start	end	text
1560	7860	Hi, welcome to our talk, Powerline Truck Hacking, Two Tools for PLC for Trucks.
8100	14740	We're going to talk to you today for about an hour, you know, who are we, what is PLC,
14740	20240	how do you interface with PLC, what are these two tools, PLC for Trucks, GR2497,
20860	26760	how can you adapt what you got onto the PLC connection. We discovered an issue,
26760	30900	we're going to discuss that issue and the impacts, and then we'll show you some future work.
31600	37320	So first up about us, I'm Ben Gardner, I'm a researcher with the National Motor Freight
37320	42820	Traffic Association, previously done embedded systems development, reverse engineering. I've
42820	47920	been an instructor at the Cybertruck Challenge and plan to, when it ever comes back, I also
47920	55280	volunteer at DEF CON and SAE. Hi, I'm Chris Poore, an electrical engineer who has been hacking things
55280	60500	and helping people get away with it for more years than I can count on these blood-stained hands.
60920	65280	I work at Assured Information Security, headquartered in Rome, New York, with locations
65280	71600	all over the U.S. AIS strives to be a driving force for technology and national security
72360	78480	and has the combined professional experience that I believe is rivaled only by the space program.
78840	83460	Contact AIS today. Next slide, please.
85300	89740	It's not just a two-person effort though, we're part of a much larger team, a great team that
89740	95560	we've been privileged to be a part of, comprised of Dan Salone, Christopher Poore, who you now know,
95560	102500	Eric Thayer, all of AIS, and myself from the NMFTA. Also, this research would not have been possible
102500	107540	without the support of the Motor Freight Carrier members of the NMFTA who sponsored us with access
107540	113520	to their facilities and to their equipment, and thank you for that. First up, what is power line
113520	119460	communications? Generally speaking, anytime you're putting data onto lines that are intended for
120080	124860	power, you're doing power line communications. You might know some technologies that fall into
124860	129220	this class, such as Green PHY and Home Plug. There's an entire interoperable family of
129220	137420	technologies in IEEE 1901. The technology is found in automotive, most commonly under SAE J1772,
137420	141720	which is for plug-in electric vehicle charging. And there was some really interesting work by
141720	146740	Baker and Martinovic using X19, where they showed that they could remotely read traffic
147300	150660	between the plug-in electric connection of a vehicle and the charger.
150660	155040	But today, we're not talking about plug-in electric vehicles, we're talking about trucks.
155820	160500	So let's rewind the clock a little bit, maybe a couple decades, and look at what trucks looked
160500	166960	like around 1997. There were anti-lock braking, ABS systems, on trailers and on tractors,
166960	174560	and these ABS systems are quite important to prevent rolls and reduce braking distance.
174560	180660	It's really important for safety. So at the time, there was only a warning on the side of
180660	185100	the trailer that showed you if the ABS was malfunctioning. There are regulators and fleet
185100	190280	safety managers that really wanted to have some kind of a dash display that would show the driver
190280	194940	if there was a problem with the trailer ABS. And this, of course, would help make sure that ABS is
194940	201900	functioning and everyone would stay safe. Now let's look at how these trailers and tractors
201900	206940	were connected. So back then, and actually as it is today, trailers and tractors are connected
206940	212800	with a J560 connector. Here you can see that green pigtailed cable plugging into a bulkhead
214120	220320	jack there, and that's a seven-way connector. You can also see a red and a blue cable behind the
220320	227640	bulkhead here. Those are actually pressurized air, whereas the green cable here, this is electrical.
229680	234500	So back then, you know, they had this tractor-trailer connector. You can see a breakout
234500	242260	here of the J560. It's got taillights, right turn, left turn, you know, brake lights, ground connector,
242260	248260	and then this power for ABS and auxiliary power. So it's a fully populated connector. There's no
248260	254200	room for anything else, but still regulators and safety managers really wanted to have a way to
254200	259160	show the driver when something was failing. Now, an obvious option is to add another connector,
259160	264440	but unfortunately, you know, for fleets, the lifetime of trailer equipment is very long,
264440	269820	and the cost of retrofitting is very high. So the industry took it upon themselves to design
269940	275060	a technology that would let them send this ABS fault data up into the tractor
276100	281420	without adding a new connector. And at the same time, there was a lot of other technologies that
282040	287440	people wanted to get data from the trailer into the tractor, and there was things like
287980	294560	axle weight, door latch, yaw sensors, and things like that. So it was hoped that this
294560	298220	technology could carry all sorts of information up from the trailer to the tractor, not just the
298220	305040	ABS fault info. Around June 1998, ATATMC actually approved PLC for trucks. This is the American
305040	309360	Trucking Association's Technical Maintenance Council. They are responsible for making
309360	316560	recommended practices in the commercial vehicle space. And eventually, SAE published J2497 in
316560	325660	2002. And what they did was add high-frequency signals onto these power lines that run the length
325660	331420	of the truck. So they would couple them onto their either transformer or capacitor, just AC couple
331420	336100	them, and send these high-frequency signals with enough of a voltage that they would propagate.
