WEBVTT 00:00.000 --> 00:03.950 Twitch, please feel free to join the Discord. 00:06.460 --> 00:11.370 Https://discord.gg, Defcon, and join the conversation. 00:13.040 --> 00:20.280 All right, without further ado, let's discuss ClusterFuzz. 01:10.100 --> 01:13.920 Can, so you could potentially hack this vehicle. 01:13.940 --> 01:14.960 Please don't. 01:14.960 --> 01:16.980 It's great fun when it's driving. 01:16.980 --> 01:18.800 It's not fun when it's not. 01:19.080 --> 01:22.540 Um, a little disclaimer down the bottom there. 01:22.540 --> 01:24.960 Car hacking is done at your own risk. 01:25.000 --> 01:29.500 If you brick your own car, please do not blame me or the Car Hacking Village. 01:30.080 --> 01:32.900 So, on to my car hacking credentials. 01:32.980 --> 01:44.460 In 2007, I hacked my own vehicle, found an issue in the Hedge Unit, in which you could get access to personal information inside the Hedge Unit quite easily. 01:44.520 --> 01:47.760 I disclosed that information to the manufacturer itself. 01:47.760 --> 01:59.120 I then did a talk about it at Defcon Group in London, DC4420, B-side London Rookie Track, and Defcon 26 Car Hacking Village. 01:59.220 --> 02:08.280 In 2018, I was also invited to be one of 12 security researchers to go to Bug Crowd's live car hacking event. 02:08.620 --> 02:20.940 I then returned in 2019 to be one of 20 security researchers to go to the same event for the same manufacturer at their factory over in the US. 02:21.460 --> 02:31.760 Last year at Defcon 27, I was part of a Bug Crowd car hacking panel with Cyber Giddens and Spectres hosted by Chloe. 02:32.500 --> 02:50.620 I was also asked last year to go to the Auto Isaac Summit in Texas at Toyota's plant, where me and a couple of others were part of a car hacking vulnerability disclosure policy panel for HackerOne. 02:51.680 --> 02:55.640 I also now, for my sins, run the Car Hacking Village in the UK. 02:56.840 --> 03:06.460 I have my car in the box, PD0, which is all the electronics from a Peugeot 208 in a box, in quite a portable form. 03:06.640 --> 03:14.860 Not as portable as being globally movable, but last year I did about 13 events, one of which was in Europe. 03:15.040 --> 03:22.500 I have been asked to take it all the way around the world, India, Australia, Brazil, America, Egypt. 03:22.540 --> 03:26.440 The only continent I don't think I've been asked to go to is Antarctica. 03:27.080 --> 03:46.200 This year I was meant to do beside Stuttgart, beside Brussels, but things have happened, as we know, and there's been quite a few virtual conferences, which also means my car in the box will be available for the virtual.carhackingvillage.com CTF. 03:46.420 --> 03:53.380 If you look for PD0, there is two Raspberry Pis attached, one on two of the buses, one on the third. 03:53.480 --> 03:58.600 You can then basically hack that vehicle in a safe manner. 03:58.620 --> 04:02.220 You won't break anything really, unless you try really, really hard. 04:03.400 --> 04:10.580 It's quite good that it's actually going to be used at DEF CON without me leaving my own home. 04:11.100 --> 04:12.740 I will miss the people. 04:12.940 --> 04:16.760 However, travel is not really fun at the moment. 04:17.060 --> 04:26.280 So there are some hints and tips for the CTF for the Carhacking Village 101 in this presentation and the fuzzing that I will show you. 04:26.320 --> 04:34.840 You may want to pause and rewind some of this at a later time, but I'm not going to give you any more hints than that. 04:35.400 --> 04:37.400 So where do we start? 04:37.760 --> 04:39.780 The assumption is you all know what CAN is. 04:39.780 --> 04:41.280 Controller Area Network. 04:41.280 --> 04:55.560 It's a differential signalling communication system that allows lots of devices on a single bus to communicate, and has an arbitration system to allow the most important message to go out first. 04:56.240 --> 05:06.340 You don't really need to know much more about that, but if you want to have a read on Carhacker's Handbook by Craig Smith, it is a good read. 05:06.820 --> 05:10.100 So first things first, you need a cheap CAN adapter. 