1
00:00:00,000 --> 00:00:00,833
- All right.

2
00:00:00,833 --> 00:00:02,190
So our next talk coming up,

3
00:00:02,190 --> 00:00:04,417
is about Automotive Ethernet Fuzzing,

4
00:00:04,417 --> 00:00:07,195
From Purchasing ECU to SOME/IP Fuzzing.

5
00:00:07,195 --> 00:00:10,579
Please help me welcome to
our stage our next speaker.

6
00:00:10,579 --> 00:00:13,329
(crowd clapping)

7
00:00:16,590 --> 00:00:18,000
- Hello everyone.

8
00:00:18,000 --> 00:00:19,791
My name is Jonghyuk Song,

9
00:00:19,791 --> 00:00:22,860
who is the first source of this research.

10
00:00:22,860 --> 00:00:24,513
The title of this talk is,

11
00:00:25,620 --> 00:00:27,150
Automotive Ethernet Fuzzing,

12
00:00:27,150 --> 00:00:29,970
From Purchasing ECU to SOME/IP Fuzzing.

13
00:00:29,970 --> 00:00:32,250
In this talk, I would like to describe,

14
00:00:32,250 --> 00:00:34,380
how to purchase Automotive ECU,

15
00:00:34,380 --> 00:00:37,713
how to set up them and
how to do SOME/IP Fuzzing.

16
00:00:39,000 --> 00:00:44,000
So who we are, we are, sorry.

17
00:00:44,040 --> 00:00:47,755
We are Red team and Blue
team members in AUTOCRYPT.

18
00:00:47,755 --> 00:00:51,016
AUTOCRYPT is a mobility security company

19
00:00:51,016 --> 00:00:55,508
and especially we focus on
the automotive cyber security.

20
00:00:55,508 --> 00:00:59,179
We have conducting fantastic
and fuzzing testing,

21
00:00:59,179 --> 00:01:02,790
with auto makers and tier suppliers.

22
00:01:02,790 --> 00:01:06,030
Also, currently we are
developing a future,

23
00:01:06,030 --> 00:01:08,700
for automotive specific protocols,

24
00:01:08,700 --> 00:01:11,431
such as CAN and Automotive Ethernet.

25
00:01:11,431 --> 00:01:15,780
So in this talk, I would
like to share tips,

26
00:01:15,780 --> 00:01:17,966
know how and my experience,

27
00:01:17,966 --> 00:01:22,538
how to do Automotive Ethernet
Fuzzing using your own ECU.

28
00:01:22,538 --> 00:01:26,370
But, you know, 20 minutes is
not enough to talk the details.

29
00:01:26,370 --> 00:01:29,493
So please don't hesitate to contact to me.

30
00:01:31,260 --> 00:01:32,970
So this talk is trying to answer,

31
00:01:32,970 --> 00:01:34,890
the following two questions.

32
00:01:34,890 --> 00:01:38,343
First, how to set up test
environment with the real ECUs?

33
00:01:39,300 --> 00:01:42,950
Second, how to do Automotive
Ethernet Fuzzing on the ECU?

34
00:01:44,160 --> 00:01:46,290
So this talk will be a practical guide,

35
00:01:46,290 --> 00:01:49,350
to SOME/IP Fuzzing with the real ECU.

36
00:01:49,350 --> 00:01:53,283
I hope that it will be useful
for car hacking beginners.

37
00:01:55,080 --> 00:01:56,460
So let's talk about first,

38
00:01:56,460 --> 00:01:58,160
the Advent of Automotive Ethernet.

39
00:02:00,270 --> 00:02:02,220
This Advent in car becoming more complex,

40
00:02:02,220 --> 00:02:03,570
than smart phones.

41
00:02:03,570 --> 00:02:07,380
So they are required
higher data bandwidth,

42
00:02:07,380 --> 00:02:12,380
for various function, such as
ADAS and Infotainment system.

43
00:02:14,280 --> 00:02:16,344
But CAN is not enough to handle it.

44
00:02:16,344 --> 00:02:20,700
So automakers have started
to adapt Automotive Ethernet.

45
00:02:20,700 --> 00:02:24,960
After BMW released their cars
with Automotive Ethernet,

46
00:02:24,960 --> 00:02:27,701
many automakers have released their car,

47
00:02:27,701 --> 00:02:29,973
supporting Automotive Ethernet.

