1
00:00:00,000 --> 00:00:01,920
come to security like the 80s how i

2
00:00:01,920 --> 00:00:05,200
stole your rf and we'll be exploring cve

3
00:00:05,200 --> 00:00:08,960
2022 27254 and more

4
00:00:08,960 --> 00:00:10,559
so who am i

5
00:00:10,559 --> 00:00:12,160
my name is iphone rajesh and i'm an

6
00:00:12,160 --> 00:00:13,679
aspiring security researcher and a

7
00:00:13,679 --> 00:00:14,799
student at the university of

8
00:00:14,799 --> 00:00:16,960
massachusetts dartmouth

9
00:00:16,960 --> 00:00:19,520
you can go visit my website or follow me

10
00:00:19,520 --> 00:00:21,439
and reach out to me on either twitter

11
00:00:21,439 --> 00:00:23,039
and you can also go check out my github

12
00:00:23,039 --> 00:00:26,720
repositories and the co-author for this

13
00:00:26,720 --> 00:00:29,519
is papa mikhail also known as scott

14
00:00:29,519 --> 00:00:31,599
he's a sub gigahertz architect for

15
00:00:31,599 --> 00:00:33,920
flipper devices and you can reach out to

16
00:00:33,920 --> 00:00:35,600
him at telegram

17
00:00:35,600 --> 00:00:38,719
or even check out his github repo

18
00:00:38,719 --> 00:00:40,079
so

19
00:00:40,079 --> 00:00:41,760
these are the

20
00:00:41,760 --> 00:00:42,719
videos

21
00:00:42,719 --> 00:00:44,320
that introduced me to the very concept

22
00:00:44,320 --> 00:00:45,920
of cyber security

23
00:00:45,920 --> 00:00:47,920
uh so huge shout out to sammy conker

24
00:00:47,920 --> 00:00:50,719
hack five and even defcon for teaching

25
00:00:50,719 --> 00:00:53,680
me what cyber security is and which even

26
00:00:53,680 --> 00:00:56,239
got me interested in the field

27
00:00:56,239 --> 00:00:58,399
um and it's been almost seven years and

28
00:00:58,399 --> 00:01:00,320
it's insane that i have this opportunity

29
00:01:00,320 --> 00:01:02,960
now so quick disclaimer

30
00:01:02,960 --> 00:01:04,799
no key fobs are harmless making in the

31
00:01:04,799 --> 00:01:06,960
making of this presentation and please

32
00:01:06,960 --> 00:01:08,400
don't try stealing cars this

33
00:01:08,400 --> 00:01:11,439
presentation in no way is to encourage

34
00:01:11,439 --> 00:01:12,880
vehicle theft

35
00:01:12,880 --> 00:01:15,920
so story time how did i get

36
00:01:15,920 --> 00:01:19,040
this so this all started off for a

37
00:01:19,040 --> 00:01:21,680
class in college last semester

38
00:01:21,680 --> 00:01:25,439
which was ece 488 cyber security

39
00:01:25,439 --> 00:01:27,520
cyber threats and security management by

40
00:01:27,520 --> 00:01:28,799
professor liu

41
00:01:28,799 --> 00:01:32,479
and we had to do a project for the class

42
00:01:32,479 --> 00:01:33,439
and

43
00:01:33,439 --> 00:01:36,079
i thought to myself why not take this

44
00:01:36,079 --> 00:01:37,360
opportunity

45
00:01:37,360 --> 00:01:39,119
and try something new something that

46
00:01:39,119 --> 00:01:41,439
