1 00:00:00,207 --> 00:00:02,463 - All right, so to start this off officially, 2 00:00:08,160 --> 00:00:10,830 Ben Gardner and Chris Poore are here to talk 3 00:00:10,830 --> 00:00:12,240 to you about trailer shouting. 4 00:00:12,240 --> 00:00:14,290 Please help me welcome them to the stage. 5 00:00:19,429 --> 00:00:20,487 - Thanks everybody. 6 00:00:21,561 --> 00:00:23,461 - [Man] Also, waters are here for you guys. 7 00:00:23,461 --> 00:00:25,380 - That's going to be needed. Thank you very much. 8 00:00:25,380 --> 00:00:27,360 So, yeah, Chris and I are here to talk 9 00:00:27,360 --> 00:00:29,550 to you about some research that we have done 10 00:00:29,550 --> 00:00:32,430 together with NMFTA and AIS. 11 00:00:32,430 --> 00:00:35,614 Should be 45 minutes. I hope we are going to end. 12 00:00:35,614 --> 00:00:37,470 It's definitely gonna be 45 minutes. 13 00:00:37,470 --> 00:00:38,910 We are gonna end with a demo video. 14 00:00:38,910 --> 00:00:42,180 So they said that actually trying to do this remote 15 00:00:42,180 --> 00:00:44,850 induction attack on stage in this RF environment 16 00:00:44,850 --> 00:00:46,110 was a bad idea. 17 00:00:46,110 --> 00:00:48,503 You're probably right. So you'll see a video instead. 18 00:00:49,349 --> 00:00:50,820 First about us. 19 00:00:50,820 --> 00:00:51,870 I'm Ben Gardner 20 00:00:51,870 --> 00:00:54,300 with the National Motor Freight Traffic Association. 21 00:00:54,300 --> 00:00:56,310 I'm a cyber security research engineer there. 22 00:00:56,310 --> 00:00:59,280 I have a career in reverse engineering 23 00:00:59,280 --> 00:01:00,960 and embedded systems development, 24 00:01:00,960 --> 00:01:02,640 and I like to volunteer at various things. 25 00:01:02,640 --> 00:01:04,980 And I've had the pleasure of being an instructor 26 00:01:04,980 --> 00:01:07,950 at the cyber truck challenge for every year. 27 00:01:07,950 --> 00:01:09,960 And this is Chris Poore. 28 00:01:09,960 --> 00:01:11,140 - Hi, I'm Chris Poore 29 00:01:11,140 --> 00:01:13,230 and I'm a senior reverse engineer 30 00:01:13,230 --> 00:01:15,540 at Assured Information Security. 31 00:01:15,540 --> 00:01:16,920 My company does a lot of things, 32 00:01:16,920 --> 00:01:19,800 but one of them is work with people like Ben here 33 00:01:19,800 --> 00:01:21,990 to find vulnerabilities and come up 34 00:01:21,990 --> 00:01:23,913 with me mitigations for those. 35 00:01:24,870 --> 00:01:27,420 You may see me yesterday at the demo labs showing 36 00:01:27,420 --> 00:01:29,970 off Fissure, the RF framework. 37 00:01:29,970 --> 00:01:32,130 Some of the tools in this talk are included 38 00:01:32,130 --> 00:01:33,840 with that software, so check it out 39 00:01:33,840 --> 00:01:36,240 at my companies Github page if you get a chance. 40 00:01:39,030 --> 00:01:41,700 - And it goes without saying that Chris 41 00:01:41,700 --> 00:01:43,560 and I are just the lucky two people that are up here 42 00:01:43,560 --> 00:01:45,810 on stage we're, we're part of a much larger team. 43 00:01:45,810 --> 00:01:48,030 I actually see one of them in the audience. 44 00:01:48,030 --> 00:01:52,230 So Dan Salone right there, Eric, there is on our team. 45 00:01:52,230 --> 00:01:54,510 We had some anonymous people as well, help us out. 46 00:01:54,510 --> 00:01:55,410 And of course, 47 00:01:55,410 --> 00:01:57,270 what we've done would not have been possible 48 00:01:57,270 --> 00:01:58,800 without the member fleets. 49 00:01:58,800 --> 00:02:01,320 The people that own the trucks that our members 50 00:02:01,320 --> 00:02:03,483 of the NMFTA so big thanks to them. 51 00:02:05,070 --> 00:02:08,130 So we're here to tell you about an issue with J24-97, 52 00:02:08,130 --> 00:02:11,370 also known as PLC4Trucks and for you 53 00:02:11,370 --> 00:02:13,511 to understand the issue, you have to know 54 00:02:13,511 --> 00:02:14,640 what is this PLC4Trucks? 55 00:02:14,640 --> 00:02:16,770 The PLC that we're talking about 56 00:02:16,770 --> 00:02:19,170 is not programmable logic controllers. 57 00:02:19,170 --> 00:02:22,380 It's the other PLC it's power line communications. 58 00:02:22,380 --> 00:02:24,810 This technology dates all the way back to the 1950s 59 00:02:24,810 --> 00:02:27,060 when it was introduced as ripple control 60 00:02:27,060 --> 00:02:30,220 and has been applied all over the place since then. 61 00:02:30,220 --> 00:02:32,790 You can see a chart here from Xavier Carcelle 62 00:02:32,790 --> 00:02:34,200 that has a survey of a bunch 63 00:02:34,200 --> 00:02:36,396 of different types of technologies. 64 00:02:36,396 --> 00:02:39,060 Today, you might be most familiar 65 00:02:39,060 --> 00:02:42,600 with power line carrier when you're dealing with HomePlug, 66 00:02:42,600 --> 00:02:45,120 if you have ever installed ethernet adapters 67 00:02:45,120 --> 00:02:47,280 that plug into your AC main 68 00:02:47,280 --> 00:02:48,780 and they extend your ethernet network, 69 00:02:48,780 --> 00:02:50,190 that's HomePlug. 70 00:02:50,190 --> 00:02:53,040 HomePlug is also found in the combined charging system 71 00:02:53,040 --> 00:02:54,690 for plug-in electric vehicles. 72 00:02:54,690 --> 00:02:57,870 And that's a reduced subset called HomePlug GreenPhy. 73 00:02:57,870 --> 00:03:00,180 That technology is actually produced originally 74 00:03:00,180 --> 00:03:03,780 by Intelon which was bought then by Atheros 75 00:03:03,780 --> 00:03:05,850 and then was bought by Qualcomm. 76 00:03:05,850 --> 00:03:07,710 And you can see there's a whole bunch of Intellon 77 00:03:07,710 --> 00:03:11,610 in this power line carrier chart from Xavier Carcelle. 78 00:03:11,610 --> 00:03:12,810 This talk though is really 79 00:03:12,810 --> 00:03:15,030 about a different Intellon technology. 80 00:03:15,030 --> 00:03:18,240 They made it in the SSCP-485 81 00:03:18,240 --> 00:03:21,150 and PLC4Trucks has been around for 30 years. 82 00:03:21,150 --> 00:03:23,220 So it kind of fits into the chart right there. 83 00:03:23,220 --> 00:03:26,370 It has some similarities with the CE Bus technology 84 00:03:26,370 --> 00:03:28,350 that you can see pictured. 85 00:03:28,350 --> 00:03:29,520 Similar frequency ranges, 86 00:03:29,520 --> 00:03:32,190 but the signaling is slightly different. 87 00:03:32,190 --> 00:03:35,970 And this talk is not about HPGP or HomePlug, 88 00:03:35,970 --> 00:03:38,523 it's about this weird PLC4Trucks technology. 89 00:03:39,960 --> 00:03:44,190 The reason we have it is actually that you needed 90 00:03:44,190 --> 00:03:46,920 to send trailer fault data from the trailer up 91 00:03:46,920 --> 00:03:49,800 into the tractor and the fleets wouldn't accept 92 00:03:49,800 --> 00:03:50,910 any more connectors. 93 00:03:50,910 --> 00:03:52,860 So they added Power Line Carrier 94 00:03:52,860 --> 00:03:54,990 onto the existing 12 volt line to send 95 00:03:54,990 --> 00:03:56,313 that data over to you, 96 00:03:58,097 --> 00:04:00,210 PLC4Trucks was implemented 97 00:04:00,210 --> 00:04:02,940 as a spread spectrum technology. 98 00:04:02,940 --> 00:04:05,670 You can see we're showing you where it sits in the spectrum, 99 00:04:05,670 --> 00:04:07,650 which is down in the a hundred to 400 kilohertz range. 100 00:04:07,650 --> 00:04:08,820 It's much wider than a lot 101 00:04:08,820 --> 00:04:10,350 of the other power line carrier technologies 102 00:04:10,350 --> 00:04:11,880 that are out there. 103 00:04:11,880 --> 00:04:15,000 It was developed to be sort of a bridge for UART. 104 00:04:15,000 --> 00:04:18,510 So as an analogy, when you bridge ethernet, 105 00:04:18,510 --> 00:04:20,340 you're obviously putting ethernet power lines. 106 00:04:20,340 --> 00:04:24,540 This technology is like you UART over power lines on trucks. 107 00:04:24,540 --> 00:04:27,240 The chirps go up and down in frequency, 108 00:04:27,240 --> 00:04:31,890 and they last about 400 microseconds each, 109 00:04:31,890 --> 00:04:34,650 but they get put together into larger millisecond messages. 110 00:04:34,650 --> 00:04:35,880 And if you see it on your spectrum spectrogram, 111 00:04:35,880 --> 00:04:38,130 you might see these horizontal lines 112 00:04:38,130 --> 00:04:40,200 because it's a spread spectrum technology that's short 113 00:04:40,200 --> 00:04:42,960 in time, and that's a waterfall plot there 114 00:04:42,960 --> 00:04:44,610 on top of that chart, 115 00:04:44,610 --> 00:04:46,830 the signaling is actually pretty clever. 116 00:04:46,830 --> 00:04:49,830 It has a different preamble and a different body. 117 00:04:49,830 --> 00:04:52,110 In the preamble, it uses amplitude shift keying, 118 00:04:52,110 --> 00:04:55,680 and then it switches over to phase shift keying in the body, 119 00:04:55,680 --> 00:04:58,950 using the same chirps with slightly different timings. 120 00:04:58,950 --> 00:05:00,990 And there's a lot of kind of interesting design decisions 121 00:05:00,990 --> 00:05:02,520 that are put in here. 122 00:05:02,520 --> 00:05:05,400 And most of them were made for this reason. 123 00:05:05,400 --> 00:05:07,770 To make it wire compatible with the technology 124 00:05:07,770 --> 00:05:09,873 that predates it called J1708. 125 00:05:12,851 --> 00:05:14,910 So they made this chip, the SSC P485. 126 00:05:14,910 --> 00:05:16,260 That's a bidirectional bridge. 