05:11.040 --> 05:13.300 I will go into those in a second. 05:13.460 --> 05:17.020 Once you have a cheap CAN adapter, you could try reading your own car. 05:17.040 --> 05:19.100 Be very careful if you do. 05:19.200 --> 05:29.040 I plugged in one of my own home-built CAN adapters into my 2017 Jaguar XE and managed to make the car lose its gearbox. 05:29.580 --> 05:36.520 Yeah, that was one of those moments where I was thinking, oops, I probably shouldn't have done that, and I was thinking pound signs. 05:37.360 --> 05:44.600 I did manage to get it back eventually, but it involves disconnecting the power for a considerable length of time, about 20 minutes. 05:44.900 --> 05:47.920 Plugging it back in, all the messages were then reset. 05:48.460 --> 06:01.700 However, the next morning when I went to drive it, it took about three and a half weeks to learn how to change gear again, because it had the automatic ZF gearbox as used in a lot of automatic vehicles these days. 06:02.380 --> 06:11.140 So slightly easier and slightly less dangerous is testing something that you can actually use outside of the vehicle. 06:11.200 --> 06:20.320 Do not test on your own vehicle, because if you break your own car and can't get Johnny to school in the morning, your missus will kill you and you will be doing the walk of shame in the rain. 06:20.320 --> 06:21.700 Not a good idea. 06:21.700 --> 06:26.400 So I'm going to show you an instrument cluster that I have. 06:26.400 --> 06:37.160 I will show you how to interpret a wiring diagram, what then is required for power supply, and then some tools that you can use. 06:37.420 --> 06:45.480 And I will show you some fuzzing, and you can see some results on the screen of what's actually happening. 06:45.960 --> 06:49.700 So first things first is the NanoCan adapter. 06:49.700 --> 06:54.820 I use this device as the PCB itself as my business card. 06:54.820 --> 07:06.200 I started doing it in early 2018 when I first started the Car Hacking Village, in that it was something I could give away at the conference to say, here's a way to start doing car hacking. 07:06.200 --> 07:24.080 All you need is five, ten dollars worth of components, which include an Arduino Nano, an MCP2515 module, a bit of wire, the PCB, and the OBD2 plug as shown there. 07:25.980 --> 07:33.480 What you would then do is solder it all together as shown on the GitHub instructions. 07:33.480 --> 07:41.920 You then can program the Arduino Nano with a basic sketch that reads all messages, and you get an output like this. 07:42.360 --> 07:53.180 You can reprogram it with other sketches that allow you to read and write data, but unless you know what you're doing, have a play with something first listening and not sending. 07:53.360 --> 08:00.160 Here is the same output but using Putty to interpret the data instead of the Arduino IDE. 08:00.560 --> 08:10.300 Again, if anyone wants one of these PCBs, hit me up on Slack or on Twitter or email me if you want to. 08:11.000 --> 08:12.900 I will put it in the post. 08:12.900 --> 08:20.200 If you're a distance away it might cost you the postage, which isn't that expensive. 08:20.200 --> 08:29.740 However, at the moment postage around the world is getting silly because of COVID costing extra money, but hit me up anyway. 08:29.740 --> 08:36.480 I will be online after this talk on the Discord channels for questions etc. 08:36.720 --> 08:40.160 Here's a second one of my adapters that I built. 08:40.160 --> 08:42.760 That is a PoundCoin 4Scale. 08:42.760 --> 08:57.740 That little device there is based on an ATTiny 1614 processor which costs about 50 pence or about 50 cents, maybe a little bit less if you buy quantity. 08:57.740 --> 09:11.460 It uses the same MCP2515 CAN controller and a SN65HVD230 CAN transceiver from Texas Instruments. 09:11.460 --> 09:13.300 The other two are from Microchip. 09:13.880 --> 09:22.060 This will allow you to build a CAN device for probably less than three dollars for all the components there. 