start	end	text
640	6940	Hi, welcome to our talk, Powerline Truck Hacking, Two Tools for PLC for Trucks.
7140	13840	We're going to talk to you today for about an hour, you know, who are we, what is PLC,
13840	19280	how do you interface with PLC, what are these two tools, PLC for Trucks, GR2497,
19900	25800	how can you adapt what you got onto the PLC connection. We discovered an issue,
25800	29980	we're going to discuss that issue and the impacts, and then we'll show you some future work.
30640	36360	So first up about us, I'm Ben Gardner, I'm a researcher with the National Motor Freight
36360	41660	Traffic Association, previously done embedded systems development, reverse engineering,
41660	46560	I've been an instructor at the Cybertruck Challenge and plan to, when it ever comes back,
46560	53440	I also volunteer at DEF CON and SAE. Hi, I'm Chris Poore, an electrical engineer who has
53440	58180	been hacking things and helping people get away with it for more years than I can count on these
58180	63100	blood-stained hands. I work at Assured Information Security, headquartered in Rome,
63100	69700	New York, with locations all over the U.S. AIS strives to be a driving force for technology and
69700	76220	national security and has the combined professional experience that I believe is rivaled only by the
76220	86100	space program. Contact AIS today. Next slide, please. It's not just a two-person effort,
86100	90780	we're part of a much larger team, a great team that we've been privileged to be a part of,
90780	96260	comprised of Dan Salone, Christopher Poore, who you now know, Eric Thayer, all of AIS,
96700	102560	and myself from the NMFTA. Also, this research would not have been possible without the support
102560	107120	of the Motor Freight Carrier members of the NMFTA, who sponsored us with access to their
107120	112560	facilities and to their equipment, and thank you for that. First up, what is power line
112560	117880	communications? Generally speaking, any time you're putting data onto lines that are intended
117880	123880	for power, you're doing power line communications. You might know some technologies that fall into
123880	128260	this class, such as Green PHY and Home Plug. There's an entire interoperable family of
128260	135340	technologies in IEEE 1901. The technology is found in automotive, most commonly under SAEJ
135340	140120	1772, which is for plug-in electric vehicle charging, and there was some really interesting
140120	145740	work by Baker and Martinovic at USENIX 19, where they showed that they could remotely read traffic
146340	150700	between the plug-in electric connection of a vehicle and the charger. But today, we're not
150700	156060	talking about plug-in electric vehicles, we're talking about trucks. So let's rewind the clock
156240	161700	a little bit, maybe a couple decades, and look at what trucks looked like around 1997. There were
162560	167240	anti-lock braking, ABS systems, on trailers and on tractors, and these ABS systems are quite
167240	174640	important to prevent rolls and reduce braking distance. It's really important
174640	180500	for safety. So at the time, there was only a warning on the side of the trailer that showed
180500	185240	you if the ABS was malfunctioning. There are regulators and fleet safety managers that really
185240	190220	wanted to have some kind of a dash display that would show the driver if there was a problem with
190220	195460	the trailer ABS. And this, of course, would help make sure that ABS is functioning and everyone
195460	202440	would stay safe. Now let's look at how these trailers and tractors were connected. So back
202440	207860	then, and actually as it is today, trailers and tractors are connected with a J560 connector.
207860	215340	Here you can see that green pigtailed cable plugging into a bulkhead jack there. And that's
215460	221720	a seven-way connector. You can also see a red and a blue cable behind the bulkhead here. Those are
221720	230060	actually pressurized air, whereas the green cable here, this is electrical. So back then,
230060	235520	they had this tractor-trailer connector. You can see a breakout here of the J560. It's got
235520	242800	tail lights, right turn, left turn, brake lights, a ground connector, and then this power for ABS
242800	248720	and auxiliary power. So it's a fully populated connector. There's no room for anything else, but
248720	254440	still, regulators and safety managers really wanted to have a way to show the driver when
254440	259320	something was failing. Now an obvious option is to add another connector, but unfortunately,
259320	264560	you know, for fleets, the lifetime of trailer equipment is very long and the cost of retrofitting
264560	270200	is very high. So the industry took it upon themselves to design a technology that would
270200	276980	let them send this ABS fault data up into the tractor without adding a new connector.
276980	283000	And at the same time, there was a lot of other technologies that people wanted to get data from
283000	289740	the trailer into the tractor, and there was things like axle weight, door latch, yaw sensors, and
289740	295500	things like that. So it was hoped that this technology could carry all sorts of information
295500	301460	up from the trailer to the tractor, not just the ABS fault info. Around June 1998, ATATMC actually
301460	306060	approved PLC for trucks. This is the American Trucking Association's Technical Maintenance
306060	310300	Council. They are responsible for making recommended practices in the commercial vehicle
310300	320280	space. And eventually, SAE published J2497 in 2002. And what they did was add high-frequency
321700	326860	signals onto these power lines that run the length of the truck. So they would couple them
326860	332080	onto their either transformer or capacitor, just AC-coupled, and send these high-frequency
332080	339780	signals with enough of a voltage that they would propagate. Now, there was an issue with
339780	345300	PLC for trucks that was patent. It was actually patent incumbent. And at the time that they
345300	350220	started the work on this, they didn't know. Eventually, it became known, and SAE actually,
350220	356800	at one point, just canceled the working group to create J2497. And eventually, it was resolved.