48
00:02:33,360 --> 00:02:34,380
Let's take a look at,

49
00:02:34,380 --> 00:02:36,873
the Automotive Ethernet Network Layers.

50
00:02:38,526 --> 00:02:42,193
Automotive Ethernet is
based on TCP and UDP.

51
00:02:43,477 --> 00:02:47,436
There are two main protocols
in Automotive Ethernet.

52
00:02:47,436 --> 00:02:51,660
First one is DoIP, it's
a diagnostic protocol.

53
00:02:51,660 --> 00:02:54,229
It's almost like UDS CAN.

54
00:02:54,229 --> 00:02:58,530
Second one is SOME/IP, which
will be covered in this talk.

55
00:02:58,530 --> 00:03:01,672
It's a control communication
protocol between ECU,

56
00:03:01,672 --> 00:03:06,222
such as remote processor
controllers and event notification.

57
00:03:06,222 --> 00:03:10,650
And there is actually, there
is, or more SOME/IP-SD,

58
00:03:10,650 --> 00:03:14,253
which is SOME/IP, Service
Discovery Protocol.

59
00:03:15,903 --> 00:03:17,878
It is service discovery protocol,

60
00:03:17,878 --> 00:03:20,021
using this protocol,

61
00:03:20,021 --> 00:03:25,021
ECU advertised their services
and can get the information,

62
00:03:27,600 --> 00:03:30,390
about services running in other ECU.

63
00:03:30,390 --> 00:03:32,583
Sorry about bad condition.

64
00:03:34,170 --> 00:03:37,350
So why we do Automotive Ethernet Fuzzing?

65
00:03:37,350 --> 00:03:41,552
As you know, Automotive
Ethernet has adapted recently.

66
00:03:41,552 --> 00:03:45,540
So Automotive Ethernet has
not yet been tested enough.

67
00:03:45,540 --> 00:03:47,670
So there is not much research about,

68
00:03:47,670 --> 00:03:49,923
also there is not much research about it.

69
00:03:50,880 --> 00:03:55,880
So let's try SOME/IP Fuzzing
with me, it will be fun.

70
00:03:56,250 --> 00:03:59,618
Then, should I, should we buy a car?

71
00:03:59,618 --> 00:04:00,753
Is it essential?

72
00:04:02,933 --> 00:04:07,230
You know, it's expensive
to buy a whole car,

73
00:04:07,230 --> 00:04:08,940
for every single test.

74
00:04:08,940 --> 00:04:12,150
This is why we cannot try car hacking.

75
00:04:12,150 --> 00:04:16,557
We cannot buy a car every
time whenever we want to test.

76
00:04:16,557 --> 00:04:21,557
So in this talk, we suggest
that let's hack an ECU first.

77
00:04:23,250 --> 00:04:27,210
If you success to find
vulnerability in that ECU,

78
00:04:27,210 --> 00:04:29,493
maybe you can exploit a little car.

79
00:04:30,780 --> 00:04:35,280
But how buying a car is difficult,

80
00:04:35,280 --> 00:04:40,233
but buying an ECU and set
up them is not also easy.

81
00:04:42,066 --> 00:04:45,340
First, where can you buy the ECU?

82
00:04:46,335 --> 00:04:49,383
And which ECU is proper for test?

83
00:04:50,760 --> 00:04:54,243
Can you know, the ECU is
supporting SOME/IP or not?

84
00:04:55,620 --> 00:04:58,680
If we know that, how to set up the ECU?

85
00:04:58,680 --> 00:05:03,153
How to connect and how
to wire that with my PC?

86
00:05:04,798 --> 00:05:06,690
In this talk, I'm going to tell you,

87
00:05:06,690 --> 00:05:08,403
how to do that, step by step.

88
00:05:11,461 --> 00:05:13,597
First step is selecting ECU,

89
00:05:14,490 --> 00:05:17,340
not all ECU support Automotive Ethernet,

90
00:05:17,340 --> 00:05:21,724
so we should buy an ECU, that
support Automotive Ethernet.