127 00:05:16,260 --> 00:05:18,090 If it receives 1708 messages, 128 00:05:18,090 --> 00:05:20,789 it wraps them in additional information for the preamble 129 00:05:20,789 --> 00:05:23,578 and these signalings that you can kind of see highlighted 130 00:05:23,578 --> 00:05:26,100 on the outsides of the message on the bottom here. 131 00:05:26,100 --> 00:05:28,500 And if it receives that on power line, it does the reverse, 132 00:05:28,500 --> 00:05:30,840 it creates the J1708 message in response. 133 00:05:30,840 --> 00:05:33,300 So it's this bidirectional transparent link 134 00:05:33,300 --> 00:05:36,630 that kind of bridges the J1708 UART technology 135 00:05:36,630 --> 00:05:37,623 over power line. 136 00:05:39,120 --> 00:05:42,330 So another J standard that you need to understand, sorry, 137 00:05:42,330 --> 00:05:44,193 it's J1708, what is this thing? 138 00:05:45,090 --> 00:05:47,220 1708 predates J1939, 139 00:05:47,220 --> 00:05:49,680 which would be the normal way that you would deal 140 00:05:49,680 --> 00:05:52,860 with communications on trucks today. 141 00:05:52,860 --> 00:05:55,080 J1708 was introduced for really the same reason 142 00:05:55,080 --> 00:05:58,260 that CAN was introduced, it's to move time varying signals 143 00:05:58,260 --> 00:05:59,310 around the vehicle. 144 00:05:59,310 --> 00:06:01,470 So they would pack the data into small fields 145 00:06:01,470 --> 00:06:02,850 and move them in smaller frames. 146 00:06:02,850 --> 00:06:04,830 So they could have just two wires instead 147 00:06:04,830 --> 00:06:07,200 of one wire per signal, right. 148 00:06:07,200 --> 00:06:11,400 So a lot of 1708 is actually encoded in J1587 messages, 149 00:06:11,400 --> 00:06:13,230 which is like the application layer 150 00:06:13,230 --> 00:06:16,200 that defines exactly how everything is packed together. 151 00:06:16,200 --> 00:06:19,470 So by an analogy you can kind of think of J1587 152 00:06:19,470 --> 00:06:22,770 as the data standard like J1939 is, 153 00:06:22,770 --> 00:06:24,510 on top of CAN, 154 00:06:24,510 --> 00:06:29,100 but here you can put J1587 on top of J2497, 155 00:06:29,100 --> 00:06:30,750 or you can put it on top of J1708. 156 00:06:30,750 --> 00:06:35,423 So 2497 is just like an alternative transport for J1587. 157 00:06:36,720 --> 00:06:40,380 Now 1587 has more than just the time during messages 158 00:06:40,380 --> 00:06:43,710 that it was intended for during mission time. 159 00:06:43,710 --> 00:06:45,870 All the diagnostics are put in there also, 160 00:06:45,870 --> 00:06:47,670 and there's data link escape messages 161 00:06:47,670 --> 00:06:50,170 that people use for doing their diagnostics 162 00:06:51,060 --> 00:06:53,010 and 2487 adds one other thing, 163 00:06:53,010 --> 00:06:56,790 which is dynamic address claim for the MIDs, 164 00:06:56,790 --> 00:06:58,350 which makes it a little bit different. 165 00:06:58,350 --> 00:07:03,180 So that's kind of our crash course on J2497 and J1708. 166 00:07:03,180 --> 00:07:05,820 There is a lot of other details in the previous talks 167 00:07:05,820 --> 00:07:07,560 that Chris and I have done as well as 168 00:07:07,560 --> 00:07:09,908 in Dan Sloan's talk on 1708 that you can find 169 00:07:09,908 --> 00:07:11,883 on the media server. 170 00:07:13,410 --> 00:07:16,260 So this technology was introduced, as I said, 171 00:07:16,260 --> 00:07:19,470 to move the fault information from the trailer 172 00:07:19,470 --> 00:07:21,210 to the tractor, 173 00:07:21,210 --> 00:07:24,690 but it didn't come without a little bit of funny business. 174 00:07:24,690 --> 00:07:26,040 And we'll talk to you about the patents 175 00:07:26,040 --> 00:07:28,533 that surround this technology. 176 00:07:29,927 --> 00:07:31,500 Back in the 1990s, 177 00:07:31,500 --> 00:07:34,020 NHTSA had been telling the fleet for some time 178 00:07:34,020 --> 00:07:36,030 that they were gonna require 179 00:07:36,030 --> 00:07:38,640 that the trailer fault information was displayed 180 00:07:38,640 --> 00:07:42,093 on the dash of the truck and they knew this was coming. 181 00:07:42,960 --> 00:07:45,501 And so the industry actually worked together 182 00:07:45,501 --> 00:07:47,640 to select how they would do this 183 00:07:47,640 --> 00:07:48,870 without adding another connector, 184 00:07:48,870 --> 00:07:50,370 because the fleet said they couldn't have 185 00:07:50,370 --> 00:07:53,340 another connector added between the tractor and the trailer. 186 00:07:53,340 --> 00:07:55,470 And they actually settled on this technology PLC4Trucks. 187 00:07:55,470 --> 00:07:58,350 And you can see the quote here that it was selected 188 00:07:58,350 --> 00:08:01,893 because it was generic and wouldn't have any licensing, 189 00:08:03,201 --> 00:08:07,710 but surprise, unfortunately, the next year, 190 00:08:07,710 --> 00:08:09,897 SAE actually withdrew its blessing of J2497, 191 00:08:09,897 --> 00:08:13,410 because there was someone that was in the meetings 192 00:08:13,410 --> 00:08:15,600 and filing patents around what they had been hearing 193 00:08:15,600 --> 00:08:17,650 in the development of these technologies. 194 00:08:19,620 --> 00:08:23,370 So eventually what happened is everyone that was involved 195 00:08:23,370 --> 00:08:25,980 did end up paying licensing fees to the individual 196 00:08:25,980 --> 00:08:27,120 that held the patent, 197 00:08:27,120 --> 00:08:29,340 including the company that bought his company 198 00:08:29,340 --> 00:08:31,650 since the licensing had to be done to the individual. 199 00:08:31,650 --> 00:08:33,990 And that was a bit of a surprise too. 200 00:08:33,990 --> 00:08:38,990 And SAE did eventually issue the draft anyways for J2497, 201 00:08:39,090 --> 00:08:40,830 despite the patents. 202 00:08:40,830 --> 00:08:42,750 I was told that at one meeting, 203 00:08:42,750 --> 00:08:46,050 this individual walked in and was given an award for J2497 204 00:08:46,050 --> 00:08:49,170 and then asked to leave the room, which is kind of funny. 205 00:08:49,170 --> 00:08:51,030 And this also, this part is disputed, 206 00:08:51,030 --> 00:08:53,040 but I've also been told that the reason we read 207 00:08:53,040 --> 00:08:54,690 those IP disclosure and patent statements, 208 00:08:54,690 --> 00:08:56,970 and I see some SAE people in the room, 209 00:08:56,970 --> 00:08:58,290 we read those every single time 210 00:08:58,290 --> 00:09:01,293 because of what happened with J2497. 211 00:09:03,270 --> 00:09:06,510 So let me tell you a little bit about what we've discovered 212 00:09:06,510 --> 00:09:08,190 now that you know what this technology is. 213 00:09:08,190 --> 00:09:10,140 Previously, Chris and I in 2019, 214 00:09:10,140 --> 00:09:12,960 we told everyone that you can read 2497 215 00:09:12,960 --> 00:09:14,550 from a distance of about six to eight feet 216 00:09:14,550 --> 00:09:16,200 with active antennas. 217 00:09:16,200 --> 00:09:18,570 Since then Chris has improved some of the receiver antennas 218 00:09:18,570 --> 00:09:20,400 and got those green ones working. 219 00:09:20,400 --> 00:09:22,500 And I hope you tell people about the other thing 220 00:09:22,500 --> 00:09:23,333 down the road. 221 00:09:24,240 --> 00:09:26,280 Today, we're happy to tell you that 222 00:09:26,280 --> 00:09:29,130 not only can you read this traffic, 223 00:09:29,130 --> 00:09:30,510 you can also write it. 224 00:09:30,510 --> 00:09:31,960 So it's possible to write it. 225 00:09:33,138 --> 00:09:34,890 The distances and the powers involved vary. 226 00:09:34,890 --> 00:09:36,833 And I'll tell you a little bit about that. 227 00:09:37,890 --> 00:09:40,710 When we were dealing with CISA to get the CVE allocated 228 00:09:40,710 --> 00:09:42,600 and to do this disclosure process, 229 00:09:42,600 --> 00:09:44,670 one of the things that was kind of difficult 230 00:09:44,670 --> 00:09:48,210 was they need to do a categorization to CVEs. 231 00:09:48,210 --> 00:09:51,720 They have to put a CWE against the CVE, 232 00:09:51,720 --> 00:09:53,700 but there really isn't a common weakness 233 00:09:53,700 --> 00:09:56,220 for inducing RF messages. 234 00:09:56,220 --> 00:09:57,630 And the closest thing they could come up with 235 00:09:57,630 --> 00:10:00,780 is this improper protection against EMFI 236 00:10:00,780 --> 00:10:04,080 which is electromagnetic fault injection protections, 237 00:10:04,080 --> 00:10:06,209 which is something that you might assign 238 00:10:06,209 --> 00:10:07,320 to a microprocessor that isn't guarded 239 00:10:07,320 --> 00:10:08,520 against fault injection. 240 00:10:09,930 --> 00:10:11,880 Hence the title of the talk, "Trailer Shouting", 241 00:10:11,880 --> 00:10:14,703 which is a nod to the amazing Colonel Flynn. 242 00:10:15,810 --> 00:10:18,240 And then finally there was other research 243 00:10:18,240 --> 00:10:20,670 that's been put out about HPGP, 244 00:10:20,670 --> 00:10:24,243 which is that combined charging system technology 245 00:10:24,243 --> 00:10:26,583 that we talked about earlier from Intellon. 246 00:10:27,690 --> 00:10:29,460 Back in 2019, when we said you could read 247 00:10:29,460 --> 00:10:32,880 the technology, the PLC4Trucks remotely, 248 00:10:32,880 --> 00:10:35,070 Martinovic and baker from Oxford University. 249 00:10:35,070 --> 00:10:37,353 They put out research saying that, yeah, 250 00:10:37,353 --> 00:10:38,190 you can actually read HBGP remotely 251 00:10:38,190 --> 00:10:40,200 from charging stations and roughly 252 00:10:40,200 --> 00:10:41,550 at about the same time that we did 253 00:10:41,550 --> 00:10:44,100 our coordinated disclosure for this remote right 254 00:10:44,100 --> 00:10:46,470 They also put in another paper called "Broken Wire" 255 00:10:46,470 --> 00:10:48,360 which shows that they can interrupt 256 00:10:48,360 --> 00:10:50,940 the HPGP charging sessions. 