356800	360600	The technology was patented for a long time, and there were royalties that had to be paid, but the
362480	368380	standard did go forward. Now, if you go to SAA meetings or ATATMC meetings like I do,
368380	373680	you've probably seen these patent disclosure and IP statements at the beginning of the meetings.
373680	378980	I've been told that for ATATMC, those passages actually exist because of what happened with
378980	386440	PLC for trucks, whereas with SAE, those statements actually predated the PLC for trucks issue.
387060	391740	So it took the industry a while to get it done. It was quite complicated. There was a lot of tests
391740	396160	that happened over the winter and otherwise. And as I mentioned, there was other technologies
396160	401360	that wanted to get like axle weighing and door sensors and things like that up from the trailer
401360	407580	into the tractor. So they had interoperability tests. And it ended up being... eventually,
407580	412260	it was deployed, but it was quite complicated to get it to that point. So the news media
413480	419200	has been seen to call this technology expensive or complicated. There's a funny quote right here
419200	423880	where someone's saying the most expensive light bulb in history. So it is funny to look at the
423880	429420	technology that way. But it's also important to recognize that the calculus that the fleets were
429420	433640	looking at was whether they would have to retrofit all their trailers, which typically have, you know,
433640	441020	30 year service lifetimes, just to get another light up into the cab. So creating this technology,
441020	445880	even though it seems like it was an expensive light bulb, still, from their point of view,
445880	452320	what they wanted was cheaper. And that's going to be true today as it was back then. The trailers
452320	457380	last for a very long time. The connectors are still the J560 connector. And trying to change
457380	464000	any of that might prove to be more expensive than anyone would want to spend. So now you know a lot
464000	468700	of the history about J2497 and why it came about and why are we sending these high frequency signals
468700	475060	on power lines. Let's talk more about what it is, how it's put together. You can think of J2497
475060	482460	like an alternate physical layer for J1708. And we're not going to go into J17 a lot because
482460	487380	there's another talk that will give you lots of details on it. Suffice it to say that it's a
487380	496280	heavy vehicle network that predates J1939. J2497 has its own arbitration scheme that it
496280	503740	employs around J1708. The PLC for trucks 2497 is always 9600 bauds. And the way it takes these
503740	511040	1708 signals is it'll actually encode them into spread spectrum chirps. So another way to think
511040	519340	about 2497 is by an analogy. You can see a couple analogies that I'm making here. You know J1939
519340	527000	is a lot like J1587. And J1939 can sit on top of high speed or low speed canned buses, twisted or
528060	537840	unshielded. So similarly can J1587 sit on top of either J2497 or just J1708. And you'll probably
537840	542980	have diagnostics or some other applications on top of those. Which if you're not an automotive
542980	550020	person you can think of it by an analogy to DNS which is built on top of UDP. And UDP IP can run
550020	558400	either like ethernet or 802.11 infrared for example. So let's talk a little bit more about
558400	564940	these spread spectrum chirps. The specification of J2497 by SAE actually includes a definition
564940	571260	of the chirp. And they have to sweep from 200 to 400 kilohertz, then from 400 to 100 kilohertz,
571260	576180	and then from 100 to 2 or 3 kilohertz. You can see a picture here of a rendering of a couple
576180	582280	possible chirps. Different possibilities result by how you treat these discontinuities here.
582420	589260	The chirps themselves are about 100 microseconds total. They start and end at value zero so that
589260	592960	they can be concatenated. And when they're transmitted they should be transmitted in
592960	598240	amplitude between 2.5 to 7 volts peak-to-peak according to the spec. Now in practice
599540	604360	the transmitters on trailer equipment tend to send them even higher than 7 volts peak-to-peak
604360	609780	just to make sure that they'll make it from one end of the tractor trailer to the other.
611420	616300	The chirps are put together into frame encodings that will let them actually send
616820	621740	J1708 frames. And the way the frames are encoded is broken up into a preamble and a body.
621760	628160	The purpose of the preamble is there to realize that alternate arbitration method so that if two
628160	632580	PLC devices are trying to talk at the same time there's a way to determine who has the highest
632580	639080	priority and which one should back off. It's very similar to CAN. It involves that very first
639080	647260	byte being sent and the lower byte is the higher priority. So here you can see two renderings of
647260	655800	frames. The first being OA00, the second being OBFF. The OA00 frame and the OBFF frame are the
655800	663540	ADS fault information that we talked about, the impetus for J2497. So in the preamble you can see
663540	669100	that the messages, the actual chirps have delays in between them. And this is because the chirps
669100	675920	are 100 microseconds but the time for the symbols is 104 microseconds, these little gaps. In the
675920	683480	preamble the presence of the chirp indicates, you know, the logic value. So logic 0 means chirp
683480	689580	present, logic 1 is chirp absent. But then when you get into the body it's actually 100
689580	698240	microseconds with no gaps and the encoding is actually determined by phase. So this is phase
698240	704740	shift keying in the body. The phase of logic 0 is arbitrary per device and it's actually given by
704740	710880	the phase that's transmitted here in the amplitude shift keying section. There's a checksum
710880	715940	at the end and then there's all these sync bits you can see in orange and in green.