91
00:05:21,724 --> 00:05:23,622
We can get this information,

92
00:05:23,622 --> 00:05:27,131
in the wiring diagram or the ECU.

93
00:05:27,131 --> 00:05:29,781
Second step is buying ECU.

94
00:05:29,781 --> 00:05:33,092
You can buy the used ECU in eBay,

95
00:05:33,092 --> 00:05:37,759
but we bought the ECU from,
BMW official service center.

96
00:05:39,651 --> 00:05:40,984
This is new one.

97
00:05:43,211 --> 00:05:46,260
Third step is setup test environment.

98
00:05:46,260 --> 00:05:48,570
In this step, we wire and connect,

99
00:05:48,570 --> 00:05:51,354
between my laptop and ECU,

100
00:05:51,354 --> 00:05:54,843
by referring the diagram
and pin map of the ECU.

101
00:05:56,700 --> 00:06:00,330
Fourth step is network
configuration for SOME/IP,

102
00:06:00,330 --> 00:06:03,090
we should compare our laptop's network,

103
00:06:03,090 --> 00:06:06,840
network setting to communicate
with SOME/IP services,

104
00:06:06,840 --> 00:06:07,687
in the ECU.

105
00:06:08,880 --> 00:06:12,840
And next step is discovering
SOME/IP services.

106
00:06:12,840 --> 00:06:14,957
We should find out the
service ID and port number,

107
00:06:14,957 --> 00:06:17,377
of the SOME/IP services running the ECU.

108
00:06:18,280 --> 00:06:20,523
After that, finally, we can do Fuzzing.

109
00:06:22,560 --> 00:06:25,233
Okay, let's talk about how
to select the ECU first.

110
00:06:26,318 --> 00:06:30,330
First, we should select the ECU.

111
00:06:30,330 --> 00:06:35,330
In this research, we chose a
head unit ECU, of BMW iX model.

112
00:06:35,400 --> 00:06:38,280
The reason why we select head unit is,

113
00:06:38,280 --> 00:06:41,430
most head unit ECUs support
Automotive Ethernet.

114
00:06:41,430 --> 00:06:43,953
The reason why we chose BMW is,

115
00:06:44,807 --> 00:06:48,236
BMW is Automotive Ethernet
industrial leader.

116
00:06:48,236 --> 00:06:50,700
As I say, BMW is the first automakers,

117
00:06:50,700 --> 00:06:53,043
to release a car with Automotive Ethernet.

118
00:06:53,964 --> 00:06:56,435
Another reason why we chose BMW is,

119
00:06:56,435 --> 00:06:59,520
BMW provides their ECU information,

120
00:06:59,520 --> 00:07:01,863
on Technical Information Site.

121
00:07:03,390 --> 00:07:05,670
So we can get the
information about the ECU,

122
00:07:05,670 --> 00:07:09,363
such as wiring diagram,
pin map on the TIS.

123
00:07:10,762 --> 00:07:12,483
This is why we chose BMW.

124
00:07:14,373 --> 00:07:18,270
So now we have to check the wire diagrams,

125
00:07:18,270 --> 00:07:20,580
to find out whether head unit ECU,

126
00:07:20,580 --> 00:07:22,533
really supports Automotive Ethernet.

127
00:07:25,230 --> 00:07:28,610
These are some screenshot
of the BMW TIS site.

128
00:07:29,700 --> 00:07:31,470
Actually, this is the paid service.

129
00:07:31,470 --> 00:07:34,440
So I should hide some
parts of the screenshot,

130
00:07:34,440 --> 00:07:35,643
please understand that.

131
00:07:36,510 --> 00:07:39,453
You can see the whole information
on the TIS, if you pay.

132
00:07:40,560 --> 00:07:43,260
In this site, of course,
there are lots of ECU data,

133
00:07:43,260 --> 00:07:45,810
so you can search the data by VIN number,

134
00:07:45,810 --> 00:07:47,670
to find what you want.

135
00:07:47,670 --> 00:07:51,800
So right figure shows that
we found wiring diagram,

136
00:07:51,800 --> 00:07:54,093
of the head unit ECU by searching.