i've been wanting to do for so long

47
00:01:41,439 --> 00:01:42,240
so

48
00:01:42,240 --> 00:01:43,200
i

49
00:01:43,200 --> 00:01:46,079
was searching around and i came across

50
00:01:46,079 --> 00:01:47,520
the cve

51
00:01:47,520 --> 00:01:52,240
for a 2017 honda crv and i thought

52
00:01:52,240 --> 00:01:55,520
um i have a honda civic it's 2018 it's

53
00:01:55,520 --> 00:01:57,119
not mentioned here

54
00:01:57,119 --> 00:01:59,280
and why not try it myself

55
00:01:59,280 --> 00:02:02,719
so i went through the repositories and

56
00:02:02,719 --> 00:02:03,759
um

57
00:02:03,759 --> 00:02:05,439
i saw two

58
00:02:05,439 --> 00:02:08,080
uh links which was to a github

59
00:02:08,080 --> 00:02:11,440
repository by hacking in your heart uh

60
00:02:11,440 --> 00:02:13,760
his name is blake berry and the

61
00:02:13,760 --> 00:02:16,160
vulnerability was first reported by

62
00:02:16,160 --> 00:02:18,319
uh victor cazares another security

63
00:02:18,319 --> 00:02:19,520
researcher

64
00:02:19,520 --> 00:02:21,120
so

65
00:02:21,120 --> 00:02:23,760
i went on facebook marketplace

66
00:02:23,760 --> 00:02:25,360
found a

67
00:02:25,360 --> 00:02:29,040
hack rf for about 200 250

68
00:02:29,040 --> 00:02:31,840
got it and tested on my car and

69
00:02:31,840 --> 00:02:32,879
it worked

70
00:02:32,879 --> 00:02:34,000
so

71
00:02:34,000 --> 00:02:37,519
what next i realized that the cv only

72
00:02:37,519 --> 00:02:40,480
mentioned a 2017 car and i thought why

73
00:02:40,480 --> 00:02:44,560
not build on to it why not try and add

74
00:02:44,560 --> 00:02:47,040
to make a complete list of the vehicles

75
00:02:47,040 --> 00:02:49,120
that are vulnerable to a simple replay

76
00:02:49,120 --> 00:02:51,680
attack so i submitted a cve

77
00:02:51,680 --> 00:02:53,120
got this email

78
00:02:53,120 --> 00:02:54,640
so

79
00:02:54,640 --> 00:02:57,680
we were credited for this cve and here's

80
00:02:57,680 --> 00:03:00,800
a picture of it on the website

81
00:03:00,800 --> 00:03:02,319
so

82
00:03:02,319 --> 00:03:04,080
that got me quite a bit of attention i

83
00:03:04,080 --> 00:03:06,400
didn't expect it at first but then

84
00:03:06,400 --> 00:03:07,280
um

85
00:03:07,280 --> 00:03:10,319
i had the opportunity to be interviewed

86
00:03:10,319 --> 00:03:12,640
by fox 11 la

87
00:03:12,640 --> 00:03:15,840
um and we even featured on it

88
00:03:15,840 --> 00:03:17,920
i was also interviewed by abc's good

89
00:03:17,920 --> 00:03:20,720
morning america which was an amazing

90
00:03:20,720 --> 00:03:22,959
even

91
00:03:23,440 --> 00:03:25,360
so getting into the deck so keyless

92
00:03:25,360 --> 00:03:27,599
entry systems have been there for a

93
00:03:27,599 --> 00:03:29,120
really long time

94
00:03:29,120 --> 00:03:30,080
so

95
00:03:30,080 --> 00:03:35,360
over 72 percent of the cars after 2014

96
00:03:36,340 --> 00:03:39,479
[Music]