716440	721620	And some of these sizes are variable so there could be one to two initial symbols and there
721620	734080	could be zero to four gap symbols. So why is it like that? Well J2497 was designed for J1708.
734420	739420	This whole PLC for trucks scheme was actually accomplished by a particular piece of
739420	748960	silicon, the Intelon SSC P485. And this particular chip was designed to take J1708 frames and wrap
748960	754220	them around with some extra information and re-encode them into these spread spectrum chirps.
754220	761860	So the Intelon P485 actually adds, you know, these sync bits and adds all the preamble highlighted
761860	769280	here in orange. It will then send, you know, the actual encoded information in chirps as the body
769280	775180	which matches exactly what you would see on the J1708 line. And then it adds these terminators with
775180	784040	the gaps and the sync bits. So the checksum is actually part of J1708 and part of J2497.
784780	791680	And you can see there's a duplication of MIDs. You can think of MIDs like arbitration IDs
791680	797980	in CAN. It's that first byte. It determines arbitration on the bus and the data is duplicated
798660	807160	twice. It turns out that this information here in the preamble is used for arbitration of the PLC bus
807160	813860	only. And what gets sent on J1708 is this byte that's put right here, which means that you can
813860	819700	send things where those two don't equal each other. And you can override priority. So you
819700	827100	could send a very low priority MID with an all zero PLC MID and it would margin on top of anyone
827100	834720	else that was talking on PLC. So a little bit about J1587. This is that next layer above. You
834720	841560	can think of it akin to J1939. If you look at the J1587 spec, there's a lot of really interesting
841560	846840	highlights. They say that you shouldn't send more than 21 bytes at a time unless the vehicle is
846840	852680	stationary. I wonder what happens if you don't. There's a factory test MID that should never be
852680	859400	sent by any vehicle system. There are bridging and forwarding schemes defined in the spec. There's a
859400	866360	dynamic address claim. There are cold and warm reset commands and lots of support for interesting
866360	870960	kind of peripherals on commercial vehicles like toll systems and display signage and climate
870960	877940	control. Now for some more details on how to decode J1587 automatically, please see our team's
877940	884740	presentation, which should be up today, or look at the pretty J1587 repository.
886140	890980	Even though J1587 defines a lot of interesting things that could be in there,
890980	896820	all we've seen in our testing for the most part is the ABS fault lamp on and off messages and
896820	904740	manufactured diagnostic messages. There was a report by the FMCSA that suggested that there
904740	913220	should also be axleway yaw sensor and door latch sensor traffic on the PLC bus, but we haven't run
913220	924960	into it yet. So how do you connect to PLC? There are some great options out there. The DG Technologies
924960	933360	PLC TESCON is very rugged and reliable. I love mine. There is also a NEXIC PLC adapter, which
933360	940000	has the advantage of being able to go in line on a cable, so you can you can test it in place.
940280	947180	The problem with these sort of classic diagnostic adapters is that they aren't cheap. You will need
947180	953760	them for running manufactured diagnostic tools though. And also the Intelon P485, I'm told,
953760	957500	is becoming harder to source, which is not going to help with the cost of these tools.
957980	963200	Finally, the limitation of these tools is that you can't do anything strange to PLC with these
963200	969680	tools, because they just have an Intelon P485 chip in them, and so you can't make arbitrary
969680	978140	PLC waveforms. For example, you can't do different PLC MID from a J1708 MID on the bus.
979220	986940	So how do you interface with J1708 so that you can interface with PLC? The first one up is another
986940	994480	one of those RP-1210 adapters, such as the Digitech DPA4, DPA5, or an EXIC USB link.
994480	1001700	And these things are necessary for the manufacturer diagnostics. An option that I really like,
1001700	1006900	that's really cool, that was presented here at DEF CON 24 is the TruckDuck, which is a beaglebone
1006900	1014660	cape by 6V and Haystack. There's been some revisions to this board since the DEF CON 24
1014660	1021640	presentation. There's the 1.5 EET version and the Mega version. These beaglebone capes enable
1021640	1027920	communication with both J1939, or any Canon network actually, and J1708 networks through
1027920	1034200	the PiHV networks module that Haystack authored. And we are going to talk about some ways to use
1034200	1041920	these to write PLC. So our PLC writing tool, what we wanted was something to be low cost.