257 00:10:50,940 --> 00:10:52,920 The big difference between the research 258 00:10:52,920 --> 00:10:54,150 that they released this year and ours 259 00:10:54,150 --> 00:10:58,020 is that we're writing valid J2497 messages onto the bus. 260 00:10:58,020 --> 00:11:00,030 We're not interrupting the communication. 261 00:11:00,030 --> 00:11:02,103 We can create brand new valid messages. 262 00:11:03,990 --> 00:11:06,300 So this is how our testing works. 263 00:11:06,300 --> 00:11:09,240 We set up this antenna next to the trailer 264 00:11:09,240 --> 00:11:11,130 at varying distances. 265 00:11:11,130 --> 00:11:13,530 We start close, we play something 266 00:11:13,530 --> 00:11:14,790 we call the Unichuff signal, 267 00:11:14,790 --> 00:11:17,190 which is a recording of all the possible 268 00:11:17,190 --> 00:11:19,410 solenoid test commands, which are diagnostic commands. 269 00:11:19,410 --> 00:11:21,180 And I'll tell you more about that. 270 00:11:21,180 --> 00:11:24,060 And we play that in a loop and we dial up the power 271 00:11:24,060 --> 00:11:27,120 until we can hear the trailer breaks, clicking. 272 00:11:27,120 --> 00:11:28,920 We can hear the solenoid test. 273 00:11:28,920 --> 00:11:30,180 And then we know we've confirmed 274 00:11:30,180 --> 00:11:33,180 that the trailer equipment has received that signal. 275 00:11:33,180 --> 00:11:35,250 The tables here are a little bit weird 276 00:11:35,250 --> 00:11:36,270 and they don't line up. 277 00:11:36,270 --> 00:11:40,290 You'll notice that the minimum power for a distance kind 278 00:11:40,290 --> 00:11:43,050 of caps out at different numbers, unpredictably. 279 00:11:43,050 --> 00:11:45,420 And this is because I had a really bad habit 280 00:11:45,420 --> 00:11:49,200 of blowing up the power amplifiers we were using to test, 281 00:11:49,200 --> 00:11:50,580 and they just wouldn't work. 282 00:11:50,580 --> 00:11:52,200 And we would look down and say, what's going on? 283 00:11:52,200 --> 00:11:54,450 And then we would notice that the test was invalidated 284 00:11:54,450 --> 00:11:55,350 at various points. 285 00:11:56,334 --> 00:11:59,550 And that's why it's 50 here and 45 in the other location. 286 00:11:59,550 --> 00:12:02,850 So yeah, I had a bad habit of breaking things, 287 00:12:02,850 --> 00:12:05,400 but you can see that on the left here, 288 00:12:05,400 --> 00:12:07,470 we have a drive van with metal decking, 289 00:12:07,470 --> 00:12:10,050 and it is possible to actually induce messages 290 00:12:10,050 --> 00:12:11,790 on drive vans with metal decking. 291 00:12:11,790 --> 00:12:13,830 There is no table for drive ends of wood decking 292 00:12:13,830 --> 00:12:15,540 because we found that we weren't able 293 00:12:15,540 --> 00:12:17,940 to get signals induced at any power level, 294 00:12:17,940 --> 00:12:19,440 even for close distances. 295 00:12:19,440 --> 00:12:21,900 So that change from wood decking to metal decking seems 296 00:12:21,900 --> 00:12:23,640 to make the equipment more susceptible 297 00:12:23,640 --> 00:12:25,590 to the induction of the messages. 298 00:12:25,590 --> 00:12:28,230 The one of the middle is tests on a tanker, 299 00:12:28,230 --> 00:12:31,600 and this is really the most unfortunate situation 300 00:12:32,520 --> 00:12:34,230 for about a hundred dollars US, 301 00:12:34,230 --> 00:12:37,050 you can put out 12 watts at these frequencies, 302 00:12:37,050 --> 00:12:39,420 and that is enough power in our test to get you 303 00:12:39,420 --> 00:12:41,160 from 12 feet away from the trailer 304 00:12:41,160 --> 00:12:42,570 to successfully induce the messages. 305 00:12:42,570 --> 00:12:45,930 So for tankers it's particularly bad. 306 00:12:45,930 --> 00:12:50,790 And then the third table on your far right, 307 00:12:50,790 --> 00:12:55,140 is when we took drive van trailers with wood decking, 308 00:12:55,140 --> 00:12:57,540 but extended them into a triple road train. 309 00:12:57,540 --> 00:12:59,880 And once they're in this triple road train configuration, 310 00:12:59,880 --> 00:13:02,700 then we find that they are once again susceptible, 311 00:13:02,700 --> 00:13:05,040 but the costs involve end up being much higher 312 00:13:05,040 --> 00:13:05,910 than in the tanker case. 313 00:13:05,910 --> 00:13:08,670 We estimate upwards of $10,000 for the kinds 314 00:13:08,670 --> 00:13:10,974 of power amplifiers that are required 315 00:13:10,974 --> 00:13:13,023 to accomplish the successful induction. 316 00:13:14,640 --> 00:13:16,320 So we had two CDs issued. 317 00:13:16,320 --> 00:13:18,900 The first is the fact that you can induce the messages. 318 00:13:18,900 --> 00:13:21,840 The other is sort of this otherwise non-issue. 319 00:13:21,840 --> 00:13:24,470 The diagnostic software that's implemented 320 00:13:24,470 --> 00:13:26,400 in all these trailer ECU controllers 321 00:13:26,400 --> 00:13:29,040 has no authentication or authorization, 322 00:13:29,040 --> 00:13:31,290 so you can just send the correct bite sequence 323 00:13:31,290 --> 00:13:33,450 at it without any back and forth challenge response 324 00:13:33,450 --> 00:13:35,370 or anything, really, even a password 325 00:13:35,370 --> 00:13:36,810 and it'll just respond. 326 00:13:36,810 --> 00:13:37,920 And if you think about it, 327 00:13:37,920 --> 00:13:40,440 the era where this software really comes from 328 00:13:40,440 --> 00:13:41,273 is sort of the '80s 329 00:13:41,273 --> 00:13:44,701 the SSEP 485 was created as a bridge between existing 330 00:13:44,701 --> 00:13:48,030 J1708 and the new J2497. 331 00:13:48,030 --> 00:13:52,200 So people were able to just forward port their firmware 332 00:13:52,200 --> 00:13:53,460 and stick the chip in front of it. 333 00:13:53,460 --> 00:13:55,740 So we're dealing with diagnostic software 334 00:13:55,740 --> 00:13:57,630 that predates 2497 itself, 335 00:13:57,630 --> 00:13:59,070 and it would be unreasonable to expect 336 00:13:59,070 --> 00:14:01,500 that it would have authorization and authentication. 337 00:14:01,500 --> 00:14:04,020 It's the era of peaks and pokes. 338 00:14:04,020 --> 00:14:07,050 But when you combine the fact that you can create 339 00:14:07,050 --> 00:14:08,790 these messages with RF 340 00:14:08,790 --> 00:14:11,400 and that there's no authenticated authorization 341 00:14:11,400 --> 00:14:13,293 when you get this problem. 342 00:14:14,700 --> 00:14:17,250 So, Chris, I hope you're gonna help fill 343 00:14:17,250 --> 00:14:18,810 in the blanks on some of what's happening 344 00:14:18,810 --> 00:14:21,273 with this RF black magic. 345 00:14:23,370 --> 00:14:26,640 - So let's try to go over some of the voodoo 346 00:14:26,640 --> 00:14:28,200 that we're doing to these trailers 347 00:14:28,200 --> 00:14:30,723 and navigate the RF black magic that's going 348 00:14:30,723 --> 00:14:32,851 on in the background. 349 00:14:32,851 --> 00:14:35,820 When they first told me about this idea, 350 00:14:35,820 --> 00:14:38,040 I thought there's no way you're going to be able 351 00:14:38,040 --> 00:14:41,520 to get a meaningful signal on that wire 352 00:14:41,520 --> 00:14:45,090 at those low frequencies and such wide bandwidths. 353 00:14:45,090 --> 00:14:46,640 I didn't think it was possible. 354 00:14:47,730 --> 00:14:50,340 It was such a complicated signal too, 355 00:14:50,340 --> 00:14:52,710 but I decided to let it play through. 356 00:14:52,710 --> 00:14:57,540 And we did the testing and we ended up getting it to work, 357 00:14:57,540 --> 00:15:00,063 but there were a lot of things that didn't work. 358 00:15:01,080 --> 00:15:03,600 We went through and we tried all types 359 00:15:03,600 --> 00:15:05,730 of antenna configurations. 360 00:15:05,730 --> 00:15:08,460 We found that loop antennas weren't that effective. 361 00:15:08,460 --> 00:15:10,410 We tried making our own loading coils 362 00:15:10,410 --> 00:15:12,210 by taping a couple buckets together 363 00:15:12,210 --> 00:15:14,640 and just wrapping wire around it. 364 00:15:14,640 --> 00:15:15,720 That didn't work for us. 365 00:15:15,720 --> 00:15:18,360 We tried rolling out our own ground planes 366 00:15:18,360 --> 00:15:20,370 along the length of the trailer using 367 00:15:20,370 --> 00:15:23,970 screen door type material and not so much. 368 00:15:23,970 --> 00:15:28,970 And then someone suggested that we try using the signal 369 00:15:29,280 --> 00:15:31,470 that's produced from a modified truck duct 370 00:15:31,470 --> 00:15:33,600 using the GPIOS pins. 371 00:15:33,600 --> 00:15:35,160 And that's not really a good idea. 372 00:15:35,160 --> 00:15:35,993 You shouldn't do it 373 00:15:35,993 --> 00:15:38,790 because that signal is much less quality 374 00:15:38,790 --> 00:15:40,020 compared to the real thing. 375 00:15:40,020 --> 00:15:41,570 It just doesn't really compare. 376 00:15:42,450 --> 00:15:43,890 Then, as Ben mentioned, 377 00:15:43,890 --> 00:15:46,020 we had the habit of breaking the power amplifiers. 378 00:15:46,020 --> 00:15:47,315 You can only imagine the joy of going 379 00:15:47,315 --> 00:15:51,060 across the country and then when the first 10 minutes 380 00:15:51,060 --> 00:15:55,140 of testing, you break the power AFL amplifier accidentally. 