97
00:03:41,440 --> 00:03:44,560
for this attack we'll be exploiting

98
00:03:44,560 --> 00:03:48,560
the remote keyless entry systems onto

99
00:03:48,560 --> 00:03:50,879
on on vehicles so it was first

100
00:03:50,879 --> 00:03:53,120
introduced by renault on the renault

101
00:03:53,120 --> 00:03:54,640
fuego in

102
00:03:54,640 --> 00:03:58,959
way back in 1982 and it also operates at

103
00:03:58,959 --> 00:04:03,280
315 433 or 868 megahertz depending on

104
00:04:03,280 --> 00:04:04,879
which country you're in

105
00:04:04,879 --> 00:04:07,519
and which brand you're going for

106
00:04:07,519 --> 00:04:09,599
so

107
00:04:09,599 --> 00:04:11,680
the way remote keyless entry works is

108
00:04:11,680 --> 00:04:13,519
that it's just one way

109
00:04:13,519 --> 00:04:15,360
something interesting that i saw on an

110
00:04:15,360 --> 00:04:18,160
article where to quote mr clements where

111
00:04:18,160 --> 00:04:20,000
he said it's similar to yelling your

112
00:04:20,000 --> 00:04:22,160
password across the room and hoping no

113
00:04:22,160 --> 00:04:24,720
one happens to be listening

114
00:04:24,720 --> 00:04:25,520
so

115
00:04:25,520 --> 00:04:27,440
unlike passive keyless entry where

116
00:04:27,440 --> 00:04:29,040
there's a challenge response this is

117
00:04:29,040 --> 00:04:30,560
just one way and that's why this is

118
00:04:30,560 --> 00:04:32,479
possible

119
00:04:32,479 --> 00:04:34,000
so what next we need to know what

120
00:04:34,000 --> 00:04:36,639
modulation is it's the way the message

121
00:04:36,639 --> 00:04:37,840
is sent

122
00:04:37,840 --> 00:04:40,080
through radio signals so you have

123
00:04:40,080 --> 00:04:42,560
amplitude key shifting frequency key

124
00:04:42,560 --> 00:04:43,520
shifting

125
00:04:43,520 --> 00:04:47,280
and face key shifting which is ask

126
00:04:47,280 --> 00:04:50,639
fsk and psk where data is transmitted

127
00:04:50,639 --> 00:04:53,520
either in the amplitude the frequency or

128
00:04:53,520 --> 00:04:56,880
the phase like the name suggests

129
00:04:56,880 --> 00:04:59,360
so static versus rolling keys i'm sure

130
00:04:59,360 --> 00:05:01,840
everyone's seen sammy conker's fixed

131
00:05:01,840 --> 00:05:04,000
code and rolling code attacks on the

132
00:05:04,000 --> 00:05:05,680
open sesame

133
00:05:05,680 --> 00:05:08,639
and many things like that so over here

134
00:05:08,639 --> 00:05:11,759
what we're exploiting is a fixed code so

135
00:05:11,759 --> 00:05:14,240
like the diagram mentions the code is

136
00:05:14,240 --> 00:05:16,080
always sent as x

137
00:05:16,080 --> 00:05:18,960
and it doesn't it never expires

138
00:05:18,960 --> 00:05:20,800
but what's supposed to be good practice

139
00:05:20,800 --> 00:05:23,360
for this is rolling codes where

140
00:05:23,360 --> 00:05:24,560
every time

141
00:05:24,560 --> 00:05:26,240
the button is pressed

142
00:05:26,240 --> 00:05:27,280
the car

143
00:05:27,280 --> 00:05:30,240
or any other device whatever it is it

144
00:05:30,240 --> 00:05:32,160
rolls to a certain code

145
00:05:32,160 --> 00:05:34,160
that's determined by the pseudo-random

146
00:05:34,160 --> 00:05:35,680
number generator

147
00:05:35,680 --> 00:05:37,120
and

148
00:05:37,120 --> 00:05:39,520
so does the key fob

149
00:05:39,520 --> 00:05:43,440
but in in this case it's clearly not

150
00:05:43,520 --> 00:05:46,080
so what what tools are we using

151
00:05:46,080 --> 00:05:49,440
so over here we'll be using fccid.io i'm

152
00:05:49,440 --> 00:05:51,199
sure everyone's heard of it in all the

153
00:05:51,199 --> 00:05:52,720
other talks and

154
00:05:52,720 --> 00:05:54,639
it's really useful because you don't

155
00:05:54,639 --> 00:05:57,280
need to know anything about the key fob

156
00:05:57,280 --> 00:05:59,600
