WEBVTT 00:00.640 --> 00:06.940 Hi, welcome to our talk, Powerline Truck Hacking, Two Tools for PLC for Trucks. 00:07.140 --> 00:24.380 We're going to talk to you today for about an hour, you know, who are we, what is PLC, how do you interface with PLC, what are these two tools, PLC for Trucks, GR2497, how can you adapt what you got onto the PLC connection. 00:24.400 --> 00:29.980 We discovered an issue, we're going to discuss that issue and the impacts, and then we'll show you some future work. 00:30.640 --> 00:46.560 So first up about us, I'm Ben Gardner, I'm a researcher with the National Motor Freight Traffic Association, previously done embedded systems development, reverse engineering, I've been an instructor at the Cybertruck Challenge and plan to, when it ever comes back, 00:46.560 --> 00:50.120 I also volunteer at DEF CON and SAE. 00:50.420 --> 00:59.740 Hi, I'm Chris Poore, an electrical engineer who has been hacking things and helping people get away with it for more years than I can count on these blood-stained hands. 01:00.060 --> 01:06.080 I work at Assured Information Security, headquartered in Rome, New York, with locations all over the U.S. 01:06.400 --> 01:17.520 AIS strives to be a driving force for technology and national security and has the combined professional experience that I believe is rivaled only by the space program. 01:17.860 --> 01:20.100 Contact AIS today. 01:20.960 --> 01:22.520 Next slide, please. 01:24.320 --> 01:38.840 It's not just a two-person effort, we're part of a much larger team, a great team that we've been privileged to be a part of, comprised of Dan Salone, Christopher Poore, who you now know, Eric Thayer, all of AIS, and myself from the NMFTA. 01:39.660 --> 01:49.820 Also, this research would not have been possible without the support of the Motor Freight Carrier members of the NMFTA, who sponsored us with access to their facilities and to their equipment, and thank you for that. 01:50.520 --> 01:53.500 First up, what is power line communications? 01:53.600 --> 02:01.900 Generally speaking, any time you're putting data onto lines that are intended for power, you're doing power line communications. 02:01.900 --> 02:06.360 You might know some technologies that fall into this class, such as Green PHY and Home Plug. 02:06.360 --> 02:10.780 There's an entire interoperable family of technologies in IEEE 1901. 02:11.020 --> 02:29.700 The technology is found in automotive, most commonly under SAEJ 1772, which is for plug-in electric vehicle charging, and there was some really interesting work by Baker and Martinovic at USENIX 19, where they showed that they could remotely read traffic between the plug-in electric connection of a vehicle and the charger. 02:29.700 --> 02:34.040 But today, we're not talking about plug-in electric vehicles, we're talking about trucks. 02:34.740 --> 02:41.100 So let's rewind the clock a little bit, maybe a couple decades, and look at what trucks looked like around 1997. 02:41.100 --> 02:53.580 There were anti-lock braking, ABS systems, on trailers and on tractors, and these ABS systems are quite important to prevent rolls and reduce braking distance. 02:53.580 --> 02:55.580 It's really important for safety. 02:55.980 --> 03:02.420 So at the time, there was only a warning on the side of the trailer that showed you if the ABS was malfunctioning. 03:02.440 --> 03:11.220 There are regulators and fleet safety managers that really wanted to have some kind of a dash display that would show the driver if there was a problem with the trailer ABS. 03:11.220 --> 03:16.640 And this, of course, would help make sure that ABS is functioning and everyone would stay safe. 03:18.660 --> 03:21.880 Now let's look at how these trailers and tractors were connected. 03:21.920 --> 03:27.860 So back then, and actually as it is today, trailers and tractors are connected with a J560 connector. 03:27.860 --> 03:34.400 Here you can see that green pigtailed cable plugging into a bulkhead jack there. 03:34.780 --> 03:36.560 And that's a seven-way connector. 03:36.560 --> 03:41.360 You can also see a red and a blue cable behind the bulkhead here. 03:41.360 --> 03:46.660 Those are actually pressurized air, whereas the green cable here, this is electrical. 03:48.520 --> 03:52.880 So back then, they had this tractor-trailer connector. 03:52.880 --> 03:55.100 You can see a breakout here of the J560. 03:55.100 --> 04:04.300 It's got tail lights, right turn, left turn, brake lights, a ground connector, and then this power for ABS and auxiliary power. 04:04.300 --> 04:07.020 So it's a fully populated connector. 04:07.020 --> 04:15.860 There's no room for anything else, but still, regulators and safety managers really wanted to have a way to show the driver when something was failing. 04:15.860 --> 04:25.620 Now an obvious option is to add another connector, but unfortunately, you know, for fleets, the lifetime of trailer equipment is very long and the cost of retrofitting is very high. 04:25.620 --> 04:36.980 So the industry took it upon themselves to design a technology that would let them send this ABS fault data up into the tractor without adding a new connector. 04:36.980 --> 04:50.860 And at the same time, there was a lot of other technologies that people wanted to get data from the trailer into the tractor, and there was things like axle weight, door latch, yaw sensors, and things like that. 04:51.080 --> 04:58.600 So it was hoped that this technology could carry all sorts of information up from the trailer to the tractor, not just the ABS fault info. 04:58.680 --> 05:03.300 Around June 1998, ATATMC actually approved PLC for trucks. 05:03.300 --> 05:06.740 This is the American Trucking Association's Technical Maintenance Council. 05:06.740 --> 05:11.320 They are responsible for making recommended practices in the commercial vehicle space. 05:11.440 --> 05:17.220 And eventually, SAE published J2497 in 2002. 05:17.260 --> 05:25.800 And what they did was add high-frequency signals onto these power lines that run the length of the truck. 