09:22.080 --> 09:27.640 However, you need some extra parts to actually connect it to the vehicle if you want to connect it to the vehicle. 09:27.960 --> 09:30.180 There are two versions of this board. 09:31.060 --> 09:33.520 The red board is the main brains. 09:33.520 --> 09:41.740 The other board behind it, the little blue board you can see there, has the power supply and the connectivity onto the CAN bus. 09:41.940 --> 09:51.860 This one here is for nefarious purposes in that you can program the board at the top to listen for certain messages. 09:51.960 --> 09:56.100 When it sees a certain message it can then start sending messages back onto the bus. 09:56.200 --> 09:58.520 This is powered from the CAN bus port. 09:58.580 --> 10:11.660 The blue PCB in the middle has the power supply that brings it down from 12 volts to 3.3 and the plug at the back will then go into the OBD2 port and allow you to do various things. 10:12.300 --> 10:16.760 Be careful when you're doing this, again you could break things unless you know what you're doing. 10:17.000 --> 10:21.300 The other version of the TinyCAN adapter is here. 10:21.660 --> 10:23.900 This is a green board in the middle. 10:23.900 --> 10:29.720 This green board has an extra connector for a USB to TTL adapter. 10:29.980 --> 10:41.620 This adapter allows you to connect it to a Linux system using SL-CAN, so serial line CAN and socket CAN and CAN utils. 10:41.660 --> 10:50.580 You can then send messages from the Linux system using CAN utils which I will go into in a second. 10:50.820 --> 10:55.360 This again, all of the hardware there is probably about seven dollars worth of hardware. 10:55.360 --> 11:00.940 At some point in the future I will put this up on GitHub as another repository. 11:03.080 --> 11:06.600 If you want me to, just pester me, I'll do it quicker. 11:08.960 --> 11:15.560 Another cheaper CAN adapter you can use if you've got a Raspberry Pi lying around doing not a lot. 11:15.760 --> 11:18.500 Here is the PiCAN for Raspberry Pi. 11:18.500 --> 11:22.020 This is made by SK Pang in the UK. 11:22.840 --> 11:36.360 It uses the similar Microchip CAN transceiver and CAN controller, however it's got a DB9 adapter to connect it to the CAN OBD2 port on the vehicle. 11:36.360 --> 11:38.420 You can also use the screw terminals. 11:38.800 --> 11:43.660 One little hint is just behind the DB9 connector are some solder pads. 11:43.740 --> 11:52.720 You have to solder them in such a way that it uses the correct pins, because there are two different versions of the same cable that may or may not work. 11:53.300 --> 12:02.820 It took me a while to work that one out, but this will cost you probably about 35 to 40 dollars, 35 to 40 UK pounds. 12:02.940 --> 12:10.120 The website there is in the UK, but I believe he sells them in the US as well through other outlets. 12:11.000 --> 12:19.260 Here again is a screenshot of CANdump showing CAN messages from the CAN bus. 12:19.260 --> 12:30.860 And finally out of the cheaper end of the CAN adapters is the CANtact, which is by Eric Evencheck, linked down the bottom there. 12:31.060 --> 12:38.800 This I believe is based on the STM32 and inbuilt CAN controller and CAN transceiver. 12:39.480 --> 12:47.960 This has got the same 9-pin adapter on the end, a large USB-B connector. 12:48.960 --> 12:58.380 These retail I believe around 75 dollars, which is okay if you're in America, but if you're in the UK you get stuck with customs and VAT. 12:58.720 --> 13:05.500 The jumpers in the middle there are for changing which pins go to where, slightly similar to the PiCan. 13:05.780 --> 13:21.320 He's currently on Kickstarter though doing the CANtact Pro, which uses a slightly different processor that gives you two isolated CAN FD channels. 13:22.800 --> 13:27.240 Worth a look if you're interested in backing a Kickstarter. 13:27.320 --> 13:32.840 I might end up backing it myself if I haven't already done by then, by the time this goes out. 13:33.260 --> 13:36.600 So on to the instrument cluster itself. 