337060	344560	Now, there was an issue with PLC for trucks that was a patent. It was actually patent incumbent.
344900	349540	And at the time that they started the work on this, they didn't know. Eventually, it became
349540	355360	known, and SAE actually, at one point, just canceled the working group to create J2497.
355840	360560	And eventually, it was resolved. The technology was patented for a long time, and there were royalties
360560	368440	that had to be paid, but the standard did go forward. Now, if you go to SAE meetings or ATATMC
368440	374000	meetings like I do, you've probably seen these patent disclosure and IP statements at the beginning
374000	379580	of the meetings. I've been told that for ATATMC, those passages actually exist because of what
379580	386020	happened with PLC for trucks, whereas with SAE, those statements actually predated the PLC for
386020	392240	trucks issue. So it took the industry a while to get it done. It was quite complicated. There was a
392240	396320	lot of tests that happened, you know, over the winter and otherwise. And as I mentioned, there
396320	401080	was other technologies that wanted to get, like, you know, axle weighing and door sensors and things
401080	406680	like that up from the trailer into the tractor. So they had interoperability tests, and it ended up
406680	411620	being, you know, eventually it was deployed, but it was quite complicated to get it to that point.
411620	418680	So the news media, you know, has been seen to call this technology expensive or complicated.
418680	423100	Here's a funny quote right here where someone's saying the most expensive light bulb in history.
423560	427980	So it is funny to look at the technology that way, but it's also important to recognize that
427980	432800	the calculus that the fleets were looking at was whether they would have to retrofit all
432800	437940	their trailers, which typically have, you know, 30-year service lifetimes, just to get another
437940	443420	light up into the cab. So creating this technology, even though it seems like it was an expensive
443420	449740	light bulb, still, from their point of view, what they wanted was cheaper. And that's going to be
449740	455880	true today as it was back then. The trailers last for a very long time, the connectors are still the
455880	461820	J560 connector, and trying to change any of that might prove to be more expensive than anyone would
461820	468280	want to spend. So now you know a lot of the history about J2497 and why it came about, and why are we
468280	472900	sending these high-frequency signals on power lines, let's talk more about what it is, how it's
472900	481720	put together. You can think of J2497 like an alternate physical layer for J1708. And we're not
481720	486160	going to go into J1708 a lot because there's another talk that will give you lots of details on it.
486160	490840	Suffice it to say that it's a heavy vehicle network that predates J1939.
492500	501300	J2497 has its own arbitration scheme that it employs around J1708. The PLC for trucks 2497
501300	507140	is always 9600 bauds. And the way it takes these 1708 signals is it'll actually encode them into
507140	516060	spread spectrum chirps. So another way to think about 2497 is by an analogy. You can see a couple
516060	525800	analogies that I'm making here. J1939 is a lot like J1587. And J1939 can sit on top of high-speed
525800	534340	or low-speed canned buses, twisted or unshielded. So similarly can J1587 sit on top of either
535200	541380	J2497 or just J1708. And you'll probably have diagnostics or some other applications on top of
541380	547160	those. Which if you're not an automotive person, you can think of it by an analogy to DNS, which
547160	557120	is built on top of UDP. And UDP IP can run on either like Ethernet or 802.11 infrared, for example.
557740	564060	So let's talk a little bit more about these spread spectrum chirps. The specification of J2497 by
564060	570260	SAE actually includes a definition of the chirp. And they have to sweep from 200 to 400 kilohertz,
570260	576060	then from 400 to 100 kilohertz, and then from 100 to 203 kilohertz. You can see a picture here
576060	581380	of a rendering of a couple possible chirps. Different possibilities result by how you treat
581380	588440	these discontinuities here. The chirps themselves are about 100 microseconds total. They start and
588440	593480	end at value zero so that they can be concatenated. And when they're transmitted, they should be
593480	599180	transmitted in amplitude between 2.5 to 7 volts peak-to-peak, according to the spec. Now in practice
600580	604040	the transmitters on trailer equipment tend to send them even higher than
604040	609820	7 volts peak-to-peak, just to make sure that they'll make it from one end of the tractor-trailer
609820	617240	to the other. The chirps are put together into frame encodings that will let them actually send
617240	622720	J1708 frames. And the way the frames are encoded is broken up into a preamble and a body.
622720	628800	The purpose of the preamble is there to realize that alternate arbitration method, so that if
628800	633340	two PLC devices are trying to talk at the same time, there's a way to determine who has the
633340	639280	highest priority and which one should back off. It's very similar to CAN. It involves, you know,
639280	646220	that very first byte being sent and the lower byte is the higher priority. So here you can see
646220	655680	two renderings of frames, the first being OA00, the second being OBFF. The OA00 frame and the OBFF
655680	662080	frame are the ADS fault information that we talked about, the impetus for J2497.
662700	668260	So in the preamble, you can see that the messages, the actual chirps, have delays in between them.