05:25.800 --> 05:35.020 So they would couple them onto their either transformer or capacitor, just AC-coupled, and send these high-frequency signals with enough of a voltage that they would propagate. 05:36.180 --> 05:42.000 Now, there was an issue with PLC for trucks that was patent. 05:42.000 --> 05:43.540 It was actually patent incumbent. 05:43.840 --> 05:47.260 And at the time that they started the work on this, they didn't know. 05:47.480 --> 05:54.360 Eventually, it became known, and SAE actually, at one point, just canceled the working group to create J2497. 05:54.840 --> 05:56.800 And eventually, it was resolved. 05:56.800 --> 06:04.580 The technology was patented for a long time, and there were royalties that had to be paid, but the standard did go forward. 06:04.780 --> 06:13.680 Now, if you go to SAA meetings or ATATMC meetings like I do, you've probably seen these patent disclosure and IP statements at the beginning of the meetings. 06:13.680 --> 06:26.440 I've been told that for ATATMC, those passages actually exist because of what happened with PLC for trucks, whereas with SAE, those statements actually predated the PLC for trucks issue. 06:27.060 --> 06:29.780 So it took the industry a while to get it done. 06:29.780 --> 06:30.860 It was quite complicated. 06:30.860 --> 06:34.200 There was a lot of tests that happened over the winter and otherwise. 06:34.240 --> 06:42.460 And as I mentioned, there was other technologies that wanted to get like axle weighing and door sensors and things like that up from the trailer into the tractor. 06:42.460 --> 06:44.520 So they had interoperability tests. 06:45.100 --> 06:50.720 And it ended up being... eventually, it was deployed, but it was quite complicated to get it to that point. 06:50.720 --> 06:57.720 So the news media has been seen to call this technology expensive or complicated. 06:57.720 --> 07:02.140 There's a funny quote right here where someone's saying the most expensive light bulb in history. 07:02.540 --> 07:04.720 So it is funny to look at the technology that way. 07:04.720 --> 07:19.200 But it's also important to recognize that the calculus that the fleets were looking at was whether they would have to retrofit all their trailers, which typically have, you know, 30 year service lifetimes, just to get another light up into the cab. 07:19.200 --> 07:27.720 So creating this technology, even though it seems like it was an expensive light bulb, still, from their point of view, what they wanted was cheaper. 07:27.860 --> 07:31.360 And that's going to be true today as it was back then. 07:31.460 --> 07:33.900 The trailers last for a very long time. 07:33.900 --> 07:36.340 The connectors are still the J560 connector. 07:36.520 --> 07:42.020 And trying to change any of that might prove to be more expensive than anyone would want to spend. 07:42.920 --> 07:49.740 So now you know a lot of the history about J2497 and why it came about and why are we sending these high frequency signals on power lines. 07:49.740 --> 07:52.900 Let's talk more about what it is, how it's put together. 07:53.200 --> 07:59.680 You can think of J2497 like an alternate physical layer for J1708. 07:59.680 --> 08:05.240 And we're not going to go into J17 a lot because there's another talk that will give you lots of details on it. 08:05.240 --> 08:10.340 Suffice it to say that it's a heavy vehicle network that predates J1939. 08:11.660 --> 08:18.260 J2497 has its own arbitration scheme that it employs around J1708. 08:18.260 --> 08:22.580 The PLC for trucks 2497 is always 9600 bauds. 08:22.580 --> 08:28.620 And the way it takes these 1708 signals is it'll actually encode them into spread spectrum chirps. 08:29.180 --> 08:33.440 So another way to think about 2497 is by an analogy. 08:33.740 --> 08:36.680 You can see a couple analogies that I'm making here. 08:36.680 --> 08:41.580 You know J1939 is a lot like J1587. 08:41.880 --> 08:49.180 And J1939 can sit on top of high speed or low speed canned buses, twisted or unshielded. 08:49.620 --> 08:57.120 So similarly can J1587 sit on top of either J2497 or just J1708. 08:57.120 --> 09:01.220 And you'll probably have diagnostics or some other applications on top of those. 09:01.320 --> 09:07.860 Which if you're not an automotive person you can think of it by an analogy to DNS which is built on top of UDP. 09:07.920 --> 09:16.080 And UDP IP can run either like ethernet or 802.11 infrared for example. 09:16.860 --> 09:20.240 So let's talk a little bit more about these spread spectrum chirps. 09:20.240 --> 09:26.220 The specification of J2497 by SAE actually includes a definition of the chirp. 09:26.240 --> 09:33.880 And they have to sweep from 200 to 400 kilohertz, then from 400 to 100 kilohertz, and then from 100 to 2 or 3 kilohertz. 09:33.880 --> 09:38.120 You can see a picture here of a rendering of a couple possible chirps. 09:38.120 --> 09:42.280 Different possibilities result by how you treat these discontinuities here. 09:42.420 --> 09:46.360 The chirps themselves are about 100 microseconds total. 09:46.380 --> 09:50.880 They start and end at value zero so that they can be concatenated. 09:51.260 --> 09:57.500 And when they're transmitted they should be transmitted in amplitude between 2.5 to 7 volts peak-to-peak according to the spec. 09:57.500 --> 10:09.780 Now in practice the transmitters on trailer equipment tend to send them even higher than 7 volts peak-to-peak just to make sure that they'll make it from one end of the tractor trailer to the other. 10:11.420 --> 10:18.060 The chirps are put together into frame encodings that will let them actually send J1708 frames. 10:18.140 --> 10:21.740 And the way the frames are encoded is broken up into a preamble and a body. 10:21.760 --> 10:35.200 The purpose of the preamble is there to realize that alternate arbitration method so that if two PLC devices are trying to talk at the same time there's a way to determine who has the highest priority and which one should back off. 10:35.200 --> 10:36.860 It's very similar to CAN. 10:36.860 --> 10:43.460 It involves that very first byte being sent and the lower byte is the higher priority. 10:43.620 --> 10:47.980 So here you can see two renderings of frames. 