13:36.600 --> 13:38.040 Here is the instrument cluster. 13:38.040 --> 13:41.280 It came from a Citroën DS3. 13:41.640 --> 13:43.760 They are not sold in the US. 13:43.760 --> 13:47.920 None of Citroën's group vehicles are sold in the US. 13:49.700 --> 13:59.120 This cost me about £30, which is probably about 25-ish dollars. 13:59.120 --> 14:06.780 You can get these from eBay, Scrapyard yourself, Vehicle Dismantler, Recycler etc. 14:07.180 --> 14:11.420 This one has an OBD2 port underneath in the middle there. 14:11.420 --> 14:14.900 This is because I use it for training purposes. 14:16.000 --> 14:24.200 So this is a very similar instrument cluster with regard to messages as my car in the box. 14:24.200 --> 14:26.460 A little hint here, listen up. 14:27.500 --> 14:33.560 The car in the box is based on a Peugeot 208, which is a similar sized vehicle to a DS3. 14:33.740 --> 14:36.900 However, it's just got a slightly different cluster. 14:37.000 --> 14:41.520 The message structures are very similar, if not the same. 14:42.540 --> 14:44.840 Here's the back of the instrument cluster. 14:45.440 --> 14:48.800 As you can see, there's some screw holes which hold it into the vehicle. 14:48.820 --> 14:54.720 One of which screw holes is blocked up with a barrel jack socket. 14:55.980 --> 15:00.780 You've then got a 18-pin connector for the device. 15:00.820 --> 15:19.840 If you are purchasing it from a vehicle recycler or scrapyard, see if you can get the cable as well because it's always easier to attach something to a cable that goes in specifically to that device, as opposed to DuPont cables and trying to select the right cable. 15:21.080 --> 15:24.240 Just zoom in on the plug itself. 15:24.540 --> 15:26.640 It's 18 pins. 15:27.140 --> 15:49.160 Pin 1 is bottom right, pin 9 is top right, pin 10 is bottom left, pin 18 is top left, and as you can see there, pin 8 is CAN HIGH, pin 9 is CAN LOW, pin 15 is 12V, and pin 18 is GROUND. 15:49.280 --> 15:52.980 Some of the other pins do things, some of the other pins do not. 15:52.980 --> 15:58.320 But be careful because you may break things if you send the wrong voltage up the wrong pin. 15:59.260 --> 16:01.940 So how do you work out what pin does what? 16:01.940 --> 16:03.720 You have to get the wiring diagram. 16:03.920 --> 16:11.860 This is the wiring diagram for the DS3 for the head unit and infotainment system. 16:12.820 --> 16:20.680 If you zoom in right in the middle of there, there is the device that is the instrument cluster. 16:20.680 --> 16:27.580 As you can see it has a little microprocessor and a couple of dials that basically shows you what's inside it. 16:27.580 --> 16:32.440 It means it's got some brains and it is a cluster. 16:32.880 --> 16:47.100 There is a key that tells you 0004 is an instrument cluster, however it might be called something else as in the language that it was originally written in, say in French. 16:47.280 --> 16:53.200 Looking at the wiring it says 18V which means it's 18 pins. 16:53.200 --> 17:02.620 BA means the color of the plug which I believe is white. 17:02.620 --> 17:03.640 I can't remember. 17:04.000 --> 17:08.360 I may be wrong but pin 18 or green is ground. 17:08.360 --> 17:10.840 Pin yellow is switched live. 17:11.980 --> 17:16.520 Pins 8 and 9 are CAN HIGH and CAN LOW. 17:16.740 --> 17:18.420 It's sort of potluck on that one. 17:18.420 --> 17:20.680 You might get it right first time, you might not. 17:20.680 --> 17:26.720 But if you don't get any messages back out of the device, swap them over and see what happens. 17:27.280 --> 17:28.880 So power supply. 17:28.880 --> 17:31.580 This power supply here came from Amazon. 17:31.620 --> 17:35.800 It's a USB to 12V barrel jack. 17:35.800 --> 17:40.140 So USB at 5V at one end, it's got a boost converter in the middle. 17:40.360 --> 17:44.480 That then can step it up to the 12V that is required for the cluster. 17:45.160 --> 17:53.540 Technically you need 13 point something volts if it was running with the alternator at full chat, but 12V should be enough. 