start	end	text
0	3950	Twitch, please feel free to join the Discord.
6460	11370	Https://discord.gg, Defcon, and join the conversation.
13040	20280	All right, without further ado, let's discuss ClusterFuzz.
70100	73920	Can, so you could potentially hack this vehicle.
73940	78800	Please don't. It's great fun when it's driving. It's not fun when it's not.
79080	82540	Um, a little disclaimer down the bottom there.
82540	84960	Car hacking is done at your own risk.
85000	89500	If you brick your own car, please do not blame me or the Car Hacking Village.
90080	92900	So, on to my car hacking credentials.
92980	98240	In 2007, I hacked my own vehicle, found an issue in the Hedge Unit,
98240	104460	in which you could get access to personal information inside the Hedge Unit quite easily.
104520	107760	I disclosed that information to the manufacturer itself.
107760	113920	I then did a talk about it at Defcon Group in London, DC4420,
113920	119120	B-side London Rookie Track, and Defcon 26 Car Hacking Village.
119220	123960	In 2018, I was also invited to be one of 12 security researchers
124540	128280	to go to Bug Crowd's live car hacking event.
128620	134300	I then returned in 2019 to be one of 20 security researchers to go to
135020	140940	the same event for the same manufacturer at their factory over in the US.
141460	145960	Last year at Defcon 27, I was part of a Bug Crowd
145960	151760	car hacking panel with Cyber Giddens and Spectres hosted by Chloe.
152500	162280	I was also asked last year to go to the Auto Isaac Summit in Texas at Toyota's plant,
162280	167940	where me and a couple of others were part of a car hacking vulnerability disclosure
167940	170620	policy panel for HackerOne.
171680	175640	I also now, for my sins, run the Car Hacking Village in the UK.
176840	184140	I have my car in the box, PD0, which is all the electronics from a Peugeot 208 in a box,
184140	189980	in quite a portable form. Not as portable as being globally movable, but
190820	194860	last year I did about 13 events, one of which was in Europe.
195040	201060	I have been asked to take it all the way around the world, India, Australia, Brazil, America,
201060	206440	Egypt. The only continent I don't think I've been asked to go to is Antarctica.
207080	209120	This year I was meant to do
210100	215660	beside Stuttgart, beside Brussels, but things have happened, as we know,
215660	217940	and there's been quite a few virtual conferences,
217940	224320	which also means my car in the box will be available for the virtual.carhackingvillage.com
225200	230840	CTF. If you look for PD0, there is two Raspberry Pis attached,
230840	236940	one on two of the buses, one on the third. You can then basically hack that vehicle
236940	242220	in a safe manner. You won't break anything really, unless you try really, really hard.
243400	246560	It's quite good that it's actually going to be used at DEF CON
247200	255980	without me leaving my own home. I will miss the people. However, travel is not really fun at the
255980	263160	moment. So there are some hints and tips for the CTF for the Carhacking Village 101 in this
263160	269540	presentation and the fuzzing that I will show you. You may want to pause and rewind some of this
269540	274840	at a later time, but I'm not going to give you any more hints than that.
275400	281280	So where do we start? The assumption is you all know what CAN is. Controller Area Network.
281280	288480	It's a differential signalling communication system that allows lots of devices on a single
288480	294700	bus to communicate, and has an arbitration system to allow the most important message to go out
294700	300440	first. You don't really need to know much more about that, but if you want to have a read
301500	308280	on Carhacker's Handbook by Craig Smith, it is a good read. So first things first,
308280	315020	you need a cheap CAN adapter. I will go into those in a second. Once you have a cheap CAN adapter,
315020	320560	you could try reading your own car. Be very careful if you do. I plugged in one of my own
320560	329040	home-built CAN adapters into my 2017 Jaguar XE and managed to make the car lose its gearbox.
329580	333220	Yeah, that was one of those moments where I was thinking, oops, I probably shouldn't have done
333220	340080	that, and I was thinking pound signs. I did manage to get it back eventually, but it involves
340080	346120	disconnecting the power for a considerable length of time, about 20 minutes. Plugging it back in,
346120	350740	all the messages were then reset. However, the next morning when I went to drive it,
350740	354620	it took about three and a half weeks to learn how to change gear again, because it had the
354620	364100	automatic ZF gearbox as used in a lot of automatic vehicles these days. So slightly easier
364100	371140	and slightly less dangerous is testing something that you can actually use outside of the vehicle.
371200	375540	Do not test on your own vehicle, because if you break your own car and can't get Johnny to school
375540	380320	in the morning, your missus will kill you and you will be doing the walk of shame in the rain.