10:47.980 --> 10:51.880 The first being OA00, the second being OBFF. 10:51.880 --> 11:01.200 The OA00 frame and the OBFF frame are the ADS fault information that we talked about, the impetus for J2497. 11:01.680 --> 11:07.260 So in the preamble you can see that the messages, the actual chirps have delays in between them. 11:07.260 --> 11:15.540 And this is because the chirps are 100 microseconds but the time for the symbols is 104 microseconds, these little gaps. 11:15.560 --> 11:22.040 In the preamble the presence of the chirp indicates, you know, the logic value. 11:22.040 --> 11:25.620 So logic 0 means chirp present, logic 1 is chirp absent. 11:25.860 --> 11:37.080 But then when you get into the body it's actually 100 microseconds with no gaps and the encoding is actually determined by phase. 11:37.220 --> 11:39.860 So this is phase shift keying in the body. 11:40.140 --> 11:48.540 The phase of logic 0 is arbitrary per device and it's actually given by the phase that's transmitted here in the amplitude shift keying section. 11:49.680 --> 11:55.940 There's a checksum at the end and then there's all these sync bits you can see in orange and in green. 11:56.440 --> 12:04.720 And some of these sizes are variable so there could be one to two initial symbols and there could be zero to four gap symbols. 12:07.240 --> 12:08.800 So why is it like that? 12:08.800 --> 12:14.080 Well J2497 was designed for J1708. 12:14.420 --> 12:23.100 This whole PLC for trucks scheme was actually accomplished by a particular piece of silicon, the Intelon SSC P485. 12:23.300 --> 12:34.220 And this particular chip was designed to take J1708 frames and wrap them around with some extra information and re-encode them into these spread spectrum chirps. 12:34.220 --> 12:43.140 So the Intelon P485 actually adds, you know, these sync bits and adds all the preamble highlighted here in orange. 12:43.140 --> 12:52.580 It will then send, you know, the actual encoded information in chirps as the body which matches exactly what you would see on the J1708 line. 12:52.580 --> 12:57.520 And then it adds these terminators with the gaps and the sync bits. 12:57.760 --> 13:04.040 So the checksum is actually part of J1708 and part of J2497. 13:04.780 --> 13:09.160 And you can see there's a duplication of MIDs. 13:09.260 --> 13:12.200 You can think of MIDs like arbitration IDs in CAN. 13:12.200 --> 13:13.320 It's that first byte. 13:13.320 --> 13:19.780 It determines arbitration on the bus and the data is duplicated twice. 13:20.000 --> 13:28.240 It turns out that this information here in the preamble is used for arbitration of the PLC bus only. 13:28.240 --> 13:36.760 And what gets sent on J1708 is this byte that's put right here, which means that you can send things where those two don't equal each other. 13:36.760 --> 13:39.520 And you can override priority. 13:39.520 --> 13:48.840 So you could send a very low priority MID with an all zero PLC MID and it would margin on top of anyone else that was talking on PLC. 13:50.140 --> 13:52.320 So a little bit about J1587. 13:52.320 --> 13:54.660 This is that next layer above. 13:54.660 --> 13:57.380 You can think of it akin to J1939. 13:58.000 --> 14:02.560 If you look at the J1587 spec, there's a lot of really interesting highlights. 14:02.840 --> 14:07.640 They say that you shouldn't send more than 21 bytes at a time unless the vehicle is stationary. 14:07.640 --> 14:09.400 I wonder what happens if you don't. 14:09.720 --> 14:14.400 There's a factory test MID that should never be sent by any vehicle system. 14:14.460 --> 14:18.580 There are bridging and forwarding schemes defined in the spec. 14:18.580 --> 14:20.920 There's a dynamic address claim. 14:21.220 --> 14:31.640 There are cold and warm reset commands and lots of support for interesting kind of peripherals on commercial vehicles like toll systems and display signage and climate control . 14:31.880 --> 14:44.740 Now for some more details on how to decode J1587 automatically, please see our team's presentation, which should be up today, or look at the pretty J1587 repository. 14:46.140 --> 14:59.700 Even though J1587 defines a lot of interesting things that could be in there, all we've seen in our testing for the most part is the ABS fault lamp on and off messages and manufactured diagnostic messages. 14:59.780 --> 15:15.060 There was a report by the FMCSA that suggested that there should also be axleway yaw sensor and door latch sensor traffic on the PLC bus, but we haven't run into it yet. 15:16.460 --> 15:20.600 So how do you connect to PLC? 15:20.760 --> 15:23.580 There are some great options out there. 15:23.580 --> 15:28.280 The DG Technologies PLC TESCON is very rugged and reliable. 15:28.280 --> 15:29.760 I love mine. 15:30.220 --> 15:40.000 There is also a NEXIC PLC adapter, which has the advantage of being able to go in line on a cable, so you can you can test it in place. 15:40.280 --> 15:45.640 The problem with these sort of classic diagnostic adapters is that they aren't cheap. 15:46.260 --> 15:50.740 You will need them for running manufactured diagnostic tools though. 15:51.100 --> 15:57.500 And also the Intelon P485, I'm told, is becoming harder to source, which is not going to help with the cost of these tools. 15:57.980 --> 16:11.340 Finally, the limitation of these tools is that you can't do anything strange to PLC with these tools, because they just have an Intelon P485 chip in them, and so you can't make arbitrary PLC waveforms. 16:11.340 --> 16:18.140 For example, you can't do different PLC MID from a J1708 MID on the bus. 16:19.220 --> 16:24.860 So how do you interface with J1708 so that you can interface with PLC? 16:25.180 --> 16:34.480 The first one up is another one of those RP-1210 adapters, such as the Digitech DPA4, DPA5, or an EXIC USB link. 16:34.480 --> 16:39.080 And these things are necessary for the manufacturer diagnostics. 16:39.320 --> 16:50.540 An option that I really like, that's really cool, that was presented here at DEF CON 24 is the TruckDuck, which is a beaglebone cape by 6V and Haystack. 