137
00:07:55,072 --> 00:07:58,290
Maybe you don't have a BMW car,

138
00:07:58,290 --> 00:08:00,210
so maybe you don't have a VIN number,

139
00:08:00,210 --> 00:08:01,740
but don't worry about that,

140
00:08:01,740 --> 00:08:03,633
you can find a VIN number on Google.

141
00:08:05,599 --> 00:08:09,213
So finally, we can get
the wiring diagram in TIS,

142
00:08:10,170 --> 00:08:13,410
you can see that there already
done a line in the diagram.

143
00:08:13,410 --> 00:08:16,950
So finally, we can be sure
that this head unit ECU,

144
00:08:16,950 --> 00:08:18,573
supports Automotive Ethernet.

145
00:08:19,620 --> 00:08:20,793
So let's buy it.

146
00:08:22,427 --> 00:08:27,030
In South Korea, some official
BMW service centers sell ECU,

147
00:08:27,030 --> 00:08:30,432
but I don't know the other
country service center,

148
00:08:30,432 --> 00:08:31,599
also sell ECU.

149
00:08:32,580 --> 00:08:35,700
Anyway, we bought a new
ECU from service center.

150
00:08:35,700 --> 00:08:37,440
We just called to the service center

151
00:08:37,440 --> 00:08:40,020
and ask to buy the ECU.

152
00:08:40,020 --> 00:08:43,855
And we visited the service
center, to get the ECU.

153
00:08:43,855 --> 00:08:46,437
Tesla also sells ECU,

154
00:08:46,437 --> 00:08:49,183
but you should install
the ECU on your car,

155
00:08:49,183 --> 00:08:51,900
in the service center.

156
00:08:51,900 --> 00:08:54,570
It means you cannot
bring out only the ECU,

157
00:08:54,570 --> 00:08:57,390
to the out of the service center.

158
00:08:57,390 --> 00:08:58,530
In Hyundai case,

159
00:08:58,530 --> 00:09:02,163
you can get Hyundai's ECU
from the Hyundai Mobis center.

160
00:09:03,273 --> 00:09:07,050
Of course, you don't have
to buy the new ECU always,

161
00:09:07,050 --> 00:09:09,840
you can buy used ECU from eBay.

162
00:09:09,840 --> 00:09:11,670
If you search the ECU on eBay,

163
00:09:11,670 --> 00:09:14,190
maybe you can find right type of ECU,

164
00:09:14,190 --> 00:09:18,690
but I cannot guarantee that
the used ECU works well.

165
00:09:18,690 --> 00:09:22,023
Also, it's a difficult
to find the latest model.

166
00:09:23,730 --> 00:09:26,310
Okay, now we've got the ECU.

167
00:09:26,310 --> 00:09:28,143
Let's Setup the test environment.

168
00:09:30,270 --> 00:09:33,873
This is the overview, our
overview of our test environment.

169
00:09:36,570 --> 00:09:41,570
This is the ECU, or there
is no my, mouse control?

170
00:09:42,275 --> 00:09:44,857
Above that, there is ECU

171
00:09:44,857 --> 00:09:47,860
and left side, there is my laptop

172
00:09:48,840 --> 00:09:51,510
and we connected the laptop and ECU,

173
00:09:51,510 --> 00:09:53,790
using the media converter.

174
00:09:53,790 --> 00:09:56,280
The media converter, is
the essential device,

175
00:09:56,280 --> 00:09:59,193
for testing Automotive Ethernet.

176
00:10:00,943 --> 00:10:03,720
Automotive Ethernet is different from,

177
00:10:03,720 --> 00:10:05,123
the standard Ethernet,

178
00:10:05,123 --> 00:10:07,293
used in the normal PC environment.

179
00:10:08,400 --> 00:10:11,790
So if we want to communicate with the ECU,

180
00:10:11,790 --> 00:10:14,940
using Automotive Ethernet,
you should convert it.

181
00:10:14,940 --> 00:10:17,493
The media convertor
can do that conversion,

182
00:10:18,641 --> 00:10:21,300
and there should be power supply,

183
00:10:21,300 --> 00:10:23,170
to supply power to the ECU.

184
00:10:24,143 --> 00:10:27,603
This is the real photo
of the previous overview.

185
00:10:30,034 --> 00:10:32,910
And there is ECU, and there is a laptop,

186
00:10:32,910 --> 00:10:34,590
there is a media convertor.