380320	387420	Not a good idea. So I'm going to show you an instrument cluster that I have. I will show you
387420	395760	how to interpret a wiring diagram, what then is required for power supply, and then some tools
395760	403760	that you can use. And I will show you some fuzzing, and you can see some results on the screen
403760	411240	of what's actually happening. So first things first is the NanoCan adapter. I use this device
411240	419300	as the PCB itself as my business card. I started doing it in early 2018 when I first started the
419300	423580	Car Hacking Village, in that it was something I could give away at the conference to say,
423580	429780	here's a way to start doing car hacking. All you need is five, ten dollars worth of components,
429780	432480	which include an Arduino Nano,
434980	444080	an MCP2515 module, a bit of wire, the PCB, and the OBD2 plug as shown there.
445980	450540	What you would then do is solder it all together as shown on the GitHub
452260	459020	instructions. You then can program the Arduino Nano with a basic sketch that reads all messages,
459020	465340	and you get an output like this. You can reprogram it with other sketches that allow you to
465340	470960	read and write data, but unless you know what you're doing, have a play with something first
470960	477520	listening and not sending. Here is the same output but using Putty to interpret the data
477520	486760	instead of the Arduino IDE. Again, if anyone wants one of these PCBs, hit me up on Slack or on
486760	496060	Twitter or email me if you want to. I will put it in the post. If you're a distance away it might
496060	503400	cost you the postage, which isn't that expensive. However, at the moment postage around the world
503400	510660	is getting silly because of COVID costing extra money, but hit me up anyway. I will be online
510660	518560	after this talk on the Discord channels for questions etc. Here's a second one of my
518560	528240	adapters that I built. That is a PoundCoin 4Scale. That little device there is based on an ATTiny
528240	536740	1614 processor which costs about 50 pence or about 50 cents, maybe a little bit less if you buy
536740	550660	quantity. It uses the same MCP2515 CAN controller and a SN65HVD230 CAN transceiver from Texas
550660	558880	Instruments. The other two are from Microchip. This will allow you to build a CAN device for
558880	563400	probably less than three dollars for all the components there. However, you need some extra
563400	567640	parts to actually connect it to the vehicle if you want to connect it to the vehicle.
567960	574540	There are two versions of this board. The red board is the main brains. The other board behind
574540	580900	it, the little blue board you can see there, has the power supply and the connectivity onto the
580900	590100	CAN bus. This one here is for nefarious purposes in that you can program the board at the top to
590100	594400	listen for certain messages. When it sees a certain message it can then start sending
594400	600400	messages back onto the bus. This is powered from the CAN bus port. The blue PCB in the middle has
600400	607280	the power supply that brings it down from 12 volts to 3.3 and the plug at the back will then go into
607280	614560	the OBD2 port and allow you to do various things. Be careful when you're doing this, again you could
614560	621300	break things unless you know what you're doing. The other version of the TinyCAN adapter is here.
621660	628620	This is a green board in the middle. This green board has an extra connector for a USB to TTL
628620	638180	adapter. This adapter allows you to connect it to a Linux system using SL-CAN, so serial line CAN
638180	645760	and socket CAN and CAN utils. You can then send messages from the Linux system
647240	653640	using CAN utils which I will go into in a second. This again, all of the hardware there is probably
653640	658780	about seven dollars worth of hardware. At some point in the future I will put this up on GitHub
658780	666600	as another repository. If you want me to, just pester me, I'll do it quicker.
668960	675560	Another cheaper CAN adapter you can use if you've got a Raspberry Pi lying around doing not a lot.
675760	682020	Here is the PiCAN for Raspberry Pi. This is made by SK Pang in the UK.
682840	691360	It uses the similar Microchip CAN transceiver and CAN controller, however it's got a DB9 adapter
691360	698420	to connect it to the CAN OBD2 port on the vehicle. You can also use the screw terminals.
698800	704980	One little hint is just behind the DB9 connector are some solder pads. You have to solder them in
704980	709820	such a way that it uses the correct pins, because there are two different versions of the same
710440	714880	cable that may or may not work. It took me a while to work that one out, but
715840	723920	this will cost you probably about 35 to 40 dollars, 35 to 40 UK pounds. The website there
723920	730120	is in the UK, but I believe he sells them in the US as well through other outlets.
731000	739260	Here again is a screenshot of CANdump showing CAN messages from the CAN bus.