16:50.540 --> 16:55.340 There's been some revisions to this board since the DEF CON 24 presentation. 16:55.340 --> 16:59.320 There's the 1.5 EET version and the Mega version. 16:59.520 --> 17:11.400 These beaglebone capes enable communication with both J1939, or any Canon network actually, and J1708 networks through the PiHV networks module that Haystack authored. 17:11.600 --> 17:17.120 And we are going to talk about some ways to use these to write PLC. 17:17.380 --> 17:21.920 So our PLC writing tool, what we wanted was something to be low cost. 17:21.920 --> 17:23.460 We wanted it to be open. 17:23.600 --> 17:26.820 We wanted it to be capable of doing weird things. 17:26.820 --> 17:29.380 We weren't so concerned about arbitration. 17:29.380 --> 17:41.620 The J1708 stack that Haystack put together for the TruckDuck originally didn't have any arbitration, just had frame detect, and it works fairly well on systems that aren't highly loaded. 17:42.920 --> 17:51.500 And we didn't want to worry about getting read in right now, and the reason for that you'll see will be clear later. 17:51.780 --> 18:09.700 So our approach that we elected, mostly because we're biased and we like the TruckDuck, is let's make some small mods to the TruckDuck and push them upstream and try to stick with very small BOM changes, and hopefully 6V can integrate those into the next Mega Mega EET version of the TruckDuck. 18:11.300 --> 18:14.800 So, Bitbanging PWM on the PRU. 18:14.800 --> 18:20.920 Bitbanging is the process of toggling a GPIO in order to create whatever protocol you're after. 18:20.940 --> 18:29.240 GPIOs are general purpose input output pins, of which there are many on the BeagleBOM, and the PRU is a programmable real-time unit on the BeagleBOM. 18:29.240 --> 18:41.300 It runs jitter-free, like deterministic code with no interrupts stopping execution at 200 megahertz, which is plenty for the 400 kilohertz-ish signal of PLC. 18:41.880 --> 18:52.520 And also the PRU was used originally on the TruckDuck for the J1708 stack itself, so there's already a precedent there for using the PRU in this system. 18:53.180 --> 19:09.360 It turns out that the TruckDuck J1708 channel 2 has pretty much been broken since release, which is actually good for us because it lets us reuse, repurpose, one of the PRU cores for the PLC application instead. 19:10.680 --> 19:20.480 And in trying to find pins, we needed to find one that we knew we could bitbang from the PRU, which is a certain class of pins. 19:20.480 --> 19:30.360 But we also wanted to eventually maybe get rid of the PRU, if possible, and use the integrated PWM unit in the BeagleBOM, although that hasn't been done yet. 19:30.360 --> 19:34.980 So trying to find the pin that would work was, you know, one of these fun processes. 19:34.980 --> 19:37.480 I found it best to just do it with markers. 19:37.640 --> 19:40.580 We wanted to make sure that it could be accessed from the PRU. 19:40.580 --> 19:42.500 It could migrate to PWM. 19:42.600 --> 19:46.140 We wanted to make sure it didn't conflict with any other TruckDuck pins. 19:46.720 --> 19:50.320 So for synthesizing PLC, we settled eventually on P928. 19:50.320 --> 19:51.400 We had a backup . 19:51.420 --> 19:59.720 And then we also planned for doing frame detect and PLC read via an ADC, but we haven't implement that. 19:59.720 --> 20:02.200 That's just kind of allocated for later. 20:02.660 --> 20:06.360 So in creating PLC signals, there's two main parts. 20:06.360 --> 20:13.260 You have to synthesize this PLC with PWM, and then you have to couple this signal that you've created onto the PLC network. 20:13.260 --> 20:16.200 So there's these two clouds that we're going to reveal. 20:17.920 --> 20:21.060 I don't often do this, but I thought I would this time. 20:21.060 --> 20:27.380 I would try the dumbest thing first, and my friends will tell you that I'm not very good at doing that, but I did it this time. 20:27.520 --> 20:30.660 The first thing we tried was the dumbest PWM possible. 20:30.660 --> 20:38.400 You just turn it on when the signal that you're trying to realize is above zero, and turn it off when the signal you're trying to realize is below zero. 20:38.500 --> 20:39.800 So you can see that picture here. 20:39.800 --> 20:44.260 The orange waveform is the dumb PWM, and the blue waveform is the true CHIRP. 20:44.340 --> 20:46.180 And it turns out that actually worked. 20:46.180 --> 20:49.220 So we said yay and moved on. 20:49.560 --> 20:51.440 The next part was coupling. 20:51.540 --> 20:57.680 And you can see here in the DGTech PLC test con, the coupling network they created is just gorgeous. 20:58.060 --> 21:08.020 And compared to what we were using, it is amazing because we found out that 100 nanofarad capacitor was enough, and that was our filtering as well. 21:08.020 --> 21:12.760 So the dumbest filtering and the dumbest PWM got us what we needed, and we moved on. 21:13.220 --> 21:16.200 The results were pretty good, actually. 21:16.200 --> 21:26.420 We did run into one issue with undocumented cycle counts for some of the instructions that we we had to use in assembly, but the results were fine. 21:26.420 --> 21:36.900 You can see down here the orange signal is a recording on an oscilloscope of the PLC signal that we synthesized after filtering on a receiver. 21:36.900 --> 21:37.980 Same with the purple. 21:37.980 --> 21:41.000 This is just a larger zoomed out trace. 21:41.260 --> 21:45.340 So this is post-filtering of the signal that we realized. 21:45.340 --> 21:50.560 The signal that we realized is much more like these square waves up here in the tuning edge delays diagram. 21:50.560 --> 22:03.520 And this is just a representation of how we had to tune some of the assembly instructions to make sure that the signal would line up, you know, all the way into the realization like bit 54 of the PLC chirp train that we had to create. 22:03.820 --> 22:05.560 So it worked pretty well. 22:06.940 --> 22:07.860 The code. 22:07.860 --> 22:09.220 You can get this tool. 22:09.220 --> 22:11.220 It's MIT licensed. 22:11.660 --> 22:15.520 It's available on GitHub as of today. 