187
00:10:34,590 --> 00:10:36,990
And actually we also bought the display,

188
00:10:36,990 --> 00:10:40,350
because we expected to see
something on the display,

189
00:10:40,350 --> 00:10:43,833
but it was nothing useful in this test.

190
00:10:44,940 --> 00:10:49,503
Anyway, there is a power
supply, to supply the power.

191
00:10:51,090 --> 00:10:52,293
And, oh, sorry.

192
00:10:53,500 --> 00:10:56,190
If you want to connect like this,

193
00:10:56,190 --> 00:10:58,890
you will need a wiring
diagram and pin map,

194
00:10:58,890 --> 00:11:00,960
to know which port in the ECU

195
00:11:00,960 --> 00:11:04,560
and which port in the ECU
is for Automotive Ethernet,

196
00:11:04,560 --> 00:11:08,910
and which port is for power
and which port is for display.

197
00:11:08,910 --> 00:11:12,093
I'm gonna show in detail how
to each part was connected.

198
00:11:13,477 --> 00:11:15,870
So let's connect power first.

199
00:11:15,870 --> 00:11:19,702
To connect power, you should
find power pin, ground pin

200
00:11:19,702 --> 00:11:22,653
and Ethernet wake up pin in the pin map.

201
00:11:24,930 --> 00:11:27,330
If you find all of them in the pin map,

202
00:11:27,330 --> 00:11:32,130
you can match the battery
with the layer ECU pin.

203
00:11:32,130 --> 00:11:34,563
Then you can connect them to power supply.

204
00:11:35,819 --> 00:11:37,320
I cannot show you though,

205
00:11:37,320 --> 00:11:42,320
real pin map in this slide
because that's not free data.

206
00:11:43,919 --> 00:11:48,663
Then we connected to display
by also referring pin map.

207
00:11:50,769 --> 00:11:54,180
Now let's turn on the BMW string,

208
00:11:54,180 --> 00:11:56,190
showed up on the display.

209
00:11:56,190 --> 00:11:59,610
So we can know that we
successfully supply powers,

210
00:11:59,610 --> 00:12:00,963
to each device.

211
00:12:03,395 --> 00:12:06,180
Now let's connect ECU and the laptop,

212
00:12:06,180 --> 00:12:07,930
to communicate Automotive Ethernet.

213
00:12:08,930 --> 00:12:10,590
Also, you should check the pin map

214
00:12:10,590 --> 00:12:12,710
and find Automotive Ethernet port.

215
00:12:12,710 --> 00:12:15,380
In this case, the
rightest port of the ECU,

216
00:12:15,380 --> 00:12:17,100
is Ethernet port.

217
00:12:17,100 --> 00:12:20,508
So we connected to the media converter.

218
00:12:20,508 --> 00:12:24,764
Then we connect the media
converter to the laptop.

219
00:12:24,764 --> 00:12:27,720
This media converter
has two Ethernet port,

220
00:12:27,720 --> 00:12:31,546
SFP port and Rj45 port.

221
00:12:31,546 --> 00:12:34,710
SFP port is used to exchange SOME/IP data,

222
00:12:34,710 --> 00:12:36,826
between laptop and ECU.

223
00:12:36,826 --> 00:12:41,313
Rj45 port is connecting control
page of the media converter.

224
00:12:42,660 --> 00:12:46,260
Maybe each media converter
has different interface,

225
00:12:46,260 --> 00:12:50,013
so you should check the manual
of your media converter.

226
00:12:52,050 --> 00:12:55,380
Now connecting and wiring is finished,

227
00:12:55,380 --> 00:12:58,110
then we should configure our
laptops network settings,

228
00:12:58,110 --> 00:13:00,063
to communicate SOME/IP service.

229
00:13:03,180 --> 00:13:05,190
People that I'm gonna tell you for trying,

230
00:13:05,190 --> 00:13:06,870
which is VLAN.

231
00:13:06,870 --> 00:13:09,810
Automotive Ethernet uses VLAN to separate,

232
00:13:09,810 --> 00:13:12,240
in-vehicle network logically.

233
00:13:12,240 --> 00:13:16,290
Because they want to isolate
traffic from different domains.