apart from its fccid which you can

157
00:05:59,600 --> 00:06:00,560
google

158
00:06:00,560 --> 00:06:03,120
and then you need an rf transceiver

159
00:06:03,120 --> 00:06:05,759
either a hack rf usrp flipper zero or

160
00:06:05,759 --> 00:06:08,240
even a yardstick one and then

161
00:06:08,240 --> 00:06:11,280
gq rx or spi sdr whatever you prefer

162
00:06:11,280 --> 00:06:13,680
based on your operating system and

163
00:06:13,680 --> 00:06:16,160
universal radio hacker as well as gnu

164
00:06:16,160 --> 00:06:17,759
radio

165
00:06:17,759 --> 00:06:21,520
so fcc id or io so you can either open

166
00:06:21,520 --> 00:06:24,560
up your key fob or even google

167
00:06:24,560 --> 00:06:26,960
what key you have for depending on your

168
00:06:26,960 --> 00:06:31,280
car and for this honda civic 2018 ex

169
00:06:31,280 --> 00:06:31,960
it's

170
00:06:31,960 --> 00:06:34,639
krv52x and then once you go into fccid

171
00:06:34,639 --> 00:06:37,800
to iowa

172
00:06:48,960 --> 00:06:51,440
success so we know roughly about where

173
00:06:51,440 --> 00:06:53,919
it starts and ends and just visually we

174
00:06:53,919 --> 00:06:55,360
can tell that

175
00:06:55,360 --> 00:06:57,520
it's fsk

176
00:06:57,520 --> 00:06:58,560
so

177
00:06:58,560 --> 00:07:00,960
it's frequency key shifting which is

178
00:07:00,960 --> 00:07:03,280
important to remember

179
00:07:03,280 --> 00:07:06,080
and i'll explain that a little later so

180
00:07:06,080 --> 00:07:09,360
getting into rf transceivers so

181
00:07:09,360 --> 00:07:12,160
a hacker f flipper 0 and yardstick 1 and

182
00:07:12,160 --> 00:07:15,199
usrp 810 are great

183
00:07:15,199 --> 00:07:17,759
um devices you can use to

184
00:07:17,759 --> 00:07:19,919
try this attack out yourself it's worth

185
00:07:19,919 --> 00:07:22,400
mentioning that the hakka rf and usrp

186
00:07:22,400 --> 00:07:23,360
are

187
00:07:23,360 --> 00:07:24,800
what are known as software defined

188
00:07:24,800 --> 00:07:26,160
radios

189
00:07:26,160 --> 00:07:28,400
unlike the zero and the elastic one

190
00:07:28,400 --> 00:07:31,199
which are computer control data devices

191
00:07:31,199 --> 00:07:34,319
so one main difference in both them

192
00:07:34,319 --> 00:07:37,680
is that sdrs can

193
00:07:37,680 --> 00:07:40,080
simply capture anything

194
00:07:40,080 --> 00:07:40,880
and

195
00:07:40,880 --> 00:07:43,360
it will simply transmit what it hears

196
00:07:43,360 --> 00:07:45,039
although for

197
00:07:45,039 --> 00:07:46,960
the flipper zero and the yardstick one

198
00:07:46,960 --> 00:07:48,720
you need to know exactly what you're

199
00:07:48,720 --> 00:07:51,039
looking for which means the modulation

200
00:07:51,039 --> 00:07:52,639
as well as the

201
00:07:52,639 --> 00:07:53,680
frequency

202
00:07:53,680 --> 00:07:56,000
unlike the sdrs where it only cares

203
00:07:56,000 --> 00:07:59,199
about what frequency

204
00:07:59,199 --> 00:08:00,400
that the

205
00:08:00,400 --> 00:08:03,759
device you're trying to capture is using

206
00:08:03,759 --> 00:08:05,680
and another big difference is that the

207
00:08:05,680 --> 00:08:09,199
hacker f and usrp go from maybe one

208
00:08:09,199 --> 00:08:12,240
megahertz to six gigahertz depending on

209
00:08:12,240 --> 00:08:14,960
the daughter board present in it but the

210
00:08:14,960 --> 00:08:17,199
flipper zero and yardstick one are sub

211
00:08:17,199 --> 00:08:19,440
gigahertz devices but that's perfect for

212
00:08:19,440 --> 00:08:21,440
us because all we're doing is attacking

213
00:08:21,440 --> 00:08:24,879
from 315 433 and 868 megahertz

214
00:08:24,879 --> 00:08:27,840
so here's a short video on gqrx of a

215
00:08:27,840 --> 00:08:30,240
real key fob capture so you can clearly

216
00:08:30,240 --> 00:08:33,760