22:15.920 --> 22:19.560 What it does is it adds a new J1708 server. 22:19.560 --> 22:30.380 That's the way that the 1708 was set up on the truck ducks is they receive and send UDP frames and will send or receive those onto J1708. 22:30.380 --> 22:38.020 What we did was create a whole new one that's completely compatible, but what it does is send PLC signals instead. 22:38.140 --> 22:41.360 We also created some command line utilities. 22:41.760 --> 22:52.480 The network, the Pi HV networks that Haystack created has a really nice programming interface for Python, but I just like to have really simple command line tools like dump and send. 22:52.520 --> 22:57.820 So we drafted those and they're compatible with the existing stack as well. 22:58.720 --> 23:09.440 And so to get your truck ducks to connect to PLC, you actually do need to do some PCB changes to your truck duck for now until 6V rolls us into the next revision. 23:10.180 --> 23:19.280 And this led to probably one of my favorite kind of bodge jobs because I love to do rework of PCBs and I also really like it when things have to be MacGyvered. 23:19.420 --> 23:32.000 When we were connecting this up to PLC, we discovered that it would work when there was a really long length of cable in between the power supply of the truck duck and the point where we were coupling to the network. 23:32.000 --> 23:50.420 And if we didn't have that long piece of cable, the truck duck power supply just seemed to attenuate the PLC signals to almost nothing, which led me to this great bodge job right here where I wrapped 40 inches of wire and soldered that down to the board in between the input to the power supply and the connector. 23:50.420 --> 23:53.920 And that actually solved the problem, which is fun. 23:55.360 --> 24:01.260 Okay, so next up we're going to show you how you can use some adapters to connect your truck duck up to the power lines. 24:01.260 --> 24:02.800 There's a lot of different options. 24:02.800 --> 24:07.580 The first is this J560 to DB15 in Deutsch 2-pin. 24:07.980 --> 24:12.720 So these DB15 connectors, you can find them in a lot of different diagnostics adapters. 24:12.720 --> 24:15.140 The DPA4 and the truck duck both have them. 24:15.140 --> 24:19.720 This is a 560 connector here, which is useful to be plugged into the back of your tractor. 24:19.720 --> 24:29.220 You can also plug into the back of your trailer if you have an adapter to connect to the batteries up here on the Deutsch 2-pin, and the whole set is in the DG Tech PLC Tescon. 24:29.560 --> 24:37.640 Next up is these battery clip, the DB15 adapters, and these ones can be found in the Nexic adapter sets on the internet. 24:38.020 --> 24:51.460 There's also these Y adapters for J560, where they give you a Deutsch 9-pin connector in line with two J560 connectors, so these can be used in line with a tractor and trailer that are connected. 24:51.500 --> 25:06.200 You've got to watch out that some of these actually do contain an Intelon P485, and what they're doing is converting PLC to J1708 and routing that to the J1708 pins instead of PLC onto the power pins. 25:07.580 --> 25:13.000 Another one that's useful is one of these inline jack and plug, which is very similar to the previous one. 25:13.000 --> 25:17.620 None of these have the Intelon P485 inside them. 25:18.920 --> 25:28.720 You can also build your own umbilical, so these J560 plugs, you can take them apart by removing the set screw, and you can wire any kind of a pigtail you like. 25:28.720 --> 25:39.160 I like to use these Deutsch 2 pins because they work with the DG Tech sets, and then you can close it all back up and you can have a connector that can be used with a tractor and trailer connected. 25:40.600 --> 25:49.060 So we also created a PLC reading tool, and Chris Poore is going to tell you some more details about that. 25:49.100 --> 25:49.820 Chris? 25:50.120 --> 25:51.220 Thanks, Ben. 25:51.360 --> 26:00.260 One of our goals was to develop a low-cost tool for reading J2497 messages with SDRs and open source software. 26:00.260 --> 26:06.880 We wanted a solution to let just about anybody tap into a line and see messages all for little cost. 26:07.620 --> 26:09.560 Next slide, please. 26:11.960 --> 26:28.880 Again, the J2497 signals primarily consist of a series of 100 microsecond chirps that start at 203 kilohertz, ramp up to 400 kilohertz, quickly drop down to 100 kilohertz, and back to 203 kilohertz. 26:29.100 --> 26:35.940 The 100 to 400 kilohertz frequency range is lower than most SDRs can handle. 26:35.940 --> 26:48.720 For example, the starting frequency of the RTL2832U dongles vary depending on the model, but they can range from 500 kilohertz to around 50 megahertz. 26:50.060 --> 26:51.800 Next slide, please. 26:54.720 --> 26:58.340 To get around this problem, we used up converters. 26:58.540 --> 27:05.860 The Hammett up up converter will take our signal and mix it with an intermediate frequency of 125 megahertz. 27:06.120 --> 27:10.420 I believe the SPIverter uses 120 megahertz. 27:11.020 --> 27:19.020 Once it's near 125 megahertz, we can receive it with radios and begin to condition the signal in software. 27:19.260 --> 27:28.560 We improved the quality of the signal if we didn't tune our radio directly on 125 megahertz, but instead at 126. 27:28.820 --> 27:35.620 This allowed us to use a bandpass filter to get rid of a lot of the DC noise associated with the Hammett up. 27:36.460 --> 27:38.240 Next slide, please. 27:40.240 --> 27:50.060 We achieved most of our success with an RTL and a Hammett up, but there are solutions out there that could be promising that don't use up converters. 27:50.060 --> 27:59.300 We tried the Lime SDR, which starts at 100 kilohertz, but the gain and performance down at those frequencies was too low for us. 27:59.460 --> 28:06.060 You can find schematics online for modifying RTL SDRs to get a lower starting frequency. 28:06.060 --> 28:16.720 They also make some that have a direct receive mode that can tune down to 500 kilohertz, but they say the performance is reduced when operating them there. 