1041920	1047540	We wanted it to be open. We wanted it to be capable of doing weird things. We weren't so
1047540	1054360	concerned about arbitration. The J1708 stack that Haystack put together for the TruckDuck
1054360	1059680	originally didn't have any arbitration, just had frame detect, and it works fairly well on systems
1059680	1068320	that aren't highly loaded. And we didn't want to worry about getting read in right now, and the
1068320	1073800	reason for that you'll see will be clear later. So our approach that we elected, mostly because
1073800	1078960	we're biased and we like the TruckDuck, is let's make some small mods to the TruckDuck and push
1078960	1085720	them upstream and try to stick with very small BOM changes, and hopefully 6V can integrate those
1085720	1095340	into the next Mega Mega EET version of the TruckDuck. So, Bitbanging PWM on the PRU. Bitbanging
1095340	1101500	is the process of toggling a GPIO in order to create whatever protocol you're after. GPIOs are
1101500	1107160	general purpose input output pins, of which there are many on the BeagleBOM, and the PRU is a
1107160	1113480	programmable real-time unit on the BeagleBOM. It runs jitter-free, like deterministic code with no
1113480	1119300	interrupts stopping execution at 200 megahertz, which is plenty for the 400 kilohertz-ish
1119300	1127060	signal of PLC. And also the PRU was used originally on the TruckDuck for the J1708 stack itself,
1127060	1132520	so there's already a precedent there for using the PRU in this system.
1133180	1140200	It turns out that the TruckDuck J1708 channel 2 has pretty much been broken since release,
1140200	1147020	which is actually good for us because it lets us reuse, repurpose, one of the PRU cores for
1147020	1156540	the PLC application instead. And in trying to find pins, we needed to find one that we knew
1156540	1162040	we could bitbang from the PRU, which is a certain class of pins. But we also wanted to eventually
1162040	1168280	maybe get rid of the PRU, if possible, and use the integrated PWM unit in the BeagleBOM, although
1168280	1174040	that hasn't been done yet. So trying to find the pin that would work was, you know, one of
1174040	1179280	these fun processes. I found it best to just do it with markers. We wanted to make sure that it
1179280	1184300	could be accessed from the PRU. It could migrate to PWM. We wanted to make sure it didn't conflict
1184300	1190940	with any other TruckDuck pins. So for synthesizing PLC, we settled eventually on P928. We had a
1190940	1199040	backup. And then we also planned for doing frame detect and PLC read via an ADC, but we haven't
1199040	1205700	implement that. That's just kind of allocated for later. So in creating PLC signals, there's two
1205700	1211340	main parts. You have to synthesize this PLC with PWM, and then you have to couple this signal
1211340	1216200	that you've created onto the PLC network. So there's these two clouds that we're going to reveal.
1217920	1223020	I don't often do this, but I thought I would this time. I would try the dumbest thing first,
1223020	1227880	and my friends will tell you that I'm not very good at doing that, but I did it this time. The
1227880	1233660	first thing we tried was the dumbest PWM possible. You just turn it on when the signal that you're
1233660	1237560	trying to realize is above zero, and turn it off when the signal you're trying to realize is below
1237560	1242880	zero. So you can see that picture here. The orange waveform is the dumb PWM, and the blue waveform
1242880	1250180	is the true CHIRP. And it turns out that actually worked. So we said yay and moved on. The next part
1250180	1256140	was coupling. And you can see here in the DGTech PLC test con, the coupling network they created
1256140	1262980	is just gorgeous. And compared to what we were using, it is amazing because we found out that
1262980	1268880	100 nanofarad capacitor was enough, and that was our filtering as well. So the dumbest filtering
1268880	1275560	and the dumbest PWM got us what we needed, and we moved on. The results were pretty good,
1275560	1282220	actually. We did run into one issue with undocumented cycle counts for some of the
1282220	1287320	instructions that we we had to use in assembly, but the results were fine. You can see down here
1287320	1294080	the orange signal is a recording on an oscilloscope of the PLC signal that we synthesized
1294080	1301000	after filtering on a receiver. Same with the purple. This is just a larger zoomed out trace.
1301260	1307140	So this is post-filtering of the signal that we realized. The signal that we realized is much more
1307140	1311840	like these square waves up here in the tuning edge delays diagram. And this is just a representation
1311840	1316580	of how we had to tune some of the assembly instructions to make sure that the signal would
1316580	1322720	line up, you know, all the way into the realization like bit 54 of the PLC chirp train that we had to
1322720	1332480	create. So it worked pretty well. The code. You can get this tool. It's MIT licensed. It's available
1332480	1341160	on GitHub as of today. What it does is it adds a new J1708 server. That's the way that the 1708
1341160	1348840	was set up on the truck ducks is they receive and send UDP frames and will send or receive those
1348840	1354280	onto J1708. What we did was create a whole new one that's completely compatible, but what it
1354280	1363080	does is send PLC signals instead. We also created some command line utilities. The network, the
1363080	1368860	Pi HV networks that Haystack created has a really nice programming interface for Python, but I just
1368860	1375120	like to have really simple command line tools like dump and send. So we drafted those and they're
1375120	1383160	compatible with the existing stack as well. And so to get your truck ducks to connect to PLC,
1383160	1388300	you actually do need to do some PCB changes to your truck duck for now until 6V rolls us into
1388300	1394420	the next revision. And this led to probably one of my favorite kind of bodge jobs because I love
1394420	1400140	to do rework of PCBs and I also really like it when things have to be MacGyvered. When we were
1400140	1406120	connecting this up to PLC, we discovered that it would work when there was a really long length of
1406120	1411460	cable in between the power supply of the truck duck and the point where we were coupling to the
1411460	1415400	network. And if we didn't have that long piece of cable, the truck duck power supply just seemed to
1415400	1423220	attenuate the PLC signals to almost nothing, which led me to this great bodge job right here where I
1423220	1428120	wrapped 40 inches of wire and soldered that down to the board in between the input to the power
1428120	1436600	supply and the connector. And that actually solved the problem, which is fun. Okay, so next up we're
1436600	1441260	going to show you how you can use some adapters to connect your truck duck up to the power lines.