see that it's speaking at about 433.6

217
00:08:33,760 --> 00:08:37,360
as well as 434.1 ish something

218
00:08:37,360 --> 00:08:38,320
so

219
00:08:38,320 --> 00:08:40,559
we now know that it's not only frequency

220
00:08:40,559 --> 00:08:42,479
key shifting but it's also transmitting

221
00:08:42,479 --> 00:08:45,279
at two separate frequencies

222
00:08:45,279 --> 00:08:48,800
and here's a video of s by sdr as well

223
00:08:48,800 --> 00:08:52,320
so in the video you can see that it's

224
00:08:52,320 --> 00:08:55,519
telling you exactly roughly about where

225
00:08:55,519 --> 00:08:57,360
the frequency is so

226
00:08:57,360 --> 00:08:59,320
i estimated it to be around

227
00:08:59,320 --> 00:09:01,880
433.65 ish and

228
00:09:01,880 --> 00:09:03,680
434.18

229
00:09:03,680 --> 00:09:05,519
which is good enough for an sdr because

230
00:09:05,519 --> 00:09:08,800
we just need a rough indication of where

231
00:09:08,800 --> 00:09:10,880
the signal is playing

232
00:09:10,880 --> 00:09:14,160
so universal radio it's a great tool

233
00:09:14,160 --> 00:09:16,480
that i recommend if you're new to

234
00:09:16,480 --> 00:09:18,640
wireless security it's really easy to

235
00:09:18,640 --> 00:09:22,320
use you can demodulate and capture

236
00:09:22,320 --> 00:09:25,200
and you can even analyze everything

237
00:09:25,200 --> 00:09:26,399
but

238
00:09:26,399 --> 00:09:28,560
i prefer gnu radio

239
00:09:28,560 --> 00:09:29,920
uh

240
00:09:29,920 --> 00:09:32,080
just because it's

241
00:09:32,080 --> 00:09:34,399
i'd like to learn more on how things

242
00:09:34,399 --> 00:09:36,480
actually work so it's built in c and the

243
00:09:36,480 --> 00:09:38,000
way this works is that you just drag and

244
00:09:38,000 --> 00:09:39,440
drop blocks

245
00:09:39,440 --> 00:09:42,240
and feed in parameters and it works so

246
00:09:42,240 --> 00:09:43,680
this is the real

247
00:09:43,680 --> 00:09:45,680
capture flowchart that we have used so

248
00:09:45,680 --> 00:09:47,760
you just have an awesome com source

249
00:09:47,760 --> 00:09:50,160
which is actually our hack rf where you

250
00:09:50,160 --> 00:09:52,959
just feed in the channel frequency

251
00:09:52,959 --> 00:09:54,720
and your sample rate

252
00:09:54,720 --> 00:09:56,880
and then what you do is you put it into

253
00:09:56,880 --> 00:09:59,040
a file sync in order to save it and the

254
00:09:59,040 --> 00:10:01,440
qt gy sync is just to show

255
00:10:01,440 --> 00:10:04,480
where the peak is so if you see clearly

256
00:10:04,480 --> 00:10:07,360
there are two peaks at 433 as well as

257
00:10:07,360 --> 00:10:10,399
434 roughly

258
00:10:10,560 --> 00:10:12,399
and here's the real

259
00:10:12,399 --> 00:10:14,560
uh flowchart for transmitting

260
00:10:14,560 --> 00:10:16,560
so all we're doing here is we've already

261
00:10:16,560 --> 00:10:18,640
saved

262
00:10:18,640 --> 00:10:20,959
the files in and

263
00:10:20,959 --> 00:10:24,240
it's either file lock start and unlock

264
00:10:24,240 --> 00:10:26,240
and then we can just enable

265
00:10:26,240 --> 00:10:28,640
whatever whichever one we like

266
00:10:28,640 --> 00:10:31,360
and then just create it into the sync

267
00:10:31,360 --> 00:10:34,320
which will transmit through the hack rf

268
00:10:34,320 --> 00:10:38,600
so enough theory let's see a demo

269
00:11:26,000 --> 00:11:27,920
so as you can see in the video we first

270
00:11:27,920 --> 00:11:31,440
used the start file capture after which

271
00:11:31,440 --> 00:11:34,160
we use the unlock capture to not only

272
00:11:34,160 --> 00:11:37,680
remote start the car but also unlock it

273
00:11:37,680 --> 00:11:41,959
and then next up is my favorite

274
00:11:51,680 --> 00:11:53,920
so new england weather in the summer can

275
00:11:53,920 --> 00:11:56,480