381 00:15:55,140 --> 00:15:55,973 - [Ben] Yeah, that's my bad. 382 00:15:55,973 --> 00:16:00,973 - [Chris] I hope yes, but what does work? 383 00:16:01,410 --> 00:16:04,543 Surprisingly, the FL2K dongle work for us. 384 00:16:04,543 --> 00:16:06,420 For those of you that don't know, 385 00:16:06,420 --> 00:16:11,420 it's a USB to VGA adapter that can be used as an SDR. 386 00:16:11,790 --> 00:16:14,400 And surprisingly it provides more output power 387 00:16:14,400 --> 00:16:15,791 at those low frequencies than a lot 388 00:16:15,791 --> 00:16:18,630 of the SDRs that you'll see. 389 00:16:18,630 --> 00:16:20,596 And it's much cheaper, 390 00:16:20,596 --> 00:16:22,800 especially with prices going up these days. 391 00:16:22,800 --> 00:16:25,710 So in the picture there, you see the FL2K plugged 392 00:16:25,710 --> 00:16:28,410 into a small five watt amplifier going 393 00:16:28,410 --> 00:16:30,270 into a (indistinct) 394 00:16:30,270 --> 00:16:32,640 and a couple of wire antennas connected to that. 395 00:16:32,640 --> 00:16:35,430 And we found that lengthy wire runs placed 396 00:16:35,430 --> 00:16:38,550 along parallel to the trailer, 397 00:16:38,550 --> 00:16:40,200 produced the best results for us. 398 00:16:42,210 --> 00:16:45,981 We recently updated our gr-J2497 code that's found 399 00:16:45,981 --> 00:16:50,981 on my company's GitHub page there. 400 00:16:51,390 --> 00:16:52,830 Before it only did receive, 401 00:16:52,830 --> 00:16:56,190 but now we put in transmit capabilities. 402 00:16:56,190 --> 00:17:00,120 So if you're using a FL2K or an RF, 403 00:17:00,120 --> 00:17:03,450 you can transmit directly at those frequencies, 404 00:17:03,450 --> 00:17:06,465 or if you have a different SDR that doesn't go that low, 405 00:17:06,465 --> 00:17:09,090 you can use a down converter and you might have 406 00:17:09,090 --> 00:17:11,790 to amplify the signal coming outta the down converter, 407 00:17:15,540 --> 00:17:17,850 But what's really going on in that wire? 408 00:17:17,850 --> 00:17:20,520 What makes the chip understand our signals 409 00:17:20,520 --> 00:17:23,070 as we transmit onto it? 410 00:17:23,070 --> 00:17:24,960 There's a couple things working in our favor. 411 00:17:24,960 --> 00:17:29,324 For one, there's a lack of differential signaling going on. 412 00:17:29,324 --> 00:17:31,140 It's just one wire and ground. 413 00:17:31,140 --> 00:17:32,320 It's not like there's two wires going 414 00:17:32,320 --> 00:17:34,023 along the length of the trailer. 415 00:17:35,010 --> 00:17:37,295 And then there's the residence effect 416 00:17:37,295 --> 00:17:39,570 that Ben was mentioning where doubles 417 00:17:39,570 --> 00:17:43,140 and triples may behave as better antennas 418 00:17:43,140 --> 00:17:45,543 than just a single trailer. 419 00:17:47,190 --> 00:17:50,310 Then there's the high sensitivity of the chips themselves. 420 00:17:50,310 --> 00:17:53,550 I mean, typically they work on the order of volts, 421 00:17:53,550 --> 00:17:54,840 these messages peak to peak, 422 00:17:54,840 --> 00:17:58,410 but we can induce a signal and it gets interpreted 423 00:17:58,410 --> 00:18:01,230 as low as a few milli volts, which is great 424 00:18:01,230 --> 00:18:04,440 if you're trying to inject something onto a wire, 425 00:18:04,440 --> 00:18:06,840 and then there's other theories that we're thinking about 426 00:18:06,840 --> 00:18:08,280 about why it's doing this. 427 00:18:08,280 --> 00:18:10,500 And one could be that it's getting 428 00:18:10,500 --> 00:18:12,810 onto the ground better than it is the wire. 429 00:18:12,810 --> 00:18:14,790 And the chip only cares about the difference. 430 00:18:14,790 --> 00:18:17,490 So our signal could be stronger 431 00:18:17,490 --> 00:18:19,563 on the ground for all we know. 432 00:18:20,910 --> 00:18:25,410 So we were able to do it despite my earlier doubts, 433 00:18:25,410 --> 00:18:29,073 things like the low frequency, the wide relative bandwidth, 434 00:18:29,910 --> 00:18:34,020 it's all near field at these distances and frequencies. 435 00:18:34,020 --> 00:18:36,870 The trailers, the wires, they're not comparable 436 00:18:36,870 --> 00:18:39,090 to the wavelengths that we're trying 437 00:18:39,090 --> 00:18:39,990 to work with here. 438 00:18:40,830 --> 00:18:43,440 So they make for bad transmit and receiving antennas, 439 00:18:43,440 --> 00:18:45,570 but it's still good enough to work. 440 00:18:45,570 --> 00:18:47,220 And then there could be reflections going on 441 00:18:47,220 --> 00:18:48,420 and impeded mismatches, 442 00:18:48,420 --> 00:18:52,830 it's not meant for RF and the chirp frequencies go 443 00:18:52,830 --> 00:18:54,240 from 100 to 400 kilohertz. 444 00:18:54,240 --> 00:18:56,970 And there's a big difference between 100 and 400 kilohertz 445 00:18:56,970 --> 00:18:58,320 in terms of wavelength. 446 00:18:58,320 --> 00:19:00,960 So certain frequencies might be transmitted 447 00:19:00,960 --> 00:19:02,560 and received better than others. 448 00:19:04,020 --> 00:19:08,100 And I've also seen just by traveling down the highway, 449 00:19:08,100 --> 00:19:11,100 I've taken my receive antenna in the passenger seat, 450 00:19:11,100 --> 00:19:12,300 held it up to the window 451 00:19:12,300 --> 00:19:15,390 and I could see that certain trailers 452 00:19:15,390 --> 00:19:19,380 transmit the signals naturally better than others 453 00:19:19,380 --> 00:19:21,150 based on the configurations of the wires 454 00:19:21,150 --> 00:19:23,130 and the metal in the trailer. 455 00:19:23,130 --> 00:19:26,190 I've seen some cables tucked away in like metal tubing, 456 00:19:26,190 --> 00:19:28,080 and you can't really get much from the signal. 457 00:19:28,080 --> 00:19:31,923 So it depends on the trailer configuration. 458 00:19:32,820 --> 00:19:34,440 And then you gotta manage your amplifier, 459 00:19:34,440 --> 00:19:37,440 harmonics and signal conditioning challenges, 460 00:19:37,440 --> 00:19:39,940 which will come up when you're trying to transmit. 461 00:19:41,250 --> 00:19:42,810 Now Ben will give you a timeline about 462 00:19:42,810 --> 00:19:45,513 how we discovered all this and went through it, Ben. 463 00:19:47,430 --> 00:19:48,330 - Thanks, Chris. 464 00:19:48,330 --> 00:19:50,610 Yeah, we've actually been at this for a while. 465 00:19:50,610 --> 00:19:54,210 Since 2019, we started and as you know, 466 00:19:54,210 --> 00:19:56,610 we did disclose that you could read this stuff 467 00:19:56,610 --> 00:20:00,090 back in Safe Mode, Safe Mode DEFCON, 468 00:20:00,090 --> 00:20:02,890 but in 2019 we were actually doing some testing 469 00:20:03,750 --> 00:20:06,129 and we did start the public disclosure process 470 00:20:06,129 --> 00:20:08,280 about remote read. 471 00:20:08,280 --> 00:20:11,198 At the time, we also had results that did suggest 472 00:20:11,198 --> 00:20:13,050 that you could do a remote right, 473 00:20:13,050 --> 00:20:16,020 but we couldn't actually confirm that our testing method 474 00:20:16,020 --> 00:20:18,570 at that time, wasn't due to galvanic coupling. 475 00:20:18,570 --> 00:20:19,920 Which means that, 476 00:20:19,920 --> 00:20:21,720 so we had an oscilloscope that was plugged 477 00:20:21,720 --> 00:20:22,980 into the mains power 478 00:20:22,980 --> 00:20:24,540 and we had a signal generator that was plugged 479 00:20:24,540 --> 00:20:25,560 into the mains power. 480 00:20:25,560 --> 00:20:27,210 And we couldn't discount the possibility 481 00:20:27,210 --> 00:20:29,970 that the signal was actually traveling through the ground 482 00:20:29,970 --> 00:20:33,660 and or mains lines from the signal generator 483 00:20:33,660 --> 00:20:36,090 to the oscilloscope and that it wasn't being induced. 484 00:20:36,090 --> 00:20:37,110 And that was true. 485 00:20:37,110 --> 00:20:40,800 So we did set up out to then test this 486 00:20:40,800 --> 00:20:42,750 to make sure there was no get galvanic coupling, 487 00:20:42,750 --> 00:20:45,930 but of course the pandemic happened and got in the way 488 00:20:45,930 --> 00:20:48,120 of our darn testing schedule. 489 00:20:48,120 --> 00:20:50,670 Well that's okay, there's more important things happening. 490 00:20:50,670 --> 00:20:53,250 Thanks to our member fleets 491 00:20:53,250 --> 00:20:55,620 and some anonymous equipment suppliers though, 492 00:20:55,620 --> 00:20:58,050 we did manage to complete a gauntlet of testing 493 00:20:58,050 --> 00:21:01,080 in late 2021 and confirm that yeah, 494 00:21:01,080 --> 00:21:02,790 you can write these signals. 495 00:21:02,790 --> 00:21:04,350 There's definitely no galvanic coupling 496 00:21:04,350 --> 00:21:06,780 because we stopped measuring the signal. 497 00:21:06,780 --> 00:21:10,560 We found that we were making signals that were very small, 498 00:21:10,560 --> 00:21:13,380 so small that they're within the noise of the oscilloscope. 499 00:21:13,380 --> 00:21:15,720 You could resolve them with a very sensitive SDR, 500 00:21:15,720 --> 00:21:16,950 like 16 bit SDRs, 501 00:21:16,950 --> 00:21:17,850 but you couldn't resolve them 502 00:21:17,850 --> 00:21:19,380 with something like the eight bit hack RF. 503 00:21:19,380 --> 00:21:20,970 They were very, very small signals, 504 00:21:20,970 --> 00:21:23,610 but they're still small enough to trigger reception 505 00:21:23,610 --> 00:21:25,530 on the trailer equipment. 506 00:21:25,530 --> 00:21:26,640 So yeah, we stopped measuring. 