668260	674240	And this is because the chirps are 100 microseconds, but the time for the symbols is 104
674240	681520	microseconds, these little gaps. In the preamble, the presence of the chirp indicates, you know,
681520	687760	the logic value. So logic 0 means chirp present, logic 1 is chirp absent. But then when you get
687760	696120	into the body, it's actually 100 microseconds with no gaps, and the encoding is actually
696120	703880	determined by phase. So this is phase shift keying in the body. The phase of logic 0 is arbitrary
703880	708320	per device, and it's actually given by the phase that's transmitted here in the amplitude shift
708320	715340	keying section. There's a checksum at the end, and then there's all these sync bits, you can see
715340	721480	in orange and in green. And some of these sizes are variable, so there could be one to two initial
721480	732840	symbols, and there could be zero to four gap symbols. So why is it like that? Well, J2497 was designed
732840	740220	for J1708. This whole PLC for trucks scheme was actually accomplished by a particular piece
740220	748760	of silicon, the Intelon SSC P485. And this particular chip was designed to take J1708 frames
748760	754720	and wrap them around with some extra information and re-encode them into these spread spectrum
754720	762440	chirps. So the Intelon P485 actually adds, you know, these sync bits and adds all the preamble
762440	769380	highlighted here in orange. It will then send, you know, the actual encoded information in chirps
769380	774780	as the body, which matches exactly what you would see on the J1708 line. And then it adds these
775400	781920	terminators with the gaps and the sync bits. So the checksum is actually part of J1708 and
781920	791420	part of J2497. And you can see there's a duplication of MIDs. You can think of MIDs
791420	798380	like arbitration IDs in CAN. It's that first byte. It determines arbitration on the bus and the data is
798380	807320	duplicated twice. It turns out that this information here in the preamble is used for arbitration of
807320	814520	the PLC bus only. And what gets sent on J1708 is this byte that's put right here, which means that
814520	820660	you can send things where those two don't equal each other and you can override priority. So you
820660	828040	could send a very low priority MID with an all zero PLC MID and it would margin on top of anyone
828040	835680	else that was talking on PLC. So a little bit about J1587. This is that next layer above. You
835680	842540	can think of it akin to J1939. If you look at the J1587 spec, there's a lot of really interesting
842540	847820	highlights. They say that you shouldn't send more than 21 bytes at a time unless the vehicle is
847820	853620	stationary. I wonder what happens if you don't. There's a factory test MID that should never be
853620	860320	sent by any vehicle system. There are bridging and forwarding schemes defined in the spec. There's a
860320	867320	dynamic address claim. There are cold and warm reset commands and lots of support for interesting
867320	871100	kind of peripherals on commercial vehicles like toll systems and display signage and
871100	877460	climate control. Now for some more details on how to decode J1587 automatically,
877460	885660	please see our team's presentation which should be up today or look at the pretty J1587 repository.
887140	892180	Even though J1587 defines a lot of interesting things that could be in there,
892180	897100	all we've seen in our testing for the most part is the ABS fault lamp on and off messages
897100	905580	and manufacturer diagnostic messages. There was a report by the FMCSA that suggested that
905580	913160	there should also be axleway yaw sensor and door latch sensor traffic on the PLC bus,
913160	923520	but we haven't run into it yet. So how do you connect to PLC? There are some great options
923520	930640	out there. The DG Technologies PLC TESCON is very rugged and reliable. I love mine.
931280	936380	There is also a NEXIC PLC adapter which has the advantage of being able to go in line
936380	944080	on a cable so you can test it in place. The problem with these sort of classic diagnostic
944080	950960	adapters is that they aren't cheap. You will need them for running manufacturer diagnostic tools
950960	956600	though. And also the Intelon P485 I'm told is becoming harder to source, which is not going
956600	962160	to help with the cost of these tools. Finally, the limitation of these tools is that you can't
962160	968740	do anything strange to PLC with these tools because they just have an Intelon P485 chip in them,
968740	976280	and so you can't make arbitrary PLC waveforms. For example, you can't do different PLC MID from
976280	985860	J1708 MID on the bus. So how do you interface with J1708 so that you can interface with PLC?