739260	745460	And finally out of the cheaper end of the CAN adapters is the CANtact,
745900	753720	which is by Eric Evencheck, linked down the bottom there. This I believe is based on the STM32
754880	762660	and inbuilt CAN controller and CAN transceiver. This has got the same 9-pin adapter on the end,
763640	774240	a large USB-B connector. These retail I believe around 75 dollars, which is okay if you're in
774240	780040	America, but if you're in the UK you get stuck with customs and VAT. The jumpers in the middle
780040	786840	there are for changing which pins go to where, slightly similar to the PiCan. He's currently
787560	794160	on Kickstarter though doing the CANtact Pro, which uses a slightly different processor
794160	805760	that gives you two isolated CAN FD channels. Worth a look if you're interested in backing
806100	811200	a Kickstarter. I might end up backing it myself if I haven't already done by then,
811200	817380	by the time this goes out. So on to the instrument cluster itself. Here is the instrument
817380	825420	cluster. It came from a Citroën DS3. They are not sold in the US. None of Citroën's group
825420	839120	vehicles are sold in the US. This cost me about £30, which is probably about 25-ish dollars.
839120	846780	You can get these from eBay, Scrapyard yourself, Vehicle Dismantler, Recycler etc.
847180	852760	This one has an OBD2 port underneath in the middle there. This is because I use it for
852760	861880	training purposes. So this is a very similar instrument cluster with regard to messages
861880	870140	as my car in the box. A little hint here, listen up. The car in the box is based on a Peugeot 208,
870140	875980	which is a similar sized vehicle to a DS3. However, it's just got a slightly different
875980	881520	cluster. The message structures are very similar, if not the same.
882540	887520	Here's the back of the instrument cluster. As you can see, there's some screw holes which
887520	894720	hold it into the vehicle. One of which screw holes is blocked up with a barrel jack socket.
895980	904260	You've then got a 18-pin connector for the device. If you are purchasing it from a
904260	909740	vehicle recycler or scrapyard, see if you can get the cable as well because it's always easier
909740	915260	to attach something to a cable that goes in specifically to that device, as opposed to
915260	919840	DuPont cables and trying to select the right cable.
921080	931840	Just zoom in on the plug itself. It's 18 pins. Pin 1 is bottom right, pin 9 is top right,
931840	942700	pin 10 is bottom left, pin 18 is top left, and as you can see there, pin 8 is CAN HIGH,
942700	950900	pin 9 is CAN LOW, pin 15 is 12V, and pin 18 is GROUND. Some of the other pins do things,
950900	955660	some of the other pins do not. But be careful because you may break things if you send
955660	962680	the wrong voltage up the wrong pin. So how do you work out what pin does what? You have to get the
962680	971860	wiring diagram. This is the wiring diagram for the DS3 for the head unit and infotainment system.
972820	980680	If you zoom in right in the middle of there, there is the device that is the instrument cluster.
980680	986600	As you can see it has a little microprocessor and a couple of dials that basically shows you
986600	995940	what's inside it. It means it's got some brains and it is a cluster. There is a
995940	1001080	key that tells you 0004 is an instrument cluster, however it might be called something else
1001700	1010160	as in the language that it was originally written in, say in French. Looking at the wiring it says
1010160	1022860	18V which means it's 18 pins. BA means the color of the plug which I believe is white. I can't
1022860	1033100	remember. I may be wrong but pin 18 or green is ground. Pin yellow is switched live. Pins 8 and
1033100	1039660	9 are CAN HIGH and CAN LOW. It's sort of potluck on that one. You might get it right first time,
1039660	1045660	you might not. But if you don't get any messages back out of the device, swap them over and see
1045660	1053760	what happens. So power supply. This power supply here came from Amazon. It's a USB to 12V
1054400	1060140	barrel jack. So USB at 5V at one end, it's got a boost converter in the middle.
1060360	1064480	That then can step it up to the 12V that is required for the cluster.
1065160	1070860	Technically you need 13 point something volts if it was running with the alternator at full
1070860	1077020	chat, but 12V should be enough. You could potentially use an ATX power supply,
1077020	1081160	but I think it's overkill to have something that could potentially put 40 amps through it.
1081160	1090460	So this is slightly safer. So on to the Linux software. When using CAN under Linux you need
1090460	1096180	the package that is called CANutils. If you're running on a Raspberry Pi,
1096180	1101460	install CANutils. It will then install all these components here.
1102360	1107040	CANdump, it will basically output all CAN messages from the bus that is currently
1107620	1115740	coming off the CAN bus. CANsniffer shows all messages that are changing on the bus.