234
00:13:16,290 --> 00:13:19,110
So anyway, if you want to
communicate with the ECU,

235
00:13:19,110 --> 00:13:20,580
by Automotive Ethernet,

236
00:13:20,580 --> 00:13:24,520
you should know the VLAN
ID, of the ECU's network.

237
00:13:25,539 --> 00:13:30,180
The ECU net, the VID is in the VLAN Tag.

238
00:13:30,180 --> 00:13:33,153
There is one more feature
in Ethernet frame,

239
00:13:34,888 --> 00:13:36,300
with the VLAN tag.

240
00:13:36,300 --> 00:13:39,218
So to communicate Automotive Ethernet,

241
00:13:39,218 --> 00:13:41,313
we should find out the VID.

242
00:13:43,650 --> 00:13:46,950
In previous tab, we connected
the ECU and the laptop,

243
00:13:46,950 --> 00:13:51,510
so we can see SOME/IP
packet by using Wireshark.

244
00:13:51,510 --> 00:13:54,038
You know, Wireshark is amazing tool.

245
00:13:54,038 --> 00:13:58,382
There is already SOME/IP
programing in Wireshark.

246
00:13:58,382 --> 00:14:02,247
So we can see the SOME/IP
packages very comfortably.

247
00:14:02,247 --> 00:14:06,698
As you can see, we can
see the VID in the packet.

248
00:14:06,698 --> 00:14:09,903
And of course you can know
the IP address of the ECU.

249
00:14:10,862 --> 00:14:13,680
One thing you need to be aware is,

250
00:14:13,680 --> 00:14:17,970
some USB to Ethernet adapter,
doesn't show VLAN ID.

251
00:14:17,970 --> 00:14:20,040
I don't know why exactly,

252
00:14:20,040 --> 00:14:22,080
maybe some adapter, network adapter,

253
00:14:22,080 --> 00:14:24,240
doesn't support feed VLAN.

254
00:14:24,240 --> 00:14:27,014
Anyway, if you cannot see the VLAN ID,

255
00:14:27,014 --> 00:14:30,213
it's a good idea to
change to another adapter.

256
00:14:32,100 --> 00:14:36,090
So now we can configure the
network setting for laptop.

257
00:14:36,090 --> 00:14:39,566
In windows, you can find
the VLAN configuration,

258
00:14:39,566 --> 00:14:41,880
in internet properties.

259
00:14:41,880 --> 00:14:45,838
You should select, Packet
Priority and VLAN enable

260
00:14:45,838 --> 00:14:50,283
and insert VLAN ID, in
the VLAN ID section.

261
00:14:51,574 --> 00:14:54,540
You should say IP address,

262
00:14:54,540 --> 00:14:57,127
which is in the same
sub network of the ECU.

263
00:14:59,490 --> 00:15:03,393
Okay, now let's talk about how
to discover SOME/IP services.

264
00:15:05,618 --> 00:15:08,434
Usually there are
several SOME/IP services,

265
00:15:08,434 --> 00:15:12,960
running in the ECU and
each service are running,

266
00:15:12,960 --> 00:15:17,160
on the different port,
with different service IDs.

267
00:15:17,160 --> 00:15:19,708
So to force or summon service,

268
00:15:19,708 --> 00:15:23,523
we should know the port
number and service ID.

269
00:15:24,720 --> 00:15:28,230
There are two ways to get
the port and service ID.

270
00:15:28,230 --> 00:15:31,470
First one is checking all OFFER message.

271
00:15:31,470 --> 00:15:36,470
Usually most ECU periodically
broadcast OFFER message,

272
00:15:36,930 --> 00:15:40,023
containing the service
ID and port numbers.

273
00:15:41,460 --> 00:15:46,260
This OFFER message is the one
of the SOME/IP-SD message,

274
00:15:46,260 --> 00:15:48,603
is kind of advertise message.

275
00:15:49,528 --> 00:15:52,140
So we can know the port and service ID,

276
00:15:52,140 --> 00:15:53,290
from the OFFER message.

277
00:15:54,420 --> 00:15:57,457
Second method is sending
FIND message to the ECU.

278
00:15:58,500 --> 00:16:02,550
FIND message is also one of
the SOME/IP-SD message style.