1441260	1448560	There's a lot of different options. The first is this J560 to DB15 in Deutsch 2-pin. So these
1448560	1453880	DB15 connectors, you can find them in a lot of different diagnostics adapters. The DPA4 and the
1453880	1458280	truck duck both have them. This is a 560 connector here, which is useful to be plugged into the back
1458280	1463000	of your tractor. You can also plug into the back of your trailer if you have an adapter to connect
1463000	1469220	to the batteries up here on the Deutsch 2-pin, and the whole set is in the DG Tech PLC Tescon.
1469560	1476060	Next up is these battery clip, the DB15 adapters, and these ones can be found in the Nexic adapter
1476060	1483060	sets on the internet. There's also these Y adapters for J560, where they give you a Deutsch
1483060	1489940	9-pin connector in line with two J560 connectors, so these can be used in line with a tractor and
1489940	1494680	trailer that are connected. You've got to watch out that some of these actually do contain an
1494680	1503680	Intelon P485, and what they're doing is converting PLC to J1708 and routing that to the J1708 pins
1503680	1509820	instead of PLC onto the power pins. Another one that's useful is one of these inline
1509820	1516600	jack and plug, which is very similar to the previous one. None of these have the Intelon P485
1516600	1524760	inside them. You can also build your own umbilical, so these J560 plugs, you can take them apart by
1524760	1529620	removing the set screw, and you can wire any kind of a pigtail you like. I like to use these Deutsch
1529620	1534260	2 pins because they work with the DG Tech sets, and then you can close it all back up and you can
1534260	1543300	have a connector that can be used with a tractor and trailer connected. So we also created a PLC
1543300	1551220	reading tool, and Chris Poore is going to tell you some more details about that. Chris? Thanks, Ben.
1551360	1558680	One of our goals was to develop a low-cost tool for reading J2497 messages with SDRs and
1558680	1564320	open source software. We wanted a solution to let just about anybody tap into a line and see
1564320	1576940	messages all for little cost. Next slide, please. Again, the J2497 signals primarily consist of a
1576940	1583540	series of 100 microsecond chirps that start at 203 kilohertz, ramp up to 400 kilohertz, quickly
1583540	1591380	drop down to 100 kilohertz, and back to 203 kilohertz. The 100 to 400 kilohertz frequency
1591380	1600460	range is lower than most SDRs can handle. For example, the starting frequency of the RTL2832U
1600460	1608720	dongles vary depending on the model, but they can range from 500 kilohertz to around 50 megahertz.
1610060	1619920	Next slide, please. To get around this problem, we used up converters. The Hammett up up converter
1619920	1625860	will take our signal and mix it with an intermediate frequency of 125 megahertz.
1626120	1634700	I believe the SPIverter uses 120 megahertz. Once it's near 125 megahertz, we can receive it with
1634700	1641260	radios and begin to condition the signal in software. We improved the quality of the signal
1641260	1649700	if we didn't tune our radio directly on 125 megahertz, but instead at 126. This allowed
1649700	1655620	us to use a bandpass filter to get rid of a lot of the DC noise associated with the Hammett up.
1656460	1658240	Next slide, please.
1660240	1666220	We achieved most of our success with an RTL and a Hammett up, but there are solutions out there
1666220	1672600	that could be promising that don't use up converters. We tried the Lime SDR, which starts
1672600	1679300	at 100 kilohertz, but the gain and performance down at those frequencies was too low for us.
1679460	1686060	You can find schematics online for modifying RTL SDRs to get a lower starting frequency.
1686060	1691900	They also make some that have a direct receive mode that can tune down to 500 kilohertz,
1691900	1696720	but they say the performance is reduced when operating them there.
1697740	1703040	The AirSpy HF Plus is supposed to start at 9 kilohertz,
1703040	1708440	but it might not have the bandwidth to support the J2497 chirps.
1709520	1714580	You might have some luck with oscilloscopes, but then the price starts to go up.
1714580	1719780	The ADOM2000 is a cheaper option you might want to consider.
1721280	1723140	Next slide, please.