1115800	1122120	It does not show by default any message that is static. It will remove them from the screen,
1122120	1126780	only shows you stuff that's changing. You can then make it highlight things to show
1126780	1132190	when things change and when things don't. You can make it show all messages,
1132560	1139180	but it's just one of the options. CANsend allows sending of a single CAN message.
1139800	1144040	If you're very good at shell scripting you may be able to use that to send multiple
1144040	1149980	messages in a for loop. It's not that easy to do unless you're really shithot
1149980	1156920	at doing bash scripts. CANgen is a slightly better version of the same thing,
1156920	1161960	in that it can generate messages either randomly or with specified logic.
1162640	1168980	Finally, the last part is CANplayer. Basically, this will replay messages that you have logged
1168980	1178440	to a text file using CANdump. And then you can then record something on a vehicle,
1178440	1182640	bring it back to your cluster, and then replay it and see what happens.
1182640	1187960	And then by selectively grepping those messages, you could replay it and find out which message
1187960	1193400	does the speed, which message does whatever, or just fuzz it and see what happens.
1193880	1195940	So, shall we start fuzzing?
1697380	1701680	Good morning, good afternoon, good evening, depending on which time zone you're in.
1701680	1707640	I'm Ian Tabor, or atminternet. This is my talk about Car Hacking Village.
1707640	1711600	Sorry, Ian, we accidentally restarted.
1712820	1717260	First things first, who am I? You could sound the ultimate car hacker.
1717380	1719960	I built this kit car 15 years ago now.
1720740	1725400	But I think we can probably take questions, yeah?
1726160	1730840	It was just about finished. You were working on the fuzzing of
1730840	1736260	and showing the different possibilities to fuzz the...
1768900	1769860	Okay.
1772140	1784340	So, if you do have questions to MintyNed or to Ian, please go ahead,
1784340	1793620	write them in the text, the support, the CHV 101 support text group, and we can answer them.
1795460	1807060	Ian, can you describe to us a little bit about what you built up there with your test rig?
1831540	1838850	Got a lot of wiring there. And it actually thinks it's a running vehicle.
1838850	1844850	So, not only does the lights work, and there's an indicator to show you like something on and off,
1844850	1853720	etc. The engine thinks it's rotating by the Arduino attached to the crank and cam sensors.
1854250	1860410	And that is basically spoofing the correct waveform that is used by the crank and cam
1860410	1863430	sensors to work out where the engine is in the firing order.
1863850	1869310	And then an indicator showing the injectors and the fuel being fired.
1869310	1873250	So, if you were here in person, you would actually be able to see the lights flashing
1873250	1882510	to show spark going off. There are some other simulators being used as well.
1882510	1889170	So, there's a couple of potentiometers for the fuel gauge and the water temperature gauge.
1889170	1895430	So, if you twist the fuel gauge potentiometer, you can make the fuel gauge go up and down.
1895730	1899430	But it's still connected to where the fuel gauge would normally be.
1900310	1906950	There's also a O2 simulator, which is required to get rid of one of those annoying
1907710	1917830	engine warning lights. But that uses a 555 timer to generate an AC wave on a DC offset.
1917830	1923690	And basically, it just varies between mean, rich, mean, rich, mean, rich,
1924330	1932110	for both the pre and post. So, that's that.
1932110	1937250	The hardest one to actually simulate is actually to get the car to think it was moving.
1937750	1942430	So, originally, I tried to do it using an Arduino or something with a similar
1946870	1954530	microcontroller. But I actually had to do it using a motor and a plastic disc.
1954530	1959690	And it's actually a plastic disc with a reluctor ring that would normally be on your
1960490	1968090	sub-axle attached to your wheel. So, there is a single motor with a reluctor ring attached to
1968310	1974910	a plastic. Around that motor is four wheel speed sensors. And then there is an Arduino
1974910	1981930	attached to that motor using PWM to vary the speed of that motor, and then thus vary the
1983270	1989490	speed of the wheels that it thinks are rotating. There is then some feedback to that same circuitry
1989490	1995970	that reads the speed of the can bus to see how fast it thinks it's going,
1995970	2001550	try and match one to the other. But I was playing around with it earlier to try and
2001550	2006150	fix it to make it slightly more accurate. And I worked with the encoder on the Arduino.
2006190	2013190	So, I'm just really writing it as we speak. But I can get it to go full tilt, which means it goes
2013190	2020470	at 181 miles an hour. And if you've ever seen a Project 208, I wouldn't want to do 181 now.
2021190	2029370	I think it wrote itself a bit fast, but yeah. Disco mode is quite trippy.
2030270	2037190	I have a couple of my little nano cans, or tiny cans, configured so that it sends it
2037190	2042890	into Disco mode, makes all the dials go absolutely nuts. It's always good to show someone
2043730	2049950	what you can do with CAN by just sending the right messages, but slightly faster,
2049950	2058630	you would actually want to send them. My car in a box probably cost me about £2,000 to build.
2060230	2064870	But I could have probably done it a bit cheaper by buying a whole car and saving the bits I didn't
2064870	2069490	actually use. But then you've got the whole hassle of disposing of parts off the interior
2069490	2077210	and body shells. I may be making another one again soon. But that's for my work.
2083670	2087150	Which car are you thinking about doing next?
2087930	2093310	I don't know, it depends on the budget. They won't tell me the budget yet.
2095830	2100690	So if you can lend me one, I don't mind. I'll build one for you if you like.
2101590	2105510	Well, I would really love for you to do it for me, actually.
2107210	2110870	But I think this is something we'll have to talk about offline, huh?
2111230	2119750	Yep. All right. Any more questions? Actually, I don't see so many questions in the chats.
2123890	2130450	What's that? Apologies for the audio. I will be around tomorrow to talk over it.
2131570	2136870	Yeah, it's pretty strange what happened. But it's, you know, this is part of the fun with
2136870	2147270	our first virtual conference. So totally understandable. We'll try to fix it for next
2147270	2158970	time. Ian, just quickly, because we're all beginners in this chat, in this talk,
2158970	2165890	what type of tools or what can you tell us a little bit more about where you learn,
2165890	2171230	which hardware you're using, which software you're using, what tools would you recommend?
2171230	2187940	The stuff I've already mentioned in the talk, I've previously used on numerous occasions.
2188480	2195140	There are the microcontrollers that have built-in fan controllers in them. There are also
2195700	2203620	software for those on GitHub as well. And quite funny, when I was at the
2203620	2211860	Bug Bash in 2018, we found a major vulnerability with the hardware that cost me about $30
2212740	2219900	worth of hardware. And we got a payout of five figures, because we were just a bit cheeky and
2219900	2225580	found somewhere that the manufacturer hadn't thought of which software to actually break
2225580	2230580	into the vehicle from. I won't tell you which vehicle, I won't tell you exactly how I broke
2230580	2239160	into the vehicle. But yeah, you can buy very expensive things, like vehicles by value counting,
2239160	2247440	things like that. But I would start at the beginning with something in the, like,
2247440	2252720	nano-fan or something like that, just to see what you want to do, whether you can actually
2253360	2258700	get used to it more than anything. Because there's no point in spending a few hundred dollars on
2258700	2265020	hardware, and then you do it three times, and then you leave it and go, oh no, you've wasted
2265020	2272320	your money. You may be able to resell it, you may not. But if you build something yourself,
2272320	2279980	for five, ten dollars, it's no big deal if you never actually use it again.
2280740	2285320	So, granted, yes, if I worked in one of those companies and I got them for free, I would say,
2285320	2290740	buy one of those really expensive ones. But I don't, and I didn't, and I've managed to get
2290740	2300510	through quite well where I am at the moment. Okay, well, Ian, thank you so much for the
2300510	2308210	information, the great talk and presentation as well. I think we don't have any further questions,
2308210	2312950	so unless you have something you would like to say to the audience, I think we can close out for
2312950	2320490	today. If anyone needs any help with any of the challenges related to PvZero, just hit me up on
2320490	2329650	Discord. I'm at Minternet on Twitter. I'm here to help. If you want me to make the car do other
2329650	2336270	things so you can see what's going on, I can interact with it, make it go faster or slower,
2336270	2342310	turn lights on, turn lights off, so you can see what's going on. I don't mind.
2344150	2348190	If you don't do it, I'll just be sat here trying to rewrite that bit of software,
2349010	2357510	getting a little more depressed. But yes, it's very strange being in Vegas time but being in London.
2358430	2364530	And you're talking about the CTF or the virtual car hacking, of course, right?
2364790	2365470	Yeah.
2367570	2374210	Great. Well, Ian, thank you so much for the great talk. I'm sure everybody learned a lot.
2375670	2382890	We have the next talk coming up in about 20 minutes. We're going to be talking about Bluetooth
2382890	2390210	security and automotive with Kamil. So if you guys want to come learn about what's going on
2390210	2397710	in Bluetooth security, please come join us here in 20 minutes. We'll be right back with Kamil,
2397710	2405290	and he's going to talk about the Bluetooth interfaces of vehicles. All right. Thank you
2405290	2406330	very much, guys.