986160	994040	The first one up is another one of those RP1210 adapters such as the DGTEK DPA4, DPA5, or a NEXIC
994040	1002080	USB link. These things are necessary for the manufacturer diagnostics. An option that I
1002080	1007880	really like that's really cool that was presented here at DEF CON 24 is the TruckDuck, which is a
1007880	1016280	BeagleBone cape by 6Volt and Haystack. There's been some revisions to this board since the DEF
1016280	1023920	CON 24 presentation. There's the 1.5 EET version and the Mega version. These BeagleBone capes
1023920	1029140	enable communication with both J1939, or any CAN network actually, and J1708 networks through the
1029140	1035660	PiHV networks module that Haystack authored. And we are going to talk about some ways to use these
1035660	1043040	to write PLC. So our PLC writing tool, what we wanted was something that would be low cost. We
1043040	1048960	wanted it to be open. We wanted it to be capable of doing weird things. We weren't so concerned
1048960	1055800	about arbitration. The J1708 stack that Haystack put together for the TruckDuck originally
1055800	1060800	didn't have any arbitration. It just had frame detect and it works fairly well on systems that
1060800	1069460	aren't highly loaded. And we didn't want to worry about getting read in right now, and the reason
1069460	1074980	for that you'll see will be clear later. So our approach that we elected, mostly because we're
1074980	1080040	biased and we like the TruckDuck, is let's make some small mods to the TruckDuck and push them
1080040	1086900	upstream and try to stick with very small BOM changes and hopefully 6V can integrate those into
1086900	1096540	the next mega-mega-yeet version of the TruckDuck. So, bit banging PWM on the PRU. Bit banging is
1096540	1102780	the process of toggling a GPIO in order to create whatever protocol you're after. GPIOs are general
1102780	1108120	purpose input output pins, of which there are many on the BeagleBone. And the PRU is a programmable
1108120	1113460	real-time unit on the BeagleBone. It runs jitter-free, like deterministic code with no
1113460	1122380	interrupts stopping execution at 200 MHz, which is plenty for the 400 kHz-ish signal of PLC.
1122940	1128040	And also the PRU was used originally on the TruckDuck for the J1708 stack itself,
1128040	1133600	so there's already precedent there for using the PRU in this system.
1134200	1141200	It turns out that the TruckDuck J1708 channel 2 has pretty much been broken since release,
1141200	1147980	which is actually good for us because it lets us reuse, repurpose, one of the PRU cores for
1147980	1157500	the PLC application instead. And in trying to find pins, we needed to find one that we knew
1157500	1163020	we could bit bang from the PRU, which is a certain class of pins. But we also wanted to eventually
1163020	1169260	maybe get rid of the PRU if possible and use the integrated PWM unit in the BeagleBone, although
1169260	1175340	that hasn't been done yet. So trying to find the pin that would work was one of these fun
1175340	1180320	processes. I found it best to just do it with markers. We wanted to make sure that it could
1180320	1185260	be accessed from the PRU. It could migrate to PWM. We wanted to make sure it didn't conflict
1185260	1191600	with any other TruckDuck pins. So for synthesizing PLC, we settled eventually on P928. We had a
1191600	1200000	backup, and then we also planned for doing frame detect and PLC read via an ADC, but we haven't
1200000	1206400	implemented that. That's just kind of allocated for later. So in creating PLC signals, there's
1206400	1212300	two main parts. You have to synthesize this PLC with PWM, and then you have to couple this signal
1212300	1217280	that you've created onto the PLC network. So there's these two clouds that we're going to reveal.
1218820	1224020	I don't often do this, but I thought I would this time. I would try the dumbest thing first,
1224020	1228820	and my friends will tell you that I'm not very good at doing that, but I did it this time. The
1228820	1234620	first thing we tried was the dumbest PWM possible. You just turn it on when the signal that you're
1234620	1238520	trying to realize is above zero, and turn it off when the signal you're trying to realize is below
1238520	1243820	zero. So you can see that picture here. The orange waveform is the dumb PWM, and the blue waveform
1243820	1251120	is the true CHIRP, and it turns out that actually worked. So we said yay and moved on. The next part
1251120	1257100	was coupling, and you can see here in the DGTech PLC test con, the coupling network they created
1257100	1263940	is just gorgeous, and compared to what we were using, it is amazing because we found out that
1263940	1269820	100 nanofarad capacitor was enough, and that was our filtering as well. So the dumbest filtering
1269820	1276520	and the dumbest PWM got us what we needed, and we moved on. The results were pretty good,
1276520	1283180	actually. We did run into one issue with undocumented cycle counts for some of the
1283180	1288300	instructions that we we had to use in assembly, but the results were fine. You can see down here
1288300	1295580	the orange signal is a recording on an oscilloscope of the PLC signal that we synthesized after
1295580	1302740	filtering on a receiver. Same with the purple, this is just a larger zoomed out trace. So this
1302740	1308340	is post-filtering of the signal that we realized. The signal that we realized is much more like
1308340	1312780	these square waves up here in the tuning edge delays diagram, and this is just a representation
1312780	1317320	of how we had to tune some of the assembly instructions to make sure that the signal
1317320	1323180	would line up, you know, all the way into the realization like bit 54 of the PLC CHIRP train
1323180	1332220	that we had to create. So it worked pretty well. The code. You can get this tool. It's MIT-licensed.
1332620	1340520	It's available on GitHub as of today. What it does is it adds a new J1708 server.
1340520	1345820	That's the way that the 1708 was set up on the truck ducks, is they receive and send UDP frames
1346610	1353960	and will send or receive those onto J1708. What we did was create a whole new one that's
1353960	1361120	completely compatible, but what it does is send PLC signals instead. We also created some command
1361120	1367360	line utilities. The network, the Pi HV networks that Haystack created as a really nice programming
1367360	1372660	interface for Python, but I just like to have really simple command line tools like dump and
1372660	1378740	send. So we drafted those and they're compatible with the existing stack as well.