be really harsh and it's really hot up

276
00:11:56,480 --> 00:11:58,880
there and having a black car doesn't

277
00:11:58,880 --> 00:12:02,000
really help so i use this feature almost

278
00:12:02,000 --> 00:12:03,920
every time before driving the car just

279
00:12:03,920 --> 00:12:05,680
so it can cool down

280
00:12:05,680 --> 00:12:07,440
but just imagine if

281
00:12:07,440 --> 00:12:09,200
someone was listening with a

282
00:12:09,200 --> 00:12:10,959
with any of the

283
00:12:10,959 --> 00:12:12,880
rf transceivers

284
00:12:12,880 --> 00:12:15,360
new england also has

285
00:12:15,360 --> 00:12:17,440
a lot of snow so just imagine if you

286
00:12:17,440 --> 00:12:20,800
were to replay that as a prank of course

287
00:12:20,800 --> 00:12:23,800
on

288
00:12:26,639 --> 00:12:29,040
okay moving on it's time to get serious

289
00:12:29,040 --> 00:12:30,399
so

290
00:12:30,399 --> 00:12:33,120
that's the key fob which uh we've opened

291
00:12:33,120 --> 00:12:35,279
up and then

292
00:12:35,279 --> 00:12:37,360
if we want to extract useful information

293
00:12:37,360 --> 00:12:39,519
out of this the best place to refer to

294
00:12:39,519 --> 00:12:42,720
is the data sheet so once you know what

295
00:12:42,720 --> 00:12:44,160
pin you're looking for you can look up

296
00:12:44,160 --> 00:12:45,519
the data sheet

297
00:12:45,519 --> 00:12:47,920
which over here is the pcf

298
00:12:47,920 --> 00:12:49,040
uh

299
00:12:49,040 --> 00:12:50,000
line

300
00:12:50,000 --> 00:12:53,279
pcf seven nine 900 and then you just

301
00:12:53,279 --> 00:12:54,240
connect

302
00:12:54,240 --> 00:12:55,519
um

303
00:12:55,519 --> 00:12:59,120
you just connect to the key fob via spi

304
00:12:59,120 --> 00:13:00,720
so

305
00:13:00,720 --> 00:13:01,990
um scored from

306
00:13:01,990 --> 00:13:03,200
[Music]

307
00:13:03,200 --> 00:13:04,240
flipper

308
00:13:04,240 --> 00:13:07,360
sorted everything and then using spi

309
00:13:07,360 --> 00:13:08,639
analysis

310
00:13:08,639 --> 00:13:10,480
uh we were able to extract a lot of

311
00:13:10,480 --> 00:13:12,399
information out so

312
00:13:12,399 --> 00:13:14,880
spi which is serial peripheral interface

313
00:13:14,880 --> 00:13:18,079
was developed by motorola in the 1980s

314
00:13:18,079 --> 00:13:20,480
and it's it's you can use three wired or

315
00:13:20,480 --> 00:13:22,240
four wire as well

316
00:13:22,240 --> 00:13:23,680
and the

317
00:13:23,680 --> 00:13:25,519
this particular chip supports both so

318
00:13:25,519 --> 00:13:29,279
the way this one was wired up was um

319
00:13:29,279 --> 00:13:30,720
was three wires

320
00:13:30,720 --> 00:13:31,920
so

321
00:13:31,920 --> 00:13:34,399
spi consists of

322
00:13:34,399 --> 00:13:36,320
serial output

323
00:13:36,320 --> 00:13:37,920
mossy which is

324
00:13:37,920 --> 00:13:40,880
master output slave input muso which is

325
00:13:40,880 --> 00:13:43,519
master input slave output

326
00:13:43,519 --> 00:13:46,240
and s-clock which is serious serial

327
00:13:46,240 --> 00:13:48,079
clock sorry

328
00:13:48,079 --> 00:13:50,720
and over here we can find the good stuff

329
00:13:50,720 --> 00:13:53,519
on the knee so

330
00:13:54,880 --> 00:13:56,240
so

331
00:13:56,240 --> 00:13:58,720
here's here's the information on the me

332
00:13:58,720 --> 00:14:02,800
so so it's 0b 0 1 1 zero one one and you

333
00:14:02,800 --> 00:14:04,639
might ask me what the hell does this

334
00:14:04,639 --> 00:14:06,480
mean i mean that's that's the first

335
00:14:06,480 --> 00:14:08,399
question that that came to my mind when

336
00:14:08,399 --> 00:14:10,959
when i saw this it's just numbers right

337
00:14:10,959 --> 00:14:13,839
but to quote uh professor vial it's in

338
00:14:13,839 --> 00:14:15,040
the data sheet

339
00