17:53.860 --> 18:01.160 You could potentially use an ATX power supply, but I think it's overkill to have something that could potentially put 40 amps through it. 18:01.160 --> 18:03.600 So this is slightly safer. 18:04.380 --> 18:07.020 So on to the Linux software. 18:07.580 --> 18:12.880 When using CAN under Linux you need the package that is called CANutils. 18:13.460 --> 18:18.700 If you're running on a Raspberry Pi, install CANutils. 18:18.700 --> 18:21.460 It will then install all these components here. 18:22.360 --> 18:30.300 CANdump, it will basically output all CAN messages from the bus that is currently coming off the CAN bus. 18:30.300 --> 18:35.740 CANsniffer shows all messages that are changing on the bus. 18:35.800 --> 18:40.440 It does not show by default any message that is static. 18:40.440 --> 18:44.240 It will remove them from the screen, only shows you stuff that's changing. 18:44.240 --> 18:49.440 You can then make it highlight things to show when things change and when things don't. 18:50.120 --> 18:54.940 You can make it show all messages, but it's just one of the options. 18:55.600 --> 18:59.180 CANsend allows sending of a single CAN message. 18:59.800 --> 19:06.040 If you're very good at shell scripting you may be able to use that to send multiple messages in a for loop. 19:06.860 --> 19:13.620 It's not that easy to do unless you're really shithot at doing bash scripts. 19:14.340 --> 19:21.960 CANgen is a slightly better version of the same thing, in that it can generate messages either randomly or with specified logic. 19:22.640 --> 19:25.280 Finally, the last part is CANplayer. 19:25.340 --> 19:31.100 Basically, this will replay messages that you have logged to a text file using CANdump. 19:33.260 --> 19:42.640 And then you can then record something on a vehicle, bring it back to your cluster, and then replay it and see what happens. 19:42.640 --> 19:53.400 And then by selectively grepping those messages, you could replay it and find out which message does the speed, which message does whatever, or just fuzz it and see what happens. 19:53.880 --> 19:55.940 So, shall we start fuzzing? 28:17.380 --> 28:21.680 Good morning, good afternoon, good evening, depending on which time zone you're in. 28:21.680 --> 28:24.140 I'm Ian Tabor, or atminternet. 28:24.520 --> 28:27.640 This is my talk about Car Hacking Village. 28:27.640 --> 28:31.600 Sorry, Ian, we accidentally restarted. 28:32.820 --> 28:35.080 First things first, who am I? 28:35.080 --> 28:37.260 You could sound the ultimate car hacker. 28:37.380 --> 28:39.960 I built this kit car 15 years ago now. 28:40.740 --> 28:45.400 But I think we can probably take questions, yeah? 28:46.160 --> 28:48.080 It was just about finished. 28:48.080 --> 28:56.260 You were working on the fuzzing of and showing the different possibilities to fuzz the... 29:28.900 --> 29:29.860 Okay. 29:32.140 --> 29:53.620 So, if you do have questions to MintyNed or to Ian, please go ahead, write them in the text, the support, the CHV 101 support text group, and we can answer them. 29:55.460 --> 30:07.060 Ian, can you describe to us a little bit about what you built up there with your test rig? 30:31.540 --> 30:35.470 Got a lot of wiring there. 30:35.470 --> 30:38.850 And it actually thinks it's a running vehicle. 30:38.850 --> 30:45.770 So, not only does the lights work, and there's an indicator to show you like something on and off, etc. 30:45.930 --> 30:53.720 The engine thinks it's rotating by the Arduino attached to the crank and cam sensors. 30:54.250 --> 31:03.430 And that is basically spoofing the correct waveform that is used by the crank and cam sensors to work out where the engine is in the firing order. 31:03.850 --> 31:09.310 And then an indicator showing the injectors and the fuel being fired. 31:09.310 --> 31:16.670 So, if you were here in person, you would actually be able to see the lights flashing to show spark going off. 31:17.370 --> 31:22.510 There are some other simulators being used as well. 31:22.510 --> 31:29.170 So, there's a couple of potentiometers for the fuel gauge and the water temperature gauge. 