1380200	1386160	And so to get your truck ducks to connect to PLC, you actually do need to do some PCB
1386160	1390360	changes to your truck duck for now until 6V rolls us into the next revision.
1391180	1395620	And this led to probably one of my favorite kind of bodge jobs because I love to do
1395620	1401100	rework of PCBs and I also really like it when things have to be MacGyvered. When we were
1401100	1406900	connecting this up to PLC, we discovered that it would work when there was a really long length
1406900	1412420	of cable in between the power supply of the truck duck and the point where we were coupling to the
1412420	1416360	network. And if we didn't have that long piece of cable, the truck duck power supply just seemed to
1416360	1424180	attenuate the PLC signals to almost nothing, which led me to this great bodge job right here where I
1424180	1429100	wrapped 40 inches of wire and soldered that down to the board in between the input to the power
1429100	1437560	supply and the connector and that actually solved the problem, which is fun. Okay, so next up we're
1437560	1442220	going to show you how you can use some adapters to connect your truck duck up to the power lines.
1442220	1448460	There's a lot of different options. The first is this J560 to DB15 in Deutsch 2 pin.
1449000	1453660	So these DB15 connectors, you can find them in a lot of different diagnostics adapters,
1453660	1458520	the DPA4 and the truck duck both have them. This is a 560 connector here, which is useful to be
1458520	1462760	plugged into the back of your tractor. You can also plug into the back of your trailer if you
1462760	1467720	have an adapter to connect to the batteries up here on the Deutsch 2 pin and the whole set is
1467720	1475060	in the DG Tech PLC TESCON. Next up is these battery clip the DB15 adapters and these ones
1475060	1482020	can be found in the Nexic adapter sets on the internet. There's also these Y adapters for J560
1482700	1488520	where they give you a Deutsch 9 pin connector in line with two J560 connectors. So these can
1488520	1493300	be used like in line with a tractor and trailer that are connected. You got to watch out that
1493300	1500760	some of these actually do contain an Intelon P485 and what they're doing is converting PLC to J1708
1500760	1509600	and routing that to the J1708 pins instead of PLC onto the power pins. Another one that's useful
1509600	1514940	is one of these inline jack and plug which is very similar to the previous one. None of these have
1515900	1524820	the Intelon P485 inside them. You can also build your own umbilical so these J560 plugs you can
1524820	1530040	take them apart by removing the set screw and you can wire any kind of a pigtail you like. I like to
1530040	1534260	use these Deutsch 2 pins because they work with the DG Tech sets and then you can close it all
1534260	1540220	back up and you can have a connector that can be used with a tractor and trailer connected.
1541480	1548780	So we also created a PLC reading tool and Chris Poore is going to tell you some more details
1548780	1557060	about that. Chris? Thanks Ben. One of our goals was to develop a low-cost tool for reading J2497
1557060	1564080	messages with SDRs and open source software. We wanted a solution to let just about anybody tap
1564080	1575910	into a line and see messages all for little cost. Next slide please. Again the J2497 signals
1575910	1583070	primarily consist of a series of 100 microsecond chirps that start at 203 kilohertz, ramp up to
1583070	1591870	400 kilohertz, quickly drop down to 100 kilohertz, and back to 203 kilohertz. The 100 to 400 kilohertz
1591870	1599310	frequency range is lower than most SDRs can handle. For example, the starting frequency of
1599310	1607910	the RTL2832U dongles vary depending on the model, but they can range from 500 kilohertz to around
1607910	1619970	50 megahertz. Next slide please. To get around this problem we used up converters. The Hammet
1619970	1626730	up-up converter will take our signal and mix it with an intermediate frequency of 125 megahertz.
1626730	1635670	I believe the SPIverter uses 120 megahertz. Once it's near 125 megahertz we can receive it with
1635670	1642210	our radios and begin to condition the signal in software. We improved the quality of the signal
1642210	1650990	if we didn't tune our radio directly on 125 megahertz but instead at 126. This allowed us to
1650990	1656610	use a bandpass filter to get rid of a lot of the DC noise associated with the Hammet up.
1657350	1659230	Next slide please.
1661270	1667210	We achieved most of our success with an RTL and a Hammet up, but there are solutions out there
1667210	1673570	that could be promising that don't use up converters. We tried the Lime SDR which starts
1673570	1680190	at 100 kilohertz, but the gain and performance down at those frequencies was too low for us.
1680190	1686700	You can find schematics online for modifying RTL SDRs to get a lower starting frequency.
1687170	1692850	They also make some that have a direct receive mode that can tune down to 500 kilohertz,
1692850	1697670	but they say the performance is reduced when operating them there.
1699070	1704010	The AirSpy HF Plus is supposed to start at 9 kilohertz,
1704010	1709430	but it might not have the bandwidth to support the J2497 chirps.
1710550	1715550	You might have some luck with oscilloscopes, but then the price starts to go up.