28:17.740 --> 28:28.440 The AirSpy HF Plus is supposed to start at 9 kilohertz, but it might not have the bandwidth to support the J2497 chirps. 28:29.520 --> 28:34.580 You might have some luck with oscilloscopes, but then the price starts to go up. 28:34.580 --> 28:39.780 The ADOM2000 is a cheaper option you might want to consider. 28:41.280 --> 28:43.140 Next slide, please. 28:44.420 --> 28:46.260 Back to our setup. 28:46.260 --> 28:54.240 When tapped to the line, we used a coupling adapter to remove the 12-volt DC offset that exists. 28:54.520 --> 28:59.820 This was to be on the safe side and avoid any chance of damaging our upconverter. 29:00.220 --> 29:13.490 Next, the output of the upconverter went to the RTL SDR and was sampled and filtered in GNU Radio, producing a J1708-looking message like you see in the bottom right. 29:14.540 --> 29:23.760 Note how the preamble has visible silent periods, and the body is the continuous section at the end of the message. 29:25.360 --> 29:27.240 Next slide, please. 29:29.240 --> 29:34.440 We developed three methods for demodulating those signals into bits. 29:34.440 --> 29:38.020 One method examines the instantaneous frequency. 29:38.020 --> 29:43.060 The other two rely on correlating the signal with specific sequences. 29:43.100 --> 29:45.740 I'll go over them in the next few slides. 29:46.640 --> 29:48.480 Next slide, please. 29:50.400 --> 29:58.320 Our first attempts took advantage of GNU Radio's quadrature demod block to produce the plot you see in the bottom right. 29:58.580 --> 30:05.960 The sawtooth pattern you see down there represents the frequency over time for chirps in the body of the message. 30:05.960 --> 30:12.240 The circled spikes indicate sudden changes in phase at the start of a new chirp. 30:12.620 --> 30:16.420 This is what we use to distinguish the ones and zeros. 30:17.160 --> 30:25.760 No change in phase means keeps the value of the previous bit, while phase change means flip the bit. 30:25.800 --> 30:38.340 We framed the start and stop of each message based on the amplitude and tried to ignore the preamble sections of each message since the body contains the whole J1708 message anyway. 30:39.700 --> 30:41.400 Next slide, please. 30:43.560 --> 30:53.480 We started developing alternative methods because the previous one did not work well with noise and relied heavily on a consistent signal amplitude. 30:53.480 --> 30:58.440 So to get around that, we correlated the signal with a 203 kilohertz reference. 30:59.600 --> 31:04.800 Now, 203 kilohertz is the precise frequency where each chirp begins. 31:04.920 --> 31:12.960 If there's no phase change, there's a smooth 203 kilohertz signal, which are the higher peaks you see in the output down there. 31:13.680 --> 31:19.820 However, when there's a phase change present, the frequency gets disrupted for a short period of time. 31:19.860 --> 31:24.580 It results in a value close to zero when correlated with the reference. 31:25.320 --> 31:34.860 That's why you kind of see those mini spikes where it's ramping up and down as it approaches the location where 203 kilohertz should be in the chirp. 31:35.820 --> 31:43.740 Likewise, anything outside the message, like the noise, is going to be reduced to a value close to zero. 31:44.200 --> 31:52.220 We use a moving average filter on the correlation output to frame the message and ignore the preamble part of it. 31:52.540 --> 31:54.540 Next slide, please. 31:57.300 --> 32:05.280 Now, for situations where the signal is completely buried in the noise, the previous two methods are not very effective. 32:05.280 --> 32:14.360 Instead, we tried a new method, which begins by correlating the signal with a Python-generated chirp designed to mimic a real one. 32:14.460 --> 32:21.600 The result produces much larger peaks, like you see down there, which helps distinguish it from the noise. 32:21.740 --> 32:31.520 We use this technique to frame the message and reuse the 203 kilohertz reference in the previous method to distinguish the ones and zeros. 32:32.680 --> 32:34.500 Next slide, please. 32:35.800 --> 32:36.420 Next slide, please. 32:36.420 --> 32:40.540 We call it all GRJ2497. 32:40.920 --> 32:47.220 It contains the blocks and flow graphs that will read the traffic and print out messages like what you see on the right. 32:47.540 --> 32:53.060 The values for the MID, data, and checksum are pulled right from the messages. 32:53.820 --> 33:03.940 Additionally, there is an option built into the blocks to send the messages in hex over to a UDP port for other potential tools to use. 33:04.420 --> 33:07.140 Now, back to Ben to continue on. 33:08.120 --> 33:09.000 Thanks, Chris. 33:09.000 --> 33:19.660 So, you've got GENIE radio, and you can now read your PLC signals, but how do you connect your Hammet up or some direct receive receiver onto PLC? 33:20.280 --> 33:24.740 Turns out, once again, just 100 nanofarad capacitor is going to do the trick. 33:24.880 --> 33:33.060 I have used and like to use the 100 volt ones just to be safe, because we don't really want to get battery currents connected to our receivers. 33:33.600 --> 33:38.880 And then you just need a way to connect those PLC wires onto this coupling network. 33:38.880 --> 33:45.980 So, all of those previous adapters that we talked about all apply in this case, but then how do you connect the wires up? 33:45.980 --> 33:51.440 And I think one of the nice solutions we came up with is modifying these Balan19 adapters. 33:51.460 --> 34:12.420 So, you can actually take the transformer off of the board and cut the trace right here at the back, replace that transformer with a surface mount capacitor, bridge the ground here, and then cover it all with solder resist to avoid ever touching 12 volt at back battery currents for trucks. 34:13.440 --> 34:16.780 Another one that's an adapter that works is an antenna. 34:16.780 --> 34:20.580 You actually can read these signals wirelessly. 34:20.580 --> 34:31.680 We experimented with a whole bunch of different antennas, but we found that this form of active antenna, pictured here, works pretty good and is pretty darn cheap. 