279
00:16:02,550 --> 00:16:05,784
If there is no OFFER
message in the target ECU,

280
00:16:05,784 --> 00:16:08,400
you can use the FIND message.

281
00:16:08,400 --> 00:16:11,357
If you send a FIND message to the ECU,

282
00:16:11,357 --> 00:16:14,048
with all possible service ID,

283
00:16:14,048 --> 00:16:16,860
the ECU will respond with OFFER message,

284
00:16:16,860 --> 00:16:20,223
only for the available
service IDs in the ECU.

285
00:16:21,210 --> 00:16:22,860
So from the response,

286
00:16:22,860 --> 00:16:26,763
we can know the available
service IDs and ports in the ECU.

287
00:16:27,930 --> 00:16:31,080
Right figure show that
one of the OFFER message,

288
00:16:31,080 --> 00:16:34,410
as you can see the port
number and service ID,

289
00:16:34,410 --> 00:16:35,883
in the OFFER message.

290
00:16:36,808 --> 00:16:40,443
So now we are ready to Fuzz.

291
00:16:42,630 --> 00:16:45,090
This is a structure of SOME/IP packet,

292
00:16:45,090 --> 00:16:49,500
to generate Fuzzing input,
we should know about it.

293
00:16:49,500 --> 00:16:53,970
First, there are a
Service ID and Method ID.

294
00:16:53,970 --> 00:16:55,470
I recommend that you use,

295
00:16:55,470 --> 00:16:58,593
the available Service ID,
Method ID, importing data.

296
00:16:59,823 --> 00:17:04,823
If Fuzzing input contains
unavailable Service or Method ID,

297
00:17:05,130 --> 00:17:07,140
the input will be filtered.

298
00:17:07,140 --> 00:17:09,480
And ECU will return unavailable service

299
00:17:09,480 --> 00:17:11,583
or unavailable method ID.

300
00:17:13,320 --> 00:17:16,320
I already described how to
find available service ID,

301
00:17:16,320 --> 00:17:18,000
in the previous slide.

302
00:17:18,000 --> 00:17:20,220
You can find available Method ID,

303
00:17:20,220 --> 00:17:21,423
using similar method.

304
00:17:22,290 --> 00:17:25,440
And next Client ID and
Session ID is not important,

305
00:17:25,440 --> 00:17:27,390
in my experience.

306
00:17:27,390 --> 00:17:29,730
Also, Protocol Version, Interface Version,

307
00:17:29,730 --> 00:17:31,653
are fixed to always one.

308
00:17:32,760 --> 00:17:34,310
You don't need to fuzzing them.

309
00:17:35,203 --> 00:17:38,643
And there are several
Message types in SOME/IP.

310
00:17:39,920 --> 00:17:42,060
The message type of the Fuzzing input,

311
00:17:42,060 --> 00:17:45,363
should be one of the values
in this table, right table.

312
00:17:46,860 --> 00:17:49,857
And last one is Payload,
it's most important.

313
00:17:49,857 --> 00:17:53,490
Each SOME/IP service
have own Payload format.

314
00:17:53,490 --> 00:17:57,810
So mutating normal packet
is the best strategy.

315
00:17:57,810 --> 00:17:59,400
The way to get normal packet,

316
00:17:59,400 --> 00:18:01,650
is just connecting several ECUs.

317
00:18:01,650 --> 00:18:04,560
If you can connect multiple ECU,

318
00:18:04,560 --> 00:18:07,800
by Automotive Ethernet
lines, they will exchange,

319
00:18:07,800 --> 00:18:09,870
SOME/IP packets,

320
00:18:09,870 --> 00:18:12,115
then you can get the normal packets,

321
00:18:12,115 --> 00:18:15,333
that can be used for a
shield of the Fuzzing.

322
00:18:17,105 --> 00:18:20,760
Then how to monitor the ECU state?

323
00:18:20,760 --> 00:18:23,613
How do we know whether the
fuzzer found crash our ECUs?

324
00:18:25,560 --> 00:18:28,290
We recommend the three method.

325
00:18:28,290 --> 00:18:30,360
First one is Return codes.

326
00:18:30,360 --> 00:18:33,030
In SOME/IP-SD message,
there is return code.