1715630	1720770	The ADOM2000 is a cheaper option you might want to consider.
1722270	1730790	Next slide, please. Back to our setup. When tapped to the line, we used a coupling adapter
1730790	1738410	to remove the 12 volt DC offset that exists. This was to be on the safe side and avoid any chance
1738410	1747170	of damaging our up converter. Next, the output of the up converter went to the RTL SDR and was
1747170	1753810	sampled and filtered in GNU Radio, producing a J1708 looking message like you see in the bottom
1753810	1762590	right. Note how the preamble has visible silent periods and the body is the continuous section
1762590	1768510	at the end of the message. Next slide, please.
1770580	1775350	We developed three methods for demodulating those signals into bits.
1775350	1781770	One method examines the instantaneous frequency. The other two rely on correlating the signal
1781770	1789430	with specific sequences. I'll go over them in the next few slides. Next slide, please.
1791410	1797810	Our first attempts took advantage of GNU Radio's quadrature demod block to produce the plot you see
1797810	1804190	in the bottom right. The sawtooth pattern you see down there represents the frequency over time for
1804190	1811270	chirps in the body of the message. The circled spikes indicate sudden changes in phase at the
1811270	1818910	start of a new chirp. This is what we use to distinguish the ones and zeros. No change in
1818910	1826710	phase means keeps the value of the previous bit, while phase change means flip the bit.
1826950	1832550	We framed the start and stop of each message based on the amplitude and tried to ignore the
1832550	1839770	preamble sections of each message since the body contains the whole J1708 message anyway.
1840610	1842850	Next slide, please.
1844500	1850490	We started developing alternative methods because the previous one did not work well with noise
1850490	1856510	and relied heavily on a consistent signal amplitude. So to get around that, we correlated
1856510	1864250	the signal with a 203 kilohertz reference. Now, 203 kilohertz is the precise frequency where each
1864250	1871290	chirp begins. If there's no phase change, there's a smooth 203 kilohertz signal, which are the higher
1871290	1878230	peaks you see in the output down there. However, when there's a phase change present, the frequency
1878230	1884130	gets disrupted for a short period of time. It results in a value close to zero when correlated
1884130	1889970	with the reference. That's why you kind of see those mini spikes where it's ramping up and down
1889970	1895870	as it approaches the location where 203 kilohertz should be in the chirp.
1896810	1901030	Likewise, anything outside the message, like the noise, is going to be reduced
1901790	1908950	to a value close to zero. We use a moving average filter on the correlation output
1908950	1915490	to frame the message and ignore the preamble part of it. Next slide, please.
1918250	1922870	Now, for situations where the signal is completely buried in the noise,
1922870	1929610	the previous two methods are not very effective. Instead, we tried a new method which begins by
1929610	1936510	correlating the signal with a python-generated chirp designed to mimic a real one. The result
1936510	1942550	produces much larger peaks, like you see down there, which helps distinguish it from the noise.
1942850	1949110	We use this technique to frame the message and reuse the 203 kilohertz reference in the previous
1949110	1955450	method to distinguish the ones and zeros. Next slide, please.
1956990	1965390	We call it all GRJ2497. It contains the blocks and flow graphs that will read the traffic and
1965390	1971650	print out messages like what you see on the right. The values for the MID, data, and checksum
1971650	1978490	are pulled right from the messages. Additionally, there is an option built into the blocks to send
1978490	1987270	the messages in hex over to a UDP port for other potential tools to use. Now, back to Ben to continue
1987270	1995030	on. Thanks, Chris. So, you've got G&E radio and you can now read your PLC signals, but how do you
1995030	2003550	connect your Hammet up or some direct receiver onto PLC? Turns out, once again, just 100
2003550	2009050	nanofarad capacitor is going to do the trick. I have used and like to use the 100 volt ones just
2009050	2014050	to be safe because we don't really want to get battery currents connected to our receivers.
2014510	2020930	And then you just need a way to connect those PLC wires onto this coupling network. So, all of those
2020930	2026030	previous adapters that we talked about all apply in this case. But then, how do you connect the
2026030	2031410	wires up? And I think one of the nice solutions we came up with is modifying these Valon 1.9
2031410	2038330	adapters. So, you can actually take the transformer off of the board and cut the trace right here at
2038330	2046390	the back, replace that transformer with a surface mount capacitor, bridge the ground here, and then
2046390	2053060	cover it all with solder resist to avoid ever touching 12 volt battery currents for trucks.
2054390	2060150	Another one that's an adapter that works is an antenna. You actually can read these signals
2060150	2066570	wirelessly. We experimented with a whole bunch of different antennas, but we found that this
2066570	2073190	form of active antenna, pictured here, works pretty good and is pretty darn cheap. The power
2073190	2080690	supply that's here is fine, but it works well as well if you connect a 9 volt battery to it instead.
