35:45,850
So totally understandable.

242
00:35:45,850 --> 00:35:48,730
We'll try to fix it for next time.

243
00:35:50,550 --> 00:36:11,230
Ian, just quickly, because we're all beginners in this chat, in this talk, what type of tools or what can you tell us a little bit more about where you learn, which hardware you're using, which software you're using, what tools would you recommend?

244
00:36:11,230 --> 00:36:27,940
The stuff I've already mentioned in the talk, I've previously used on numerous occasions.

245
00:36:28,480 --> 00:36:34,100
There are the microcontrollers that have built-in fan controllers in them.

246
00:36:34,260 --> 00:36:40,520
There are also software for those on GitHub as well.

247
00:36:40,520 --> 00:36:54,380
And quite funny, when I was at the Bug Bash in 2018, we found a major vulnerability with the hardware that cost me about $30 worth of hardware.

248
00:36:54,380 --> 00:37:07,080
And we got a payout of five figures, because we were just a bit cheeky and found somewhere that the manufacturer hadn't thought of which software to actually break into the vehicle from.

249
00:37:07,320 --> 00:37:11,740
I won't tell you which vehicle, I won't tell you exactly how I broke into the vehicle.

250
00:37:12,540 --> 00:37:20,340
But yeah, you can buy very expensive things, like vehicles by value counting, things like that.

251
00:37:20,680 --> 00:37:35,460
But I would start at the beginning with something in the, like, nano-fan or something like that, just to see what you want to do, whether you can actually get used to it more than anything.

252
00:37:35,660 --> 00:37:45,880
Because there's no point in spending a few hundred dollars on hardware, and then you do it three times, and then you leave it and go, oh no, you've wasted your money.

253
00:37:46,360 --> 00:37:48,480
You may be able to resell it, you may not.

254
00:37:48,480 --> 00:37:59,980
But if you build something yourself, for five, ten dollars, it's no big deal if you never actually use it again.

255
00:38:00,740 --> 00:38:07,340
So, granted, yes, if I worked in one of those companies and I got them for free, I would say, buy one of those really expensive ones.

256
00:38:07,440 --> 00:38:13,520
But I don't, and I didn't, and I've managed to get through quite well where I am at the moment.

257
00:38:17,330 --> 00:38:24,690
Okay, well, Ian, thank you so much for the information, the great talk and presentation as well.

258
00:38:25,150 --> 00:38:33,870
I think we don't have any further questions, so unless you have something you would like to say to the audience, I think we can close out for today.

259
00:38:34,850 --> 00:38:41,470
If anyone needs any help with any of the challenges related to PvZero, just hit me up on Discord.

260
00:38:41,830 --> 00:38:45,530
I'm at Minternet on Twitter.

261
00:38:45,870 --> 00:38:47,450
I'm here to help.

262
00:38:47,490 --> 00:39:00,970
If you want me to make the car do other things so you can see what's going on, I can interact with it, make it go faster or slower, turn lights on, turn lights off, so you can see what's going on.

263
00:39:01,090 --> 00:39:02,310
I don't mind.

264
00:39:04,150 --> 00:39:10,650
If you don't do it, I'll just be sat here trying to rewrite that bit of software, getting a little more depressed.

265
00:39:11,250 --> 00:39:17,510
But yes, it's very strange being in Vegas time but being in London.

266
00:39:18,430 --> 00:39:24,530
And you're talking about the CTF or the virtual car hacking, of course, right?

267
00:39:24,790 --> 00:39:25,470
Yeah .

268
00:39:27,570 --> 00:39:28,570
Great.

269
00:39:28,570 --> 00:39:31,990
Well, Ian, thank you so much for the great talk.

270
00:39:31,990 --> 00:39:34,210
I'm sure everybody learned a lot.

271
00:39:35,670 --> 00:39:40,970
We have the next talk coming up in about 20 minutes.

272
00:39:40,970 --> 00:39:46,030
We're going to be talking about Bluetooth security and automotive with Kamil.

273
00:39:46,030 --> 00:39:54,790
So if you guys want to come learn about what's going on in Bluetooth security, please come join us here in 20 minutes.

274
00:39:54,790 --> 00:40:03,050
We'll be right back with Kamil, and he's going to talk about the Bluetooth interfaces of vehicles.

275
00:40:03,330 --> 00:40:04,910
All right.

276
00:40:04,910 --> 00:40:06,330
Thank you very much, guys.