31:29.170 --> 31:35.430 So, if you twist the fuel gauge potentiometer, you can make the fuel gauge go up and down. 31:35.730 --> 31:39.430 But it's still connected to where the fuel gauge would normally be. 31:40.310 --> 31:49.470 There's also a O2 simulator, which is required to get rid of one of those annoying engine warning lights. 31:50.810 --> 31:57.830 But that uses a 555 timer to generate an AC wave on a DC offset. 31:57.830 --> 32:06.850 And basically, it just varies between mean, rich, mean, rich, mean, rich, for both the pre and post. 32:09.510 --> 32:12.110 So, that's that. 32:12.110 --> 32:17.250 The hardest one to actually simulate is actually to get the car to think it was moving. 32:17.750 --> 32:22.430 So, originally, I tried to do it using an Arduino or something with a similar 32:26.870 --> 32:28.230 microcontroller. 32:28.310 --> 32:34.530 But I actually had to do it using a motor and a plastic disc. 32:34.530 --> 32:43.650 And it's actually a plastic disc with a reluctor ring that would normally be on your sub-axle attached to your wheel. 32:43.650 --> 32:49.230 So, there is a single motor with a reluctor ring attached to a plastic. 32:49.510 --> 32:53.250 Around that motor is four wheel speed sensors. 32:53.590 --> 33:06.670 And then there is an Arduino attached to that motor using PWM to vary the speed of that motor, and then thus vary the speed of the wheels that it thinks are rotating. 33:06.830 --> 33:17.750 There is then some feedback to that same circuitry that reads the speed of the can bus to see how fast it thinks it's going, try and match one to the other. 33:19.230 --> 33:23.390 But I was playing around with it earlier to try and fix it to make it slightly more accurate. 33:23.750 --> 33:26.150 And I worked with the encoder on the Arduino. 33:26.190 --> 33:29.390 So, I'm just really writing it as we speak. 33:30.030 --> 33:34.970 But I can get it to go full tilt, which means it goes at 181 miles an hour. 33:35.310 --> 33:40.470 And if you've ever seen a Project 208, I wouldn't want to do 181 now. 33:41.190 --> 33:45.870 I think it wrote itself a bit fast, but yeah. 33:46.250 --> 33:49.370 Disco mode is quite trippy. 33:50.270 --> 34:00.190 I have a couple of my little nano cans, or tiny cans, configured so that it sends it into Disco mode, makes all the dials go absolutely nuts. 34:01.150 --> 34:12.570 It's always good to show someone what you can do with CAN by just sending the right messages, but slightly faster, you would actually want to send them. 34:14.730 --> 34:18.630 My car in a box probably cost me about £2,000 to build. 34:20.230 --> 34:26.110 But I could have probably done it a bit cheaper by buying a whole car and saving the bits I didn't actually use. 34:26.270 --> 34:30.790 But then you've got the whole hassle of disposing of parts off the interior and body shells. 34:31.730 --> 34:34.710 I may be making another one again soon. 34:35.250 --> 34:37.210 But that's for my work. 34:43.670 --> 34:47.150 Which car are you thinking about doing next? 34:47.930 --> 34:50.150 I don't know, it depends on the budget. 34:51.070 --> 34:53.310 They won't tell me the budget yet. 34:55.830 --> 34:58.810 So if you can lend me one, I don't mind. 34:58.890 --> 35:00.690 I'll build one for you if you like. 35:01.590 --> 35:05.510 Well, I would really love for you to do it for me, actually. 35:07.210 --> 35:10.870 But I think this is something we'll have to talk about offline, huh? 35:11.230 --> 35:11.590 Yep. 35:11.650 --> 35:14.110 All right. 35:14.110 --> 35:15.330 Any more questions? 35:15.950 --> 35:19.750 Actually, I don't see so many questions in the chats. 35:23.890 --> 35:25.050 What's that? 35:25.390 --> 35:26.990 Apologies for the audio. 35:27.710 --> 35:30.450 I will be around tomorrow to talk over it. 35:31.570 --> 35:34.790 Yeah, it's pretty strange what happened. 