2080770	2085310	And we believe that there's a lot more options out there because really anything that's made
2085310	2092250	for 2200 meters or low FER is in the right band. But we stuck with portable options because a lot
2092250	2097210	low FER and 2200 meter stuff is giant masts and you're not going to move that around with you,
2097210	2103350	but there are loops and whips and mini-whips. But really, if you just want to do quick and dirty,
2103350	2109110	these mini-whips work really great for the price. Over here you can actually see, you know, we're
2109110	2116130	receiving a pretty clear PLC signal on top of the background noise using just this mini-whip taped
2116130	2121970	to the side of a box next to a truck. So, we're able to read these signals wirelessly, but
2122250	2129630	how far? In our testing, we can reliably receive six feet away from a position next to the gap
2129630	2135850	between the tractor and the trailer. Now, this was using our first version of the GNU radio receiver,
2135850	2140790	the one that does the phase measurements and not the new cool stuff that Chris talked about
2140790	2149730	with correlation. So, we feel pretty confident this can be extended. We don't know how far and,
2149730	2157050	we're going to find out. Why do we think this works? It's a bit strange because, you know,
2157050	2163490	these trailers, or maybe the long ones that we were testing on, were 40 feet. And a half-wave
2164530	2172230	resonator at 40 feet is really only 12 megahertz, which is way, way above the 400 kilohertz top end
2172230	2179030	of the PLC for trucks. So, it really shouldn't be a good radiator. But when we tested it,
2179030	2186250	certainly is good enough at this point. And we think that may be a combination of factors,
2186250	2192590	but possibly primarily due to that very large voltage that they transmit, that these devices
2192590	2196830	transmit at, to make sure they can make it across the whole range of the tractor and the trailer.
2199110	2205570	So, yeah, the long wires, the high transmit voltages, I think also contributing this is
2205570	2213630	maybe PLC transmitters are actually left alone to be noisy. The spec for J2497 allows any conducted
2213630	2222770	noise to be beyond any other restrictions. And then also FCC's regulations on unintentional
2222770	2229090	radiators actually exempt vehicles, any digital device utilized exclusively in any transportation
2229090	2236130	vehicle from the unintended radiator status. Now, they do still have to turn off if they're found
2236130	2240970	to be in violation, but it's hard to understand how that could be enforced with a large moving
2240970	2247990	vehicle. So, it seems like maybe these are radiators that are beyond spec and no one's
2247990	2255830	been testing for them because they're exempt or because it's in spec. There are some impacts to
2255830	2260110	this, but the good news is the impacts aren't very large. It's really a minor impact.
2260370	2265890	On trailers, as we mentioned, really the main traffic is just the ABS fault information.
2266630	2272790	And if that's the only information that's being disclosed by these radiators on a remote read,
2272790	2279970	then you're not really losing confidentiality much. Now, if you are a fleet that's deploying
2279970	2288490	other technologies like way axles or maybe even your door sensors, any canvassing technology in
2288490	2292650	the trailer, this kind of stuff might be more confidential. You wouldn't want to have it
2292650	2298150	disclosed. In terms of the impact in other technologies, other applications of the Intel
2298150	2305290	on P485, we don't really know. Now, one of the reasons we wanted to do this talk is that there
2305290	2311410	are future impacts that really matter. The ATATMC is working on putting together a new
2311410	2317250	next generation tractor-trailer interface, and one of the propositions include exchanging keys
2317250	2325170	over PLC. Not that you can't do key exchange without guarantees of confidentiality, but we just
2325170	2330630	want everyone designing those systems to be aware of the fact that you can't assume that what you
2330630	2336590	exchange over these buses will be confidential. So, it could be a problem if it's not implemented
2336590	2341130	correctly. And then, as we mentioned at the beginning of the presentation, this is not unique
2341130	2346830	to PLC for trucks. This behavior is present in other powerline technologies, and we encourage
2346830	2351750	you to look at the work of Baker and Martinovic, who showed that this happens in plug-in electric
2351750	2358630	vehicle chargers. Now, what can we do about it? Presently, there's not a whole lot you could do
2358630	2363430	on existing trailers, because we think that really it's these long wires and the high voltage levels
2363430	2370870	that are contributing to this. But for the future, there is something you could do. You also should,
2370870	2375630	if you're a fleet, consider what kind of information is flowing on your trailers. If you are using
2375630	2382410	airway, if you are using door sensors or canvassing systems, you might want to be aware that that kind
2382410	2386930	of information can't be considered confidential when your trucks are rolling down the road.
2387510	2392570	You also should be aware if your maintenance departments configure your trailer ECUs to do
2392570	2397270	any streaming of readings, which is possible on several of the manufacturers, where you can
2397270	2402570	configure them to continuously stream wheel speed readings or temperature or voltage readings. Those
2402570	2408010	wouldn't be considered confidential anymore on those buses. But for the future, when they're
2408010	2412970	designing the next tractor-trailer interface, I think the main mitigation that needs to be taken
2412970	2419650	into place is reducing those emissions. And that should be able to be achieved by using PLC
2419650	2427050	on power lines only between the connections where those J560 connectors are. We recognize that the
2427050	2432590	J560 connector is not going anywhere. It's going to be too expensive to try to get fleets to move
2432590	2439570	off of it. So if we only use PLC in between the J560 connectors, that should reduce the radiated
2439570	2446270	emissions. If we only use it in between those J560 connectors, it also affords designers the
2446270	2451910	opportunity to use lower transmit voltages because the signals don't have to reach
2452770	2458730	across the entire tractor-trailer or multiple, especially multiple trailers in tandem.