507 00:21:26,640 --> 00:21:28,362 I'll talk a little bit more about that. 508 00:21:28,362 --> 00:21:32,310 We work with CISA to get a coordinated disclosure 509 00:21:32,310 --> 00:21:36,150 and it was very quick I think, and it was nice. 510 00:21:36,150 --> 00:21:38,021 We wanted to get done in time to talk 511 00:21:38,021 --> 00:21:40,050 to the American Trucking Association's 512 00:21:40,050 --> 00:21:41,430 technical maintenance council. 513 00:21:41,430 --> 00:21:43,380 They have a task force that was putting together 514 00:21:43,380 --> 00:21:47,610 in the new specifications for tractor trailer interfaces. 515 00:21:47,610 --> 00:21:50,670 And we really wanted to make sure that that task force 516 00:21:50,670 --> 00:21:53,460 and the stakeholders thereof were aware 517 00:21:53,460 --> 00:21:54,990 of the problems of J2497, 518 00:21:54,990 --> 00:21:57,060 so that the new interface wouldn't inherit 519 00:21:57,060 --> 00:21:58,590 all the same problems that have been there 520 00:21:58,590 --> 00:22:01,770 in 2497 for the past 30 odd years. 521 00:22:01,770 --> 00:22:03,450 So we are able to do that thankfully 522 00:22:03,450 --> 00:22:05,670 by the time that they had their meeting in March, 523 00:22:05,670 --> 00:22:07,560 and eventually we were also able to contact 524 00:22:07,560 --> 00:22:09,690 the American Tanker Truck Association, 525 00:22:09,690 --> 00:22:12,663 which is good because the issue is the worst on tankers. 526 00:22:13,920 --> 00:22:16,500 So about the Unichuff signal, 527 00:22:16,500 --> 00:22:18,540 because we stopped kind of trying to measure 528 00:22:18,540 --> 00:22:19,620 how much we could induce, 529 00:22:19,620 --> 00:22:21,690 because it was way down in this very dirty, 530 00:22:21,690 --> 00:22:24,963 noisy 12 volt line on the trailer. 531 00:22:26,220 --> 00:22:28,260 We put together a signal be called Unichuff. 532 00:22:28,260 --> 00:22:30,390 It contains the diagnostic commands 533 00:22:30,390 --> 00:22:33,870 for all three trailer brake suppliers. 534 00:22:33,870 --> 00:22:35,042 And we send them to all five 535 00:22:35,042 --> 00:22:38,498 of the possible trailer brake locations. 536 00:22:38,498 --> 00:22:40,050 And we just do that on a loop, 537 00:22:40,050 --> 00:22:42,660 because if you remember the CVE that was issued, 538 00:22:42,660 --> 00:22:45,420 there is no authentication or authorization required. 539 00:22:45,420 --> 00:22:47,790 So we just play it over and over again, 540 00:22:47,790 --> 00:22:50,970 which lets us move where our antennas, change our powers. 541 00:22:50,970 --> 00:22:53,130 And eventually we hear clicking 542 00:22:53,130 --> 00:22:54,730 and then we know that it worked. 543 00:22:55,890 --> 00:22:58,350 And we did this for solanoid test 544 00:22:58,350 --> 00:23:00,000 because you can hear the clicking. 545 00:23:00,000 --> 00:23:01,440 It's very useful as a test, 546 00:23:01,440 --> 00:23:04,680 but this is also applicable to other diagnostic commands. 547 00:23:04,680 --> 00:23:06,580 And we'll talk a bit about that later. 548 00:23:07,620 --> 00:23:09,480 So Chris, how can they do this? 549 00:23:09,480 --> 00:23:10,480 Should they do this? 550 00:23:13,230 --> 00:23:15,300 - So if you're on the highway, 551 00:23:15,300 --> 00:23:17,700 you should not do this to other people's trucks. 552 00:23:17,700 --> 00:23:19,357 This is not a good idea. 553 00:23:19,357 --> 00:23:21,270 They're big machines. You don't own them. 554 00:23:21,270 --> 00:23:22,710 Don't mess with 'em. 555 00:23:22,710 --> 00:23:25,394 But if you have your own truck 556 00:23:25,394 --> 00:23:27,808 or you wanna make your own bench set up, 557 00:23:27,808 --> 00:23:29,370 I strongly encourage that. 558 00:23:29,370 --> 00:23:31,110 And there are different things you can do 559 00:23:31,110 --> 00:23:32,878 if you have a bench set up. 560 00:23:32,878 --> 00:23:37,470 You can tap directly into the wires and view these signals. 561 00:23:37,470 --> 00:23:39,840 One way to do it is with a DC block to get rid 562 00:23:39,840 --> 00:23:42,090 of the 12 volts that's on the power line 563 00:23:42,090 --> 00:23:44,760 and just see the signal and you don't harm your scopes 564 00:23:44,760 --> 00:23:47,643 or your SDRs or whatever you got plugged in. 565 00:23:48,660 --> 00:23:52,110 Another method is you can get a hardware hacking, 566 00:23:52,110 --> 00:23:54,210 diagnostic adapter. 567 00:23:54,210 --> 00:23:58,920 They sell some that go from J2497 to 1708, 568 00:23:58,920 --> 00:24:00,480 and you can plug it in on one end. 569 00:24:00,480 --> 00:24:02,220 And then if you get your hands 570 00:24:02,220 --> 00:24:05,130 on a supplier diagnostic adapter that goes like right 571 00:24:05,130 --> 00:24:07,170 into a brake controller or something, 572 00:24:07,170 --> 00:24:10,503 you can view entire session traffic and capture that. 573 00:24:12,360 --> 00:24:15,600 If you wanna make your own FL2K adapter like we did, 574 00:24:15,600 --> 00:24:19,020 there are schematics out there for buying 575 00:24:19,020 --> 00:24:22,680 or just buy a board that goes from VGA to SMA 576 00:24:22,680 --> 00:24:24,633 and you're off and running there. 577 00:24:26,040 --> 00:24:29,850 And if you're making your own bench set up, 578 00:24:29,850 --> 00:24:34,200 you can add bonus features such as wheel speed simulation 579 00:24:34,200 --> 00:24:35,613 or pressurized air. 580 00:24:36,600 --> 00:24:39,420 And then if you wanna go online and see our code, 581 00:24:39,420 --> 00:24:41,640 you can do it yourself with the SDRs 582 00:24:41,640 --> 00:24:43,983 and the down converter and amplifier methods. 583 00:24:48,180 --> 00:24:51,030 This is an example of event set up that Ben's been using 584 00:24:51,030 --> 00:24:52,202 for the past couple years. 585 00:24:52,202 --> 00:24:55,743 I'll let him talk more about it. It's pretty interesting. 586 00:24:57,060 --> 00:24:58,850 - [Ben] Yeah this is actually a CTF challenge 587 00:24:58,850 --> 00:24:59,880 at the car hacking village. 588 00:24:59,880 --> 00:25:01,500 We have it again this year. 589 00:25:01,500 --> 00:25:04,170 This year, the contestants have to use an SDR. 590 00:25:04,170 --> 00:25:06,930 In the past, we've given them a diagnostic actor 591 00:25:06,930 --> 00:25:08,313 and because it's DEFCON, 592 00:25:08,313 --> 00:25:10,410 (indistinct) also helped me modify it. 593 00:25:10,410 --> 00:25:13,350 And we started a launch war with each other yesterday. 594 00:25:13,350 --> 00:25:14,820 So it's pretty fun. 595 00:25:14,820 --> 00:25:17,370 And you should come check it out if you like. 596 00:25:17,370 --> 00:25:20,164 And yeah, I mean, bench setups can be really key. 597 00:25:20,164 --> 00:25:22,470 If you want to take on the challenge 598 00:25:22,470 --> 00:25:26,370 of doing your own J2497 research on a bench, 599 00:25:26,370 --> 00:25:29,610 it might behoove you to know that if you find something, 600 00:25:29,610 --> 00:25:33,330 whatever you find is now remotely exploitable, right? 601 00:25:33,330 --> 00:25:35,520 So this is the environment that you would have 602 00:25:35,520 --> 00:25:38,340 in the situation of possibly remote inducing messages. 603 00:25:38,340 --> 00:25:39,210 Not that you're gonna do it, 604 00:25:39,210 --> 00:25:42,060 but your bench set up may be set up to look like this. 605 00:25:42,060 --> 00:25:45,480 You're gonna have at least a tractor brake controller 606 00:25:45,480 --> 00:25:47,790 and one trailer brake controller, 607 00:25:47,790 --> 00:25:51,390 but here in north America, you could actually run triples, 608 00:25:51,390 --> 00:25:53,250 meaning three trailers. 609 00:25:53,250 --> 00:25:56,100 A lot of those triples actually require converter dollies. 610 00:25:56,100 --> 00:25:58,470 And that's what kind of changes the back of a normal trailer 611 00:25:58,470 --> 00:26:00,540 into something that looks like the back of a truck 612 00:26:00,540 --> 00:26:02,667 so that you can put another trailer on it. 613 00:26:02,667 --> 00:26:04,170 And these converter dollies of course 614 00:26:04,170 --> 00:26:05,820 have their own trailer brake controllers. 615 00:26:05,820 --> 00:26:07,710 So even though you can have a up to a triple, 616 00:26:07,710 --> 00:26:10,650 you could have up to five trailer brake controllers. 617 00:26:10,650 --> 00:26:12,540 So if you want to have an authentic test bench, 618 00:26:12,540 --> 00:26:14,990 you might want to consider all five being present 619 00:26:17,340 --> 00:26:21,330 and yes, hang on a second. 620 00:26:21,330 --> 00:26:22,163 I lost my notes. 621 00:26:27,030 --> 00:26:29,250 Right, so when you're looking at this stuff on your bench, 622 00:26:29,250 --> 00:26:32,370 keep in mind that the only required functionality 623 00:26:32,370 --> 00:26:33,990 while the truck is rolling at mission time 624 00:26:33,990 --> 00:26:35,490 is sending the lamp messages 625 00:26:35,490 --> 00:26:37,290 from the trailer to the tractor 626 00:26:37,290 --> 00:26:39,270 to show whether there's a fault. 627 00:26:39,270 --> 00:26:40,620 There's a lot of other stuff going on, 628 00:26:40,620 --> 00:26:43,380 but most of that is really value add from the vendors 629 00:26:43,380 --> 00:26:46,470 and doesn't necessarily need to be happening on J2497, 630 00:26:46,470 --> 00:26:49,413 especially when we get to new tractor trailer interfaces. 631 00:26:50,760 --> 00:26:53,100 Our experience with J2497 has kind of uncovered 632 00:26:53,100 --> 00:26:54,660 that it's a little strange. 