1724420	1731540	Back to our setup. When tapped to the line, we used a coupling adapter to remove the 12-volt
1731540	1738480	DC offset that exists. This was to be on the safe side and avoid any chance of damaging our
1738480	1747220	upconverter. Next, the output of the upconverter went to the RTL SDR and was sampled and filtered
1747220	1753490	in GNU Radio, producing a J1708-looking message like you see in the bottom right.
1754540	1758740	Note how the preamble has visible silent periods,
1758740	1763760	and the body is the continuous section at the end of the message.
1765360	1767240	Next slide, please.
1769240	1776080	We developed three methods for demodulating those signals into bits. One method examines the
1776080	1783060	instantaneous frequency. The other two rely on correlating the signal with specific sequences.
1783100	1788480	I'll go over them in the next few slides. Next slide, please.
1790400	1796660	Our first attempts took advantage of GNU Radio's quadrature demod block to produce the plot you
1796660	1802500	see in the bottom right. The sawtooth pattern you see down there represents the frequency over
1802500	1809800	time for chirps in the body of the message. The circled spikes indicate sudden changes in phase
1809800	1816420	at the start of a new chirp. This is what we use to distinguish the ones and zeros.
1817160	1824740	No change in phase means keeps the value of the previous bit, while phase change means flip the
1824740	1831580	bit. We framed the start and stop of each message based on the amplitude and tried to ignore the
1831580	1838340	preamble sections of each message since the body contains the whole J1708 message anyway.
1839700	1841400	Next slide, please.
1843560	1847440	We started developing alternative methods because the previous one
1847440	1853480	did not work well with noise and relied heavily on a consistent signal amplitude.
1853480	1858440	So to get around that, we correlated the signal with a 203 kilohertz reference.
1859600	1866580	Now, 203 kilohertz is the precise frequency where each chirp begins. If there's no phase change,
1866580	1872960	there's a smooth 203 kilohertz signal, which are the higher peaks you see in the output down there.
1873680	1879160	However, when there's a phase change present, the frequency gets disrupted for a short period of
1879160	1884580	time. It results in a value close to zero when correlated with the reference.
1885320	1888980	That's why you kind of see those mini spikes where it's ramping up and down
1889540	1894860	as it approaches the location where 203 kilohertz should be in the chirp.
1895820	1902600	Likewise, anything outside the message, like the noise, is going to be reduced to a value close to
1902600	1909600	zero. We use a moving average filter on the correlation output to frame the message and
1909600	1919820	ignore the preamble part of it. Next slide, please. Now, for situations where the signal
1919820	1925280	is completely buried in the noise, the previous two methods are not very effective.
1925280	1929820	Instead, we tried a new method, which begins by correlating the signal
1929820	1934360	with a Python-generated chirp designed to mimic a real one.
1934460	1940520	The result produces much larger peaks, like you see down there, which helps distinguish it from
1940520	1947480	the noise. We use this technique to frame the message and reuse the 203 kilohertz reference
1947480	1954500	in the previous method to distinguish the ones and zeros. Next slide, please.
1955800	1963320	Next slide, please. We call it all GRJ2497. It contains the blocks and flow graphs that will
1963320	1969600	read the traffic and print out messages like what you see on the right. The values for the MID,
1969600	1975860	data, and checksum are pulled right from the messages. Additionally, there is an option
1975860	1983040	built into the blocks to send the messages in hex over to a UDP port for other potential tools to
1983040	1991960	use. Now, back to Ben to continue on. Thanks, Chris. So, you've got GENIE radio, and you can
1991960	1997840	now read your PLC signals, but how do you connect your Hammet up or some direct receive receiver
1997840	2004740	onto PLC? Turns out, once again, just 100 nanofarad capacitor is going to do the trick.
2004880	2009900	I have used and like to use the 100 volt ones just to be safe, because we don't really want
2009900	2015080	to get battery currents connected to our receivers. And then you just need a way to connect
2015080	2022020	those PLC wires onto this coupling network. So, all of those previous adapters that we talked
2022020	2027060	about all apply in this case, but then how do you connect the wires up? And I think one of the
2027060	2032480	nice solutions we came up with is modifying these Balan19 adapters. So, you can actually
2032480	2038620	take the transformer off of the board and cut the trace right here at the back,
2038620	2045700	replace that transformer with a surface mount capacitor, bridge the ground here, and then cover
2045700	2052420	it all with solder resist to avoid ever touching 12 volt at back battery currents for trucks.
2053440	2059200	Another one that's an adapter that works is an antenna. You actually can read these signals
2059200	2065920	wirelessly. We experimented with a whole bunch of different antennas, but we found that this form
2065920	2072680	of active antenna, pictured here, works pretty good and is pretty darn cheap. The power supply
2072680	2079700	that's here is fine, but it works well as well if you connect a 9 volt battery to it instead.