34:31.680 --> 34:39.700 The power supply that's here is fine, but it works well as well if you connect a 9 volt battery to it instead. 34:39.760 --> 34:49.100 And we believe that there's a lot more options out there because really anything that's made for 2200 meters or low FER is in the right band. 34:49.480 --> 34:58.860 But we stuck with portable options because a lot of low FER and 2200 meter stuff is giant masts and you're not going to move that around with you, but there are loops and whips and mini whips. 34:59.620 --> 35:05.380 But really if you just want to do quick and dirty, these mini whips work really great for the price. 35:05.400 --> 35:17.240 Over here you can actually see, you know, we're receiving a pretty clear PLC signal on top of the background noise using just this mini whip taped to the side of a box next to a truck. 35:18.380 --> 35:22.560 So we're able to read these signals wirelessly, but how far? 35:22.560 --> 35:30.880 In our testing we can reliably receive six feet away from a position next to the gap between the tractor and the trailer. 35:31.180 --> 35:40.900 Now this was using our first version of the GNU radio receiver, the one that does the phase measurements and not the new cool stuff that Chris talked about with correlation. 35:41.060 --> 35:44.000 So we feel pretty confident this can be extended. 35:44.000 --> 35:50.260 We don't know how far and, you more testing, we're going to find out. 35:51.500 --> 35:53.380 Why do we think this works? 35:53.840 --> 36:00.660 It's a bit strange because, you know, these trailers, or maybe the long ones that we were testing on, were 40 feet. 36:01.060 --> 36:12.880 And a half wave, you know, resonator at 40 feet is really only 12 megahertz, which is way, way above the 400 kilohertz top end of PLC for trucks. 36:12.880 --> 36:16.500 So it really shouldn't be a good radiator. 36:16.500 --> 36:20.980 But when we tested it, it certainly is good enough at this point. 36:20.980 --> 36:36.120 And we think that may be a combination of factors, but possibly primarily due to that very large voltage that they transmit, that these devices transmit at, to make sure they can make it across the whole range of the tractor and the trailer. 36:38.220 --> 36:48.840 So yeah, the long wires, the high transmit voltages, I think also contributing this is maybe PLC transmitters are actually left alone to be noisy. 36:48.840 --> 36:56.860 The spec for J2497 allows any conducted noise to be beyond any other restrictions. 36:56.880 --> 37:11.100 And then also FCC's regulations on unintentional radiators actually exempt vehicles, any digital device utilized exclusively in any transportation vehicle from the unintended radiator status. 37:11.100 --> 37:20.880 Now they do still have to, you know, turn off if they're found to be in violation, but it's hard to understand how that could be enforced with a large moving vehicle. 37:21.000 --> 37:31.840 So it seems like maybe these are radiators that are beyond spec and no one's been testing for them because they're exempt or because it's in spec. 37:33.400 --> 37:37.500 There are some impacts to this, but the good news is the impacts aren't very large. 37:37.500 --> 37:39.180 It's really a minor impact. 37:39.340 --> 37:44.980 On trailers, as we mentioned, really the main traffic is just the ABS fault information. 37:45.440 --> 37:56.280 And if that's the only information that's being disclosed by these radiators on a remote read, then you're not really losing confidentiality much. 37:56.420 --> 38:10.820 Now if you are a fleet that's deploying other technologies like, you know, way axles or maybe even your door sensors, any canvassing technology in the trailer, this kind of stuff might be more confidential. 38:10.820 --> 38:12.760 You wouldn't want to have it disclosed. 38:12.960 --> 38:19.820 In terms of the impact in other technologies, other applications of the Intel on P485, we don't really know. 38:20.040 --> 38:26.320 Now one of the reasons we wanted to do this talk is that there are future impacts that really matter. 38:26.320 --> 38:38.100 The ATATMC is working on putting together a new next generation tractor-trailer interface, and one of the propositions include exchanging keys over PLC. 38:38.100 --> 38:53.300 Not that, you know, you can't do key exchange without guarantees of confidentiality, but we just want everyone designing those systems to be aware of the fact that you can't assume that what you exchange over these buses will be confidential. 38:53.620 --> 38:56.540 So it could be a problem if it's not implemented correctly. 38:56.760 --> 39:01.740 And then as we mentioned at the beginning of the presentation, this is not unique to PLC for trucks. 39:01.740 --> 39:11.980 This behavior is present in other powerline technologies, and we encourage you to look at the work of Baker and Martinovic, who showed that this happens in plug-in electric vehicle chargers. 39:12.840 --> 39:14.780 Now what can we do about it? 39:15.320 --> 39:24.080 Presently, there's not a whole lot you could do on existing trailers, because we think that really it's these long wires and the high voltage levels that are contributing to this. 39:24.220 --> 39:28.400 But for the future, there is something you could do. 39:28.680 --> 39:33.760 You also should, if you're a fleet, consider what kind of information is flowing on your trailers. 39:33.760 --> 39:45.760 If you are using airway, if you are using door sensors or canvassing systems, you might want to be aware that that kind of information can't be considered confidential when your trucks are rolling down the road. 39:46.540 --> 40:01.440 You also should be aware if your maintenance departments configure your trailer ECUs to do any streaming of readings, which is possible on several of the manufacturers, where you can configure them to continuously stream wheel speed readings or temperature or voltage readings. 40:01.440 --> 40:04.900 Those wouldn't be considered confidential anymore on those buses. 40:05.040 --> 40:14.700 But for the future, when they're designing the next tractor-trailer interface, I think the main mitigation that needs to be taken into place is reducing those emissions. 