633 00:26:54,660 --> 00:26:56,550 And there's a lot of things about what we found 634 00:26:56,550 --> 00:26:59,910 that suggest that either it's not been explored 635 00:26:59,910 --> 00:27:03,030 or that possibly this patent had a real chilling effect 636 00:27:03,030 --> 00:27:04,571 on the technology. 637 00:27:04,571 --> 00:27:06,360 You can see this picture at the bottom, 638 00:27:06,360 --> 00:27:08,880 which is sort of this weird chirp fragment coming out. 639 00:27:08,880 --> 00:27:11,070 And as soon as we started capturing these signals, 640 00:27:11,070 --> 00:27:12,270 we were seeing these chirp fragments. 641 00:27:12,270 --> 00:27:13,530 And we couldn't tell if it was us 642 00:27:13,530 --> 00:27:16,140 or if it was something we were doing on the software. 643 00:27:16,140 --> 00:27:17,700 Eventually we broke out the signals 644 00:27:17,700 --> 00:27:19,770 and it really was just this tri-state output 645 00:27:19,770 --> 00:27:20,970 on the bridge. 646 00:27:20,970 --> 00:27:22,320 A tri-state is when you kind of try 647 00:27:22,320 --> 00:27:24,480 to turn off external amplifiers 648 00:27:24,480 --> 00:27:27,810 and this output was just going high for some unknown reason. 649 00:27:27,810 --> 00:27:30,150 It's highly unlikely that no one has ever seen this before. 650 00:27:30,150 --> 00:27:31,500 There's a lot of really smart engineers 651 00:27:31,500 --> 00:27:33,480 that work on this technology. 652 00:27:33,480 --> 00:27:35,962 We suspect that this and other things really suggest 653 00:27:35,962 --> 00:27:39,108 that whenever someone encountered this stuff, 654 00:27:39,108 --> 00:27:40,470 the answer was probably, well, 655 00:27:40,470 --> 00:27:42,780 this is patented and we don't do anything about it. 656 00:27:42,780 --> 00:27:44,250 We can't make an alternative technology. 657 00:27:44,250 --> 00:27:45,090 How could we change it? 658 00:27:45,090 --> 00:27:47,730 So we think that all of the weirdness here that you see, 659 00:27:47,730 --> 00:27:50,670 we summarized really did have a chilling effect. 660 00:27:50,670 --> 00:27:52,680 And Michael Osman has talked about this, 661 00:27:52,680 --> 00:27:55,170 how patents can be harmful to innovation. 662 00:27:55,170 --> 00:27:57,780 In his case, he talked about forceps 663 00:27:57,780 --> 00:28:00,360 and that really caused really bad things. 664 00:28:00,360 --> 00:28:02,730 This has thankfully hasn't hurt anybody, 665 00:28:02,730 --> 00:28:05,970 but we do believe that the patents being present 666 00:28:05,970 --> 00:28:07,500 has had a chilling effect. 667 00:28:07,500 --> 00:28:08,790 And I've heard of that as well, 668 00:28:08,790 --> 00:28:12,450 that in 1998, when they evaluated this technology 669 00:28:12,450 --> 00:28:13,440 amongst the other ones, 670 00:28:13,440 --> 00:28:14,820 there was a whole list of dozens 671 00:28:14,820 --> 00:28:16,500 and dozens of features that they could integrate 672 00:28:16,500 --> 00:28:19,320 over J2497 and to this day, 673 00:28:19,320 --> 00:28:20,700 really none of them have been implemented. 674 00:28:20,700 --> 00:28:22,050 And I've been told by some engineers that 675 00:28:22,050 --> 00:28:25,203 that's really was because of licensing and the patent. 676 00:28:26,130 --> 00:28:29,010 So the other thing to note here is the preamble 677 00:28:29,010 --> 00:28:30,810 is discarded on receive. 678 00:28:30,810 --> 00:28:33,180 We previously had reported that you can make frames 679 00:28:33,180 --> 00:28:35,700 that have a different priority on 2497 680 00:28:35,700 --> 00:28:38,400 than they have on J1708 when they received. 681 00:28:38,400 --> 00:28:39,480 It's actually worse than that. 682 00:28:39,480 --> 00:28:42,180 It turns out that the preamble isn't used at all. 683 00:28:42,180 --> 00:28:44,160 And we found that in one case, 684 00:28:44,160 --> 00:28:46,620 this one brake controller was just sending random bites 685 00:28:46,620 --> 00:28:47,453 for its preamble. 686 00:28:47,453 --> 00:28:49,380 It never was sending the correct lamp message. 687 00:28:49,380 --> 00:28:50,970 And which explains why we couldn't decode it 688 00:28:50,970 --> 00:28:52,260 that first time we had a capture. 689 00:28:52,260 --> 00:28:53,610 So another mystery solved 690 00:28:53,610 --> 00:28:55,080 and the other two brake controllers, 691 00:28:55,080 --> 00:28:58,080 only one of them implements arbitration correctly. 692 00:28:58,080 --> 00:29:00,720 And that one actually has a priority inversion bug, 693 00:29:00,720 --> 00:29:02,280 'cause it's doing it correctly, 694 00:29:02,280 --> 00:29:04,710 it still can hold up its transmit 695 00:29:04,710 --> 00:29:06,420 if it has a low transmit priority, 696 00:29:06,420 --> 00:29:09,000 ahead of a high transmit priority. 697 00:29:09,000 --> 00:29:10,980 So even though it implemented arbitration correctly, 698 00:29:10,980 --> 00:29:13,980 it messed something else up, which is unfortunate, 699 00:29:13,980 --> 00:29:14,880 but kind of funny. 700 00:29:16,140 --> 00:29:18,300 So solenoid tests, 701 00:29:18,300 --> 00:29:19,770 a lot of the testing we've done, 702 00:29:19,770 --> 00:29:22,980 a lot of what we've disclosed here is all about these tests. 703 00:29:22,980 --> 00:29:25,440 When the trailer break controller receives them, 704 00:29:25,440 --> 00:29:28,080 it makes a clicking noise if there's no air present, 705 00:29:28,080 --> 00:29:29,880 if the air is present and the driver's foot is 706 00:29:29,880 --> 00:29:31,055 on the brake, 707 00:29:31,055 --> 00:29:32,580 it will actually release compressed air 708 00:29:32,580 --> 00:29:34,710 through the exhaust port of the trailer brake controller, 709 00:29:34,710 --> 00:29:36,690 which makes a chuffing sound. 710 00:29:36,690 --> 00:29:39,330 And that's why these are called chuff test. 711 00:29:39,330 --> 00:29:41,520 The difference also is in dollies, 712 00:29:41,520 --> 00:29:43,780 Dollies don't have traditional air brakes. 713 00:29:43,780 --> 00:29:45,930 You don't need the driver's foot to be 714 00:29:45,930 --> 00:29:47,370 on the brake to chuff air. 715 00:29:47,370 --> 00:29:48,900 If they receive a solenoid test, 716 00:29:48,900 --> 00:29:50,820 they will chuff air regardless of the configuration. 717 00:29:50,820 --> 00:29:54,510 So when you have a road train with dollies, 718 00:29:54,510 --> 00:29:56,943 you'll actually exhaust air much, much quicker, 719 00:29:58,440 --> 00:30:00,840 but it's important to remember that even 720 00:30:00,840 --> 00:30:02,280 though we're talking about solenoid tests, 721 00:30:02,280 --> 00:30:04,860 they were a good stand in for us to do our testing 722 00:30:04,860 --> 00:30:07,140 'cause we could hear the results when they were received. 723 00:30:07,140 --> 00:30:09,090 They were also kind of bad enough. 724 00:30:09,090 --> 00:30:11,370 There were fleets that got upset about just this, 725 00:30:11,370 --> 00:30:13,560 but there is more that's possible. 726 00:30:13,560 --> 00:30:18,480 On tractors, the tractor units are really supposed 727 00:30:18,480 --> 00:30:19,800 to be receiving those lamp messages. 728 00:30:19,800 --> 00:30:23,220 That's their function, but they're doing more than that. 729 00:30:23,220 --> 00:30:25,440 Some of them are actually resetting in response 730 00:30:25,440 --> 00:30:28,290 to messages that they receive on the 2497 bus. 731 00:30:28,290 --> 00:30:30,270 And when a tractor brake controller resets, 732 00:30:30,270 --> 00:30:33,000 it sounds off its modulators, which is another chuff test. 733 00:30:33,000 --> 00:30:35,130 So it does four or more chuff tests 734 00:30:35,130 --> 00:30:36,840 in response to these reset commands, 735 00:30:36,840 --> 00:30:39,270 which is actually a well defined J1587 message, 736 00:30:39,270 --> 00:30:41,403 not even a hidden proprietary one. 737 00:30:42,390 --> 00:30:43,890 There are a lot of the brake controllers 738 00:30:43,890 --> 00:30:44,880 that are doing bridging. 739 00:30:44,880 --> 00:30:48,330 Thankfully that bridging is from 2497 to 1708. 740 00:30:48,330 --> 00:30:51,270 And we don't find 1708 on modern trucks. 741 00:30:51,270 --> 00:30:53,040 Although there are a lot of trucks on the road 742 00:30:53,040 --> 00:30:54,618 that aren't modern. 743 00:30:54,618 --> 00:30:56,040 So it's not a zero impact thing. 744 00:30:56,040 --> 00:30:57,780 There are tractor brake controllers 745 00:30:57,780 --> 00:31:01,290 that enable diagnostics from 1939 to 2497. 746 00:31:01,290 --> 00:31:03,630 So we know that some of the software does include 747 00:31:03,630 --> 00:31:05,820 higher privilege bridging 748 00:31:05,820 --> 00:31:08,160 and it's not clear whether it goes backwards. 749 00:31:08,160 --> 00:31:10,710 We certainly haven't found any that do that so far. 750 00:31:10,710 --> 00:31:12,390 And we haven't found any tractor brake controllers 751 00:31:12,390 --> 00:31:15,660 that respond to legitimate diagnostic commands on 2497, 752 00:31:15,660 --> 00:31:16,623 which is good. 753 00:31:17,910 --> 00:31:19,410 Back to trailers. 754 00:31:19,410 --> 00:31:21,120 There are other diagnostic commands 755 00:31:21,120 --> 00:31:24,000 on trailer brake controllers that aren't solenoid tests. 