2079760	2084480	And we believe that there's a lot more options out there because really anything that's made for
2084480	2091400	2200 meters or low FER is in the right band. But we stuck with portable options because a lot of
2091400	2095940	low FER and 2200 meter stuff is giant masts and you're not going to move that around with you,
2095940	2102380	but there are loops and whips and mini whips. But really if you just want to do quick and dirty,
2102380	2108160	these mini whips work really great for the price. Over here you can actually see, you know, we're
2108160	2115160	receiving a pretty clear PLC signal on top of the background noise using just this mini whip taped
2115160	2121080	to the side of a box next to a truck. So we're able to read these signals wirelessly, but
2121080	2128640	how far? In our testing we can reliably receive six feet away from a position next to the gap
2128640	2134920	between the tractor and the trailer. Now this was using our first version of the GNU radio receiver,
2134920	2139820	the one that does the phase measurements and not the new cool stuff that Chris talked about
2139820	2147740	with correlation. So we feel pretty confident this can be extended. We don't know how far and, you
2147740	2155740	more testing, we're going to find out. Why do we think this works? It's a bit strange because,
2155740	2160660	you know, these trailers, or maybe the long ones that we were testing on, were 40 feet.
2161060	2167180	And a half wave, you know, resonator at 40 feet is really only 12 megahertz, which is
2167180	2174360	way, way above the 400 kilohertz top end of PLC for trucks. So it really shouldn't be
2175060	2181120	a good radiator. But when we tested it, it certainly is good enough at this point. And
2181120	2189000	we think that may be a combination of factors, but possibly primarily due to that very large
2189000	2194020	voltage that they transmit, that these devices transmit at, to make sure they can make it across
2194020	2202380	the whole range of the tractor and the trailer. So yeah, the long wires, the high transmit voltages,
2202380	2208260	I think also contributing this is maybe PLC transmitters are actually left alone to be
2208260	2216860	noisy. The spec for J2497 allows any conducted noise to be beyond any other restrictions.
2216880	2225180	And then also FCC's regulations on unintentional radiators actually exempt vehicles,
2225180	2229980	any digital device utilized exclusively in any transportation vehicle from the unintended
2229980	2236180	radiator status. Now they do still have to, you know, turn off if they're found to be in violation,
2236180	2241560	but it's hard to understand how that could be enforced with a large moving vehicle. So it seems
2241560	2248160	like maybe these are radiators that are beyond spec and no one's been testing for them because
2248160	2255860	they're exempt or because it's in spec. There are some impacts to this, but the good news is
2255860	2261900	the impacts aren't very large. It's really a minor impact. On trailers, as we mentioned, really the
2261900	2267560	main traffic is just the ABS fault information. And if that's the only information that's being
2267560	2274360	disclosed by these radiators on a remote read, then you're not really losing confidentiality
2275120	2281980	much. Now if you are a fleet that's deploying other technologies like, you know, way axles
2282620	2288720	or maybe even your door sensors, any canvassing technology in the trailer, this kind of stuff
2288720	2295060	might be more confidential. You wouldn't want to have it disclosed. In terms of the impact
2295060	2299820	in other technologies, other applications of the Intel on P485, we don't really know.
2300040	2306320	Now one of the reasons we wanted to do this talk is that there are future impacts that really matter.
2306320	2312900	The ATATMC is working on putting together a new next generation tractor-trailer interface,
2312900	2320180	and one of the propositions include exchanging keys over PLC. Not that, you know, you can't
2320180	2325500	do key exchange without guarantees of confidentiality, but we just want everyone
2325500	2330480	designing those systems to be aware of the fact that you can't assume that what you exchange over
2330480	2336540	these buses will be confidential. So it could be a problem if it's not implemented correctly.
2336760	2341740	And then as we mentioned at the beginning of the presentation, this is not unique to PLC for trucks.
2341740	2346440	This behavior is present in other powerline technologies, and we encourage you to look
2346440	2351120	at the work of Baker and Martinovic, who showed that this happens in plug-in electric vehicle
2351120	2358180	chargers. Now what can we do about it? Presently, there's not a whole lot you could do on existing
2358180	2362780	trailers, because we think that really it's these long wires and the high voltage levels that are
2362780	2370100	contributing to this. But for the future, there is something you could do. You also should, if you're
2370240	2375860	a fleet, consider what kind of information is flowing on your trailers. If you are using airway,
2375860	2381280	if you are using door sensors or canvassing systems, you might want to be aware that that
2381280	2385760	kind of information can't be considered confidential when your trucks are rolling down the road.
2386540	2391600	You also should be aware if your maintenance departments configure your trailer ECUs to do
2391600	2396300	any streaming of readings, which is possible on several of the manufacturers, where you can
2396300	2401600	configure them to continuously stream wheel speed readings or temperature or voltage readings. Those
2401600	2407040	wouldn't be considered confidential anymore on those buses. But for the future, when they're
2407040	2412000	designing the next tractor-trailer interface, I think the main mitigation that needs to be taken
2412000	2419040	into place is reducing those emissions. And that should be able to be achieved by using PLC on
2419040	2426080	power lines only between the connections where those J560 connectors are. We recognize that the
2426080	2431620	J560 connector is not going anywhere. It's going to be too expensive to try to get fleets to move
2431620	2438600	off of it. So if we only use PLC in between the J560 connectors, that should reduce the radiated
2438600	2445300	emissions. If we only use it in between those J560 connectors, it also affords designers the
2445300	2450940	opportunity to use lower transmit voltages because the signals don't have to reach
2451800	2457760	across the entire tractor-trailer or multiple, especially multiple trailers in tandem.