40:14.820 --> 40:24.860 And that should be able to be achieved by using PLC on power lines only between the connections where those J560 connectors are. 40:24.860 --> 40:28.280 We recognize that the J560 connector is not going anywhere. 40:28.280 --> 40:32.680 It's going to be too expensive to try to get fleets to move off of it. 40:32.680 --> 40:39.720 So if we only use PLC in between the J560 connectors, that should reduce the radiated emissions. 40:39.740 --> 40:57.760 If we only use it in between those J560 connectors, it also affords designers the opportunity to use lower transmit voltages because the signals don't have to reach across the entire tractor-trailer or multiple, especially multiple trailers in tandem. 40:59.240 --> 41:07.260 So this issue has, throughout the process, has been disclosed to various parties over the past eight months or so. 41:07.260 --> 41:11.220 We've been in contact with trailer equipment manufacturers, all three of the major ones. 41:11.220 --> 41:14.120 We have reached out to all the trailer builders. 41:14.120 --> 41:16.400 Only one of them responded to us. 41:16.660 --> 41:21.200 We have coordinated the disclosure with NMFDA members and our sponsors. 41:21.400 --> 41:29.140 We've also done it with what was previously ICS CERT, who now wants to be called the CISA Vulnerability Disclosure Program. 41:29.600 --> 41:34.400 And they themselves also reached out to the trailer builders that didn't respond to us. 41:35.160 --> 41:49.500 At this time, CISA BDP has assigned CVE-2020-14514, and there is a advisory on this issue of trailer powerline communications to raise awareness forthcoming. 41:49.820 --> 41:54.340 So in terms of future work, it's kind of got two different directions. 41:54.340 --> 42:07.140 I know our AIS friends here do a lot of industrial control systems work, and they're very interested in looking at applications of the same method to various other powerline communication technologies, some of them listed here. 42:07.360 --> 42:18.060 On the transportation side, very much would like to improve those truck tuck features, you know, get some PLC read going, maybe use the PWM unit instead. 42:18.740 --> 42:26.820 I recognize that those DC blocks could be implemented differently, maybe capacitive coupling on one side of the transformer instead of removing the transformer. 42:27.040 --> 42:34.100 Also, the new Balin-19s have really great screw terminals, so you could have a much more rugged connection to the powerline. 42:34.520 --> 42:47.600 We also would like to take Chris's receiver code and figure out just how far the reception can be done reasonably using one of these cheap active antennas, and maybe some of the other more fancy active antennas that we've bought since then. 42:47.920 --> 42:52.180 And then there's also looking at the other places where you find PLC. 42:52.180 --> 43:04.040 We're told that PLC is also used in intramodal, which is where people take containers and put those on top of flat cars or put them on top of trailers on the road as well. 43:04.040 --> 43:07.020 So we'd like to have a look at how PLC integrates in that space. 43:07.840 --> 43:17.880 And there's also this thing, which should be really fun to look at, that someone took a trailer brake controller and of course added Wi-Fi to it, because that's a great idea. 43:18.220 --> 43:23.470 If anyone wants to have fun with a trailer brake controller, check this one out. 43:24.870 --> 43:30.830 But also at the Car Hacking Village, we have two brake controllers hooked up to pressured air. 43:30.830 --> 43:32.650 I'll tell you about that a little more in a minute. 43:33.370 --> 43:38.410 So yeah, in summary, in conclusion, we got you two tools. 43:38.410 --> 43:46.070 There's PLC for TruckDuck, which enables you to write to PLC using 1-bit PLC chirps that we did with bit banging. 43:46.070 --> 43:52.390 You can make an arbitrary waveform, you know, you can have different PLC MIDs than you do for the J1708 payloads. 43:52.390 --> 43:57.090 Everything we put together is compatible with Haystack's PyHV Networks modules. 43:57.470 --> 44:08.890 There's also the ability to read PLC traffic remotely, and this is tracked also internally as ICSVU-227452, and I gave you the CVE earlier. 44:08.950 --> 44:18.470 And the GR-J2497 tool that Chris told you all about is capable of receiving this traffic at a distance of six feet. 44:18.470 --> 44:26.170 And also that GR-2497 tool is itself compatible with the PyHV Networks modules from Haystack. 44:26.170 --> 44:28.290 So this is what I was trying to tell you about. 44:28.330 --> 44:47.610 We actually have a couple trailer brake controllers turned upside down, and we've connected Nerf dart firing cactuses to the exhaust ports on the bottom, and we're running pressurized air on them so that if you can figure out how to do a valve test or do an ECU reset on one of these things, 44:47.610 --> 44:52.050 it should push air through that exhaust port and you should fire those Nerf darts. 44:52.110 --> 44:58.650 And they're connected up on the Virtual Car Hacking Builder system, so there's a Twitch stream and remote logins to the shells. 44:58.990 --> 45:07.050 We do hope that you log in and have a try, and maybe if you get familiar with them, have a try at that Wi-Fi trailer unit. 45:07.050 --> 45:08.970 I know I'd like to someday too. 45:11.410 --> 45:22.170 What we did here was, you know, not the result of just Chris and I's effort, but really the result of a lot of people committing a lot of resources and assistance over the past few months. 45:22.230 --> 45:26.170 And I really want to take an opportunity to put all their names up here and thank them. 45:26.730 --> 45:35.130 Really, this wouldn't be possible without, you know, support of a team and a community, and I feel really lucky to be a part of both. 45:35.210 --> 45:37.370 So thank you very much for your time. 45:37.670 --> 45:45.530 I'll be over in chat with Chris, hopefully answering any questions you have, and I'll see you at the Virtual Car Hacking Village later. 45:45.570 --> 45:46.450 Bye!