756 00:31:24,000 --> 00:31:25,560 You can change the tone ring size, 757 00:31:25,560 --> 00:31:27,330 which tells the ABS controller 758 00:31:27,330 --> 00:31:29,610 how fast is the wheel going based on the signal 759 00:31:29,610 --> 00:31:30,570 that it sees. 760 00:31:30,570 --> 00:31:33,420 The good news is that when you give it nonsensical values, 761 00:31:33,420 --> 00:31:35,910 the ones that we've tested don't do anything bad. 762 00:31:35,910 --> 00:31:37,770 We thought maybe if you gave it a nonsense value, 763 00:31:37,770 --> 00:31:39,420 it might start ABS events. 764 00:31:39,420 --> 00:31:41,430 It doesn't, which is good news. 765 00:31:41,430 --> 00:31:43,560 You can also change the axle number. 766 00:31:43,560 --> 00:31:46,680 You can do all your DTC reading and clearing, et cetera. 767 00:31:46,680 --> 00:31:49,170 Now 2497 is really the only interface 768 00:31:49,170 --> 00:31:51,690 to access trailer brake controllers in North America. 769 00:31:51,690 --> 00:31:55,080 And so all the engineering tools also work over 2497. 770 00:31:55,080 --> 00:31:56,790 And even though those tools aren't supposed 771 00:31:56,790 --> 00:31:58,260 to be in customer hands, 772 00:31:58,260 --> 00:32:00,810 the software that receives the engineering tool commands 773 00:32:00,810 --> 00:32:03,360 is in the trailer brake controller and will respond to them. 774 00:32:03,360 --> 00:32:06,180 So things like uploading scripts, 775 00:32:06,180 --> 00:32:08,100 some of the manufacturers have scripting languages 776 00:32:08,100 --> 00:32:09,660 that they put in their trailer brake controllers. 777 00:32:09,660 --> 00:32:13,340 And we're also told that firmer updates do happen over 2497 778 00:32:13,340 --> 00:32:14,730 on some of these trailer brake controllers. 779 00:32:14,730 --> 00:32:17,220 So there's a lot more than solenoid tests 780 00:32:17,220 --> 00:32:19,650 that are all possible. 781 00:32:19,650 --> 00:32:21,690 So with all this happening 782 00:32:21,690 --> 00:32:23,640 and there's some bad stuff happening here, 783 00:32:23,640 --> 00:32:24,660 it's not a zero impact. 784 00:32:24,660 --> 00:32:26,670 Why would we come up here and tell you all about it 785 00:32:26,670 --> 00:32:27,503 at DEFCON? 786 00:32:29,010 --> 00:32:31,140 The timing was really kind of important about it 787 00:32:31,140 --> 00:32:33,270 and it does present a dilemma 788 00:32:33,270 --> 00:32:35,790 and we recognize that the dilemma is not unique to us. 789 00:32:35,790 --> 00:32:37,590 This happens in a lot of situations 790 00:32:37,590 --> 00:32:39,720 with security disclosures. 791 00:32:39,720 --> 00:32:41,010 On the one hand, if we talk about it, 792 00:32:41,010 --> 00:32:42,990 it's gonna put unwanted attention on thousands 793 00:32:42,990 --> 00:32:45,120 of deployed vulnerable devices. 794 00:32:45,120 --> 00:32:46,530 On the other hand, if we don't talk about it, 795 00:32:46,530 --> 00:32:48,330 then the issue can't be widely understood 796 00:32:48,330 --> 00:32:50,820 and people might just keep doing the same thing 797 00:32:50,820 --> 00:32:52,170 they've always done. 798 00:32:52,170 --> 00:32:54,480 And this last part is particularly important right now 799 00:32:54,480 --> 00:32:55,770 because we're starting to define 800 00:32:55,770 --> 00:32:58,050 the new tractor trailer interface. 801 00:32:58,050 --> 00:33:00,690 And if they said that it had to maintain 802 00:33:00,690 --> 00:33:03,750 complete backwards compatibility with J2497, 803 00:33:03,750 --> 00:33:06,300 which is something that fleets would reasonably want 804 00:33:06,300 --> 00:33:07,290 because they want to make sure 805 00:33:07,290 --> 00:33:10,080 that their old equipment works with their new equipment. 806 00:33:10,080 --> 00:33:11,850 The fleets would then also inherit all 807 00:33:11,850 --> 00:33:14,850 of these security problems with J2497. 808 00:33:14,850 --> 00:33:17,910 So because right now that task force is working 809 00:33:17,910 --> 00:33:19,110 to define these things, 810 00:33:19,110 --> 00:33:21,540 we felt it was really important to do this public disclosure 811 00:33:21,540 --> 00:33:24,626 with CISA so that we could tell the various task forces 812 00:33:24,626 --> 00:33:27,783 and tanker associations and carrier associations 813 00:33:27,783 --> 00:33:31,380 to make sure that everyone understands the issue. 814 00:33:31,380 --> 00:33:35,042 We have asked the task force to make sure that J2487 815 00:33:35,042 --> 00:33:37,350 is deprecated in the next interface. 816 00:33:37,350 --> 00:33:40,650 And that will actually come to a vote in September. 817 00:33:40,650 --> 00:33:44,823 The in-person ATMC meeting and we hope they will agree, 818 00:33:46,410 --> 00:33:48,840 which brings us to probably the reason you all came here 819 00:33:48,840 --> 00:33:51,360 is let's look at some trucks chuffing, right? 820 00:33:51,360 --> 00:33:54,450 Okay, now actually getting time 821 00:33:54,450 --> 00:33:57,210 to test trucks is pretty difficult. 822 00:33:57,210 --> 00:34:00,420 So we'll just show you how Chris 823 00:34:00,420 --> 00:34:02,133 and I prepare for tests. 824 00:34:10,290 --> 00:34:12,690 Right? Okay, got it. 825 00:34:12,690 --> 00:34:14,100 Thank you for those of you that laughed. 826 00:34:14,100 --> 00:34:15,033 I appreciate that. 827 00:34:16,860 --> 00:34:19,560 Okay, in all seriousness, we will show you chuffing trucks. 828 00:34:19,560 --> 00:34:21,600 This is our demo setup. 829 00:34:21,600 --> 00:34:24,600 We have the Unichuff signal in that black box. 830 00:34:24,600 --> 00:34:27,690 We turn that into a J2497 signal 831 00:34:27,690 --> 00:34:30,180 with some code that's now public and available. 832 00:34:30,180 --> 00:34:33,930 We serialize that and play it an FL2K USB dongle 833 00:34:33,930 --> 00:34:35,520 that Chris told you about. 834 00:34:35,520 --> 00:34:37,140 That goes into a variable attenuator, 835 00:34:37,140 --> 00:34:38,850 which feeds a power amplifier. 836 00:34:38,850 --> 00:34:40,800 The reason for the variable attenuator is 837 00:34:40,800 --> 00:34:43,500 so that I don't blow up any more power amplifiers. 838 00:34:43,500 --> 00:34:44,850 That's important. 839 00:34:44,850 --> 00:34:47,460 And then we feed that into the antenna, 840 00:34:47,460 --> 00:34:49,890 which is sitting next to the truck. 841 00:34:49,890 --> 00:34:52,443 So let's do the demo. 842 00:34:53,880 --> 00:34:56,503 Oh, there we go. 843 00:35:00,300 --> 00:35:02,730 So that sound, you're hearing. That's the chuffing sound. 844 00:35:02,730 --> 00:35:06,123 That's the trailer break controller exhausting the air. 845 00:35:08,820 --> 00:35:10,257 I can see it down here. 846 00:35:11,550 --> 00:35:14,160 You can kind of see the antenna here, strung on the pylon. 847 00:35:14,160 --> 00:35:17,550 So it's those two red wires that are just to the left 848 00:35:17,550 --> 00:35:19,350 and we're at a pretty decent distance here. 849 00:35:19,350 --> 00:35:22,200 This is a triple with grain haulers, 850 00:35:22,200 --> 00:35:24,630 which are type B trailers, so there's no dollies. 851 00:35:24,630 --> 00:35:28,320 It's just three trailer brake controllers 852 00:35:28,320 --> 00:35:29,493 on these grain haulers. 853 00:35:32,310 --> 00:35:34,210 And of course the driver is in the cab 854 00:35:35,850 --> 00:35:37,140 and he has his foot on the brake. 855 00:35:37,140 --> 00:35:39,000 And because he's in the cab with his foot on the brake, 856 00:35:39,000 --> 00:35:41,610 that's why we're hearing the air chuffing out. 857 00:35:41,610 --> 00:35:45,090 Here you can see the laptop and the programmable attenuator 858 00:35:45,090 --> 00:35:47,190 and the power amplifier that feeds the antennas. 859 00:35:47,190 --> 00:35:49,650 And there's nothing else between the setup 860 00:35:49,650 --> 00:35:51,250 and the truck, very independent. 861 00:35:53,550 --> 00:35:56,950 Now what happens if you do this test for a while? 862 00:36:01,560 --> 00:36:04,980 It's not super easy to hear here at DEFCON, 863 00:36:04,980 --> 00:36:07,430 but the air stops to chuff. 864 00:36:07,430 --> 00:36:09,210 So we ran the test for quite a while 865 00:36:09,210 --> 00:36:11,310 and you can hear just the solenoid clicking much 866 00:36:11,310 --> 00:36:12,420 more than the air. 867 00:36:12,420 --> 00:36:14,490 There just isn't enough air in the reservoirs 868 00:36:14,490 --> 00:36:18,300 to keep up with the continuous chuffing commands 869 00:36:18,300 --> 00:36:19,680 that we're sending, right? 870 00:36:19,680 --> 00:36:24,680 And you definitely hear that it's different at least. 871 00:36:27,660 --> 00:36:28,493 And of course, 872 00:36:28,493 --> 00:36:29,790 if they don't have enough air in the reservoir, 873 00:36:29,790 --> 00:36:32,130 then they can't release the brakes to move the truck. 874 00:36:32,130 --> 00:36:35,010 So if a truck were caught in this situation long enough 875 00:36:35,010 --> 00:36:37,290 for roughly two to three minutes in this configuration 876 00:36:37,290 --> 00:36:39,303 for that tractor and these trailers, 877 00:36:39,303 --> 00:36:40,410 then it probably wouldn't be able 878 00:36:40,410 --> 00:36:43,233 to roll away until its compressor could keep up. 879 00:36:47,850 --> 00:36:49,410 Back to that. Okay. 880 00:36:49,410 --> 00:36:51,960 So I think you'll find that Chris 881 00:36:51,960 --> 00:36:54,450 and I have showed you that it's possible to both read 882 00:36:54,450 --> 00:36:57,030 and write these messages remotely 883 00:36:57,030 --> 00:36:59,460 on some tractor and trailer configurations. 884 00:36:59,460 --> 00:37:00,750 And in the worst case, 885 00:37:00,750 --> 00:37:02,587 writing remotely can be done for pretty cheap. 