2460210	2467210	So this issue has, throughout the process, has been disclosed to various parties over the past
2467210	2471150	eight months or so. We've been in contact with trailer equipment manufacturers, all three of the
2471150	2477370	major ones. We have reached out to all the trailer builders. Only one of them responded to us.
2477610	2484130	We have coordinated disclosure with NMFTA members and our sponsors. We've also done it with what
2484130	2490110	was previously ICS CERT, who now wants to be called the CISA Vulnerability Disclosure Program.
2490530	2495370	And they themselves also reached out to the trailer builders that didn't respond to us.
2496120	2506730	At this time, CISA BDP has assigned CVE-2020-14514, and there is a advisory on this issue of trailer
2506730	2513690	powerline communications to raise awareness forthcoming. So in terms of future work, it's
2513690	2519190	kind of got two different directions. I know our AIS friends here do a lot of industrial control
2519190	2523510	systems work, and they're very interested in looking at applications of the same method to
2523510	2528110	various other powerline communication technologies, some of them listed here.
2528330	2533990	On the transportation side, very much would like to improve those truck duct features,
2533990	2540910	you know, get some PLC read going, maybe use the PWM unit instead. I recognize that those
2540910	2545430	DC blocks could be implemented differently, maybe capacitive coupling on one side of the
2545430	2551110	transformer instead of removing the transformer. Also, the new Balin-19s have really great screw
2551110	2556610	terminals, so you could have a much more rugged connection to the powerline. We also would like
2556610	2562850	to take Chris's receiver code and figure out just how far the reception can be done reasonably using
2562850	2567090	one of these cheap active antennas, and maybe some of the other more fancy active antennas
2567090	2572530	that we've bought since then. And then there's also looking at the other places where you find
2572530	2579730	PLC. We're told that PLC is also used in intramodal, which is where people take containers and put
2579730	2585550	those on top of flat cars or put them on top of trailers on the road as well. So we'd like to have
2585650	2591850	a look at how PLC integrates in that space. And there's also this thing, which should be really
2591850	2597190	fun to look at. Someone took a trailer brake controller and of course added Wi-Fi to it,
2597190	2602050	because that's a great idea. If anyone wants to have fun with a trailer brake controller,
2602890	2609390	check this one out. But also at the Car Hacking Village, we have two brake controllers
2609390	2613630	hooked up to pressured air. I'll tell you about that a little more in a minute.
2614350	2620750	So yeah, in summary, in conclusion, we got you two tools. There's PLC for TruckDuck,
2620750	2627030	which enables you to write to PLC using 1-bit PLC chirps that we did with bit banging.
2627030	2631650	You can make an arbitrary waveform, you know, you can have different PLC MIDs than you do for
2631650	2637790	the J1708 payloads. Everything we put together is compatible with Haystack's PyHV Networks modules.
2638370	2644370	There's also the ability to read PLC traffic remotely. And this is tracked also internally
2644370	2654390	as ICSVU-227452, and I gave you the CVE earlier. And the GR-J2497 tool that Chris told you all
2654390	2662350	about, he is capable of receiving this traffic at a distance of six feet. And also that GR-2497
2662350	2667890	tool is itself compatible with the PyHV Networks modules from Haystack. So this is what I was
2667890	2673670	trying to tell you about. We actually have a couple trailer brake controllers turned upside down,
2673670	2680450	and we've connected Nerf dart firing cactuses to the exhaust ports on the bottom, and we're
2680450	2686250	running pressurized air on them so that if you can figure out how to do a valve test or do an
2686250	2691390	ECU reset on one of these things, it should push air through that exhaust port, and you should
2691390	2696630	fire those Nerf darts. And they're connected up on the Virtual Car Hacking Builder system,
2696630	2701410	so there's a Twitch stream and remote logins to the shells. We do hope that you log in and
2701410	2707990	have a try, and maybe if you get familiar with them, have a try at that Wi-Fi trailer unit.
2707990	2715750	I know I'd like to someday, too. What we did here was, you know, not the result of just
2715750	2720450	Chris and I's effort, but really the result of a lot of people committing a lot of resources
2720450	2725330	and assistance over the past few months, and I really want to take an opportunity to put all
2725330	2730050	their names up here and thank them. Really, this wouldn't be possible without, you know,
2730050	2736010	support of a team and a community, and I feel really lucky to be a part of both.
2736010	2741110	So thank you very much for your time. I'll be over in chat with Chris,
2741110	2745430	hopefully answering any questions you have, and I'll see you at the Virtual Car Hacking Village
2745430	2747270	later. Bye!