327
00:18:33,030 --> 00:18:34,620
You can guess the ECU state,

328
00:18:34,620 --> 00:18:37,950
but it's hard to know
to detail information.

329
00:18:37,950 --> 00:18:41,100
Second is checking
response of valid request.

330
00:18:41,100 --> 00:18:43,020
After the Fuzzing input transmission,

331
00:18:43,020 --> 00:18:45,630
you can send the valid message to the ECU,

332
00:18:45,630 --> 00:18:47,847
then if there is no response from the ECU,

333
00:18:47,847 --> 00:18:50,733
you can guess that the
SOME/IP service is dead.

334
00:18:51,582 --> 00:18:54,750
Third method is checking
periodic SOME/IP-SD message,

335
00:18:54,750 --> 00:18:56,370
from the ECU.

336
00:18:56,370 --> 00:18:59,970
If target ECU broadcast
SOME/IP-SD message periodically,

337
00:18:59,970 --> 00:19:03,780
you can check whether the
message is still transmitted,

338
00:19:03,780 --> 00:19:04,613
after Fuzzing.

339
00:19:07,067 --> 00:19:10,170
Also how to implement SOME/IP Fuzzer.

340
00:19:10,170 --> 00:19:15,170
Luckily, sorry, there are
already SOME/IP Python in Scapy,

341
00:19:15,600 --> 00:19:17,950
so you can easily
implement a SOME/IP Fuzzer,

342
00:19:17,950 --> 00:19:19,143
using Python.

343
00:19:21,600 --> 00:19:24,240
So until now, we've tried fuzzing tests,

344
00:19:24,240 --> 00:19:25,710
to the BMW head unit.

345
00:19:25,710 --> 00:19:28,456
Actually, we tried to many OEMs

346
00:19:28,456 --> 00:19:33,456
and we still keep trying
to press strategies,

347
00:19:33,780 --> 00:19:37,564
but you cannot find any ECUs from BMW,

348
00:19:37,564 --> 00:19:41,700
but actually found some
questions from other OEMs ECU.

349
00:19:41,700 --> 00:19:43,140
I want to share it,

350
00:19:43,140 --> 00:19:45,780
but I cannot disclose it because of NDA,

351
00:19:45,780 --> 00:19:47,610
please understand that.

352
00:19:47,610 --> 00:19:49,290
The point of this talk is describing,

353
00:19:49,290 --> 00:19:52,650
the best sort, how to show my
Fuzzing, using your own ECU,

354
00:19:52,650 --> 00:19:55,233
not describing vulnerability that I found.

355
00:19:57,180 --> 00:20:00,090
So anyway, I conclude my talk.

356
00:20:00,090 --> 00:20:03,420
In this talk, I want
to tell you two things.

357
00:20:03,420 --> 00:20:06,510
First, you can do car hacking, using ECU.

358
00:20:06,510 --> 00:20:08,880
You don't need to buy a car.

359
00:20:08,880 --> 00:20:11,160
I hope that you'll try your car hacking,

360
00:20:11,160 --> 00:20:13,348
by buying and setting up ECUs.

361
00:20:13,348 --> 00:20:16,440
Second, I enjoyed the
third half to Fuzzing,

362
00:20:16,440 --> 00:20:19,350
on SOME/IP services of the real issue.

363
00:20:19,350 --> 00:20:21,604
I think Fuzzing Automotive Ethernet,

364
00:20:21,604 --> 00:20:24,282
has not been sufficiently studied.

365
00:20:24,282 --> 00:20:26,250
It's early stage.

366
00:20:26,250 --> 00:20:27,663
There is too much to fuzz.

367
00:20:28,530 --> 00:20:30,390
So I recommend you guys,

368
00:20:30,390 --> 00:20:32,892
to try test Automotive Ethernet.

369
00:20:32,892 --> 00:20:35,240
This talk can be a good guide.

370
00:20:35,240 --> 00:20:38,820
In fact, recently we are
also trying DoIP Fuzzing.

371
00:20:38,820 --> 00:20:41,403
I hope that we can share some result soon.

372
00:20:42,900 --> 00:20:46,775
Okay, this is end of my
talk, thank you very much.

373
00:20:46,775 --> 00:20:48,128
(crowd clapping)