886 00:37:02,587 --> 00:37:05,700 $300 US at a very large separation, 887 00:37:05,700 --> 00:37:08,160 something that would work for ditched road 888 00:37:08,160 --> 00:37:10,230 and the rights don't just reach the trailer equipment. 889 00:37:10,230 --> 00:37:13,380 They actually reach the tractor brake controller as well. 890 00:37:13,380 --> 00:37:14,940 And both the trailer brake controllers 891 00:37:14,940 --> 00:37:17,040 and those tractor brake controllers are doing more 892 00:37:17,040 --> 00:37:19,923 than just the regulation required lamp messages. 893 00:37:21,274 --> 00:37:24,450 We could not have done the cool stuff here 894 00:37:24,450 --> 00:37:26,040 without the assistance of AIS. 895 00:37:26,040 --> 00:37:27,660 This was a really great team effort 896 00:37:27,660 --> 00:37:29,850 and we're very grateful for your assistance. 897 00:37:29,850 --> 00:37:31,830 And Dan, thank you very much. 898 00:37:31,830 --> 00:37:34,923 And Eric, who's not here, but on the stream hopefully. 899 00:37:35,850 --> 00:37:36,840 This would not have been possible 900 00:37:36,840 --> 00:37:40,470 without the support of the NMFTA member fleet carriers. 901 00:37:40,470 --> 00:37:43,410 So thank you very much to them and a huge thank you 902 00:37:43,410 --> 00:37:45,864 to this a long list of people that I won't read out, 903 00:37:45,864 --> 00:37:47,850 'cause it'll embarrass those of you that are 904 00:37:47,850 --> 00:37:48,683 in the audience. 905 00:37:48,683 --> 00:37:49,770 But thank you very much to you 906 00:37:49,770 --> 00:37:52,380 and we're happy to take your questions now. 907 00:37:52,380 --> 00:37:53,213 Thank you. 908 00:37:54,283 --> 00:37:56,866 (crowd claps) 909 00:38:04,980 --> 00:38:05,813 Yes, sir. 910 00:38:08,389 --> 00:38:11,806 (man talks indistinctly) 911 00:38:29,670 --> 00:38:32,250 - Yeah, so the question is we mentioned 912 00:38:32,250 --> 00:38:33,990 that there's some interuptability. 913 00:38:33,990 --> 00:38:36,660 I was saying bridging between 1939, 914 00:38:36,660 --> 00:38:39,120 which is a CAN bus and this 2497, 915 00:38:39,120 --> 00:38:40,980 which is a power line carrier, 916 00:38:40,980 --> 00:38:45,077 the tractor brake controllers, they connect J1939, 917 00:38:45,077 --> 00:38:48,330 'cause they're responsible for actuating the brakes 918 00:38:48,330 --> 00:38:50,190 and responding to torque and all the other messages 919 00:38:50,190 --> 00:38:51,270 on the bus, 920 00:38:51,270 --> 00:38:53,490 those tractor brake controllers in North America, 921 00:38:53,490 --> 00:38:56,370 they also have to for regulation reasons 922 00:38:56,370 --> 00:38:59,070 receive 2497 messages. 923 00:38:59,070 --> 00:39:00,990 So they're like the nexus that connects to both 924 00:39:00,990 --> 00:39:02,875 of those buses and the software in them does 925 00:39:02,875 --> 00:39:07,650 in some cases move data for various reasons. 926 00:39:07,650 --> 00:39:09,690 Does that answer your question, sir? 927 00:39:09,690 --> 00:39:10,980 Welcome. 928 00:39:10,980 --> 00:39:11,813 Yes. 929 00:39:12,810 --> 00:39:16,477 (guest speaks indistinctly) 930 00:39:17,850 --> 00:39:20,910 - Okay yeah. So is that's a good question. 931 00:39:20,910 --> 00:39:22,710 It's definitely a natural question. 932 00:39:22,710 --> 00:39:26,351 We have tested something like this when it's moving, 933 00:39:26,351 --> 00:39:28,320 the results were negative. 934 00:39:28,320 --> 00:39:31,500 So what we found and we mentioned that if you change 935 00:39:31,500 --> 00:39:34,980 the tone ring size, it doesn't make things bad either. 936 00:39:34,980 --> 00:39:37,800 What we found is that because these are ABS units, 937 00:39:37,800 --> 00:39:40,350 they have wheel speed sensors built right into them. 938 00:39:40,350 --> 00:39:43,320 The software knows intrinsically how fast it's going. 939 00:39:43,320 --> 00:39:45,510 All the ones we've tested will just not receive 940 00:39:45,510 --> 00:39:47,790 any diagnostic commands while they're in motion. 941 00:39:47,790 --> 00:39:49,650 I think you'll find in one of the slides earlier, 942 00:39:49,650 --> 00:39:50,580 I didn't say it verbally, 943 00:39:50,580 --> 00:39:54,480 but it's there that if they're in a fault state, 944 00:39:54,480 --> 00:39:56,310 some of them will actually still respond 945 00:39:56,310 --> 00:39:58,440 to the diagnostic commands either in motion, 946 00:39:58,440 --> 00:40:00,330 they have a fault and they will respond 947 00:40:00,330 --> 00:40:02,400 and that's for some of them, 948 00:40:02,400 --> 00:40:03,720 for some versions on some things. 949 00:40:03,720 --> 00:40:05,163 So your mileage may vary. 950 00:40:06,431 --> 00:40:09,848 (man talks indistinctly) 951 00:40:27,139 --> 00:40:29,490 - I mean, so we're talking about, okay, 952 00:40:29,490 --> 00:40:31,140 so the question is what would happen 953 00:40:31,140 --> 00:40:33,240 if this was somehow theoretically possible 954 00:40:33,240 --> 00:40:35,610 in motion or happened, right? 955 00:40:35,610 --> 00:40:38,163 And sorry, is that the question? 956 00:40:39,390 --> 00:40:40,350 Yeah. Okay. 957 00:40:40,350 --> 00:40:43,545 So these are air spring brakes. 958 00:40:43,545 --> 00:40:46,830 If it's just rolling and you start to deplete 959 00:40:46,830 --> 00:40:49,020 the brake pressure and no one has their foot 960 00:40:49,020 --> 00:40:49,853 on the brake or anything, 961 00:40:49,853 --> 00:40:51,510 the effect is not really gonna be anything, 962 00:40:51,510 --> 00:40:53,370 unless you get all that supply air out 963 00:40:53,370 --> 00:40:54,840 and then the brakes would start to close 964 00:40:54,840 --> 00:40:56,430 and it would slow down the vehicle. 965 00:40:56,430 --> 00:40:59,100 So it's pretty decent failure state, 966 00:40:59,100 --> 00:41:00,570 I think in terms of impact. 967 00:41:00,570 --> 00:41:02,760 the thing that kind of bothers the fleets about it 968 00:41:02,760 --> 00:41:05,340 is the access to the other diagnostic functions 969 00:41:05,340 --> 00:41:07,800 and the potential immobilization of tractor trailers 970 00:41:07,800 --> 00:41:10,473 that are stationary and then made to stay stationary, 971 00:41:11,580 --> 00:41:13,140 'cause they're big and hard to move 972 00:41:13,140 --> 00:41:15,940 and that would make things bad in a lot of cases, right. 973 00:41:16,980 --> 00:41:18,473 Does that answer your question, sir? 974 00:41:21,532 --> 00:41:22,365 Welcome. 975 00:41:28,100 --> 00:41:28,933 Okay. 976 00:41:36,120 --> 00:41:37,980 Thank you. Oh, do we have a question back here? 977 00:41:37,980 --> 00:41:39,003 Yes please. 978 00:41:41,162 --> 00:41:44,745 (guest talks indistinctly) 979 00:41:48,480 --> 00:41:49,313 It's a good question. 980 00:41:49,313 --> 00:41:51,810 So the question is can we use the same method 981 00:41:51,810 --> 00:41:55,533 to actually block activation of brakes, right? 982 00:41:57,240 --> 00:42:01,380 So brake control in North America at least is all pneumatic, 983 00:42:01,380 --> 00:42:04,200 which means it's all through pressurized air control. 984 00:42:04,200 --> 00:42:06,354 So application of the brakes and release of the brakes 985 00:42:06,354 --> 00:42:10,410 is both through the blue line that signals relay control, 986 00:42:10,410 --> 00:42:11,520 but it's all pneumatic. 987 00:42:11,520 --> 00:42:15,990 There's no way to control the breaks 988 00:42:15,990 --> 00:42:18,890 with any of the research that we've done here in that way. 989 00:42:20,370 --> 00:42:21,203 Yes, sir. 990 00:42:22,168 --> 00:42:25,835 (guest talks indistinctly) 991 00:42:44,730 --> 00:42:48,480 - Right and so the question is sort of the talk last year 992 00:42:48,480 --> 00:42:51,060 that was involved with stealing and 993 00:42:51,060 --> 00:42:53,580 or completely disabling all the shopping trolleys, 994 00:42:53,580 --> 00:42:57,570 which is a great talk and is seven kilohertz similar. 995 00:42:57,570 --> 00:42:58,680 Just like kind of Chris mentioned, 996 00:42:58,680 --> 00:43:00,057 there's a big difference between 400 kilohertz 997 00:43:00,057 --> 00:43:01,080 and 100 kilohertz. 998 00:43:01,080 --> 00:43:02,430 There's actually an even bigger difference 999 00:43:02,430 --> 00:43:04,320 between one and seven. 1000 00:43:04,320 --> 00:43:05,400 The thing that is similar is that 1001 00:43:05,400 --> 00:43:07,290 there's no authentication or authorization required. 1002 00:43:07,290 --> 00:43:09,720 So that loop that he did that just play the thing, 1003 00:43:09,720 --> 00:43:12,750 that's kind of what we did with the Unichuff as well. 1004 00:43:12,750 --> 00:43:14,130 The other really important distinction is 1005 00:43:14,130 --> 00:43:16,710 that those trollies, 1006 00:43:16,710 --> 00:43:18,930 the equipment that he was attacking had antennas 1007 00:43:18,930 --> 00:43:22,050 that were designed to receive RF. 1008 00:43:22,050 --> 00:43:23,864 They were electrical engineers, real electrical engineers, 1009 00:43:23,864 --> 00:43:26,340 did the thing and made the antennas to receive it. 1010 00:43:26,340 --> 00:43:29,384 What we're doing is convincing a power line system 1011 00:43:29,384 --> 00:43:32,190 to receive RF when it really shouldn't. 1012 00:43:32,190 --> 00:43:33,780 And so we need a lot more power 1013 00:43:33,780 --> 00:43:35,943 and oomph to make that happen. 1014 00:43:39,120 --> 00:43:39,953 You're welcome. 1015 00:43:44,700 --> 00:43:47,200 I think we're good. Thank you everybody very much.