2459240	2466260	So this issue has, throughout the process, has been disclosed to various parties over the past
2466260	2470180	eight months or so. We've been in contact with trailer equipment manufacturers, all three of the
2470180	2476400	major ones. We have reached out to all the trailer builders. Only one of them responded to us.
2476660	2482960	We have coordinated the disclosure with NMFDA members and our sponsors. We've also done it with
2482960	2489140	what was previously ICS CERT, who now wants to be called the CISA Vulnerability Disclosure Program.
2489600	2494400	And they themselves also reached out to the trailer builders that didn't respond to us.
2495160	2505760	At this time, CISA BDP has assigned CVE-2020-14514, and there is a advisory on this issue of trailer
2505760	2512720	powerline communications to raise awareness forthcoming. So in terms of future work, it's
2512720	2518220	kind of got two different directions. I know our AIS friends here do a lot of industrial control
2518220	2522540	systems work, and they're very interested in looking at applications of the same method to
2522540	2527140	various other powerline communication technologies, some of them listed here.
2527360	2533020	On the transportation side, very much would like to improve those truck tuck features,
2533020	2539940	you know, get some PLC read going, maybe use the PWM unit instead. I recognize that those
2539940	2544460	DC blocks could be implemented differently, maybe capacitive coupling on one side of the
2544460	2550160	transformer instead of removing the transformer. Also, the new Balin-19s have really great screw
2550160	2555640	terminals, so you could have a much more rugged connection to the powerline. We also would like
2555640	2561880	to take Chris's receiver code and figure out just how far the reception can be done reasonably using
2561880	2566120	one of these cheap active antennas, and maybe some of the other more fancy active antennas
2566120	2571560	that we've bought since then. And then there's also looking at the other places where you find
2571560	2577540	PLC. We're told that PLC is also used in intramodal, which is where people take containers
2577540	2584360	and put those on top of flat cars or put them on top of trailers on the road as well. So we'd like
2584360	2590560	to have a look at how PLC integrates in that space. And there's also this thing, which should
2590560	2595300	be really fun to look at, that someone took a trailer brake controller and of course added
2595300	2601110	Wi-Fi to it, because that's a great idea. If anyone wants to have fun with a trailer brake controller,
2601930	2608430	check this one out. But also at the Car Hacking Village, we have two brake controllers
2608430	2612650	hooked up to pressured air. I'll tell you about that a little more in a minute.
2613370	2619790	So yeah, in summary, in conclusion, we got you two tools. There's PLC for TruckDuck,
2619790	2626070	which enables you to write to PLC using 1-bit PLC chirps that we did with bit banging.
2626070	2630670	You can make an arbitrary waveform, you know, you can have different PLC MIDs than you do for
2630670	2637090	the J1708 payloads. Everything we put together is compatible with Haystack's PyHV Networks modules.
2637470	2643390	There's also the ability to read PLC traffic remotely, and this is tracked also internally
2643390	2653410	as ICSVU-227452, and I gave you the CVE earlier. And the GR-J2497 tool that Chris told you all
2653410	2661790	about is capable of receiving this traffic at a distance of six feet. And also that GR-2497 tool
2661790	2666910	is itself compatible with the PyHV Networks modules from Haystack. So this is what I was
2666910	2672690	trying to tell you about. We actually have a couple trailer brake controllers turned upside down,
2672690	2679470	and we've connected Nerf dart firing cactuses to the exhaust ports on the bottom, and we're
2679470	2685270	running pressurized air on them so that if you can figure out how to do a valve test or do an
2685270	2690870	ECU reset on one of these things, it should push air through that exhaust port and you should fire
2690870	2696230	those Nerf darts. And they're connected up on the Virtual Car Hacking Builder system, so there's a
2696230	2701930	Twitch stream and remote logins to the shells. We do hope that you log in and have a try, and maybe
2701930	2708970	if you get familiar with them, have a try at that Wi-Fi trailer unit. I know I'd like to someday too.
2711410	2716930	What we did here was, you know, not the result of just Chris and I's effort, but really the result
2716930	2722430	of a lot of people committing a lot of resources and assistance over the past few months. And I
2722430	2727390	really want to take an opportunity to put all their names up here and thank them. Really, this
2727390	2733550	wouldn't be possible without, you know, support of a team and a community, and I feel really lucky to
2733550	2740150	be a part of both. So thank you very much for your time. I'll be over in chat with Chris,
2740150	2744450	hopefully answering any questions you have, and I'll see you at the Virtual Car Hacking Village
2744450	2746450	later. Bye!