35:34.790 --> 35:40.830 But it's, you know, this is part of the fun with our first virtual conference. 35:42.290 --> 35:45.850 So totally understandable. 35:45.850 --> 35:48.730 We'll try to fix it for next time. 35:50.550 --> 36:11.230 Ian, just quickly, because we're all beginners in this chat, in this talk, what type of tools or what can you tell us a little bit more about where you learn, which hardware you're using, which software you're using, what tools would you recommend? 36:11.230 --> 36:27.940 The stuff I've already mentioned in the talk, I've previously used on numerous occasions. 36:28.480 --> 36:34.100 There are the microcontrollers that have built-in fan controllers in them. 36:34.260 --> 36:40.520 There are also software for those on GitHub as well. 36:40.520 --> 36:54.380 And quite funny, when I was at the Bug Bash in 2018, we found a major vulnerability with the hardware that cost me about $30 worth of hardware. 36:54.380 --> 37:07.080 And we got a payout of five figures, because we were just a bit cheeky and found somewhere that the manufacturer hadn't thought of which software to actually break into the vehicle from. 37:07.320 --> 37:11.740 I won't tell you which vehicle, I won't tell you exactly how I broke into the vehicle. 37:12.540 --> 37:20.340 But yeah, you can buy very expensive things, like vehicles by value counting, things like that. 37:20.680 --> 37:35.460 But I would start at the beginning with something in the, like, nano-fan or something like that, just to see what you want to do, whether you can actually get used to it more than anything. 37:35.660 --> 37:45.880 Because there's no point in spending a few hundred dollars on hardware, and then you do it three times, and then you leave it and go, oh no, you've wasted your money. 37:46.360 --> 37:48.480 You may be able to resell it, you may not. 37:48.480 --> 37:59.980 But if you build something yourself, for five, ten dollars, it's no big deal if you never actually use it again. 38:00.740 --> 38:07.340 So, granted, yes, if I worked in one of those companies and I got them for free, I would say, buy one of those really expensive ones. 38:07.440 --> 38:13.520 But I don't, and I didn't, and I've managed to get through quite well where I am at the moment. 38:17.330 --> 38:24.690 Okay, well, Ian, thank you so much for the information, the great talk and presentation as well. 38:25.150 --> 38:33.870 I think we don't have any further questions, so unless you have something you would like to say to the audience, I think we can close out for today. 38:34.850 --> 38:41.470 If anyone needs any help with any of the challenges related to PvZero, just hit me up on Discord. 38:41.830 --> 38:45.530 I'm at Minternet on Twitter. 38:45.870 --> 38:47.450 I'm here to help. 38:47.490 --> 39:00.970 If you want me to make the car do other things so you can see what's going on, I can interact with it, make it go faster or slower, turn lights on, turn lights off, so you can see what's going on. 39:01.090 --> 39:02.310 I don't mind. 39:04.150 --> 39:10.650 If you don't do it, I'll just be sat here trying to rewrite that bit of software, getting a little more depressed. 39:11.250 --> 39:17.510 But yes, it's very strange being in Vegas time but being in London. 39:18.430 --> 39:24.530 And you're talking about the CTF or the virtual car hacking, of course, right? 39:24.790 --> 39:25.470 Yeah . 39:27.570 --> 39:28.570 Great. 39:28.570 --> 39:31.990 Well, Ian, thank you so much for the great talk. 39:31.990 --> 39:34.210 I'm sure everybody learned a lot. 39:35.670 --> 39:40.970 We have the next talk coming up in about 20 minutes. 39:40.970 --> 39:46.030 We're going to be talking about Bluetooth security and automotive with Kamil. 39:46.030 --> 39:54.790 So if you guys want to come learn about what's going on in Bluetooth security, please come join us here in 20 minutes. 39:54.790 --> 40:03.050 We'll be right back with Kamil, and he's going to talk about the Bluetooth interfaces of vehicles. 40:03.330 --> 40:04.910 All right. 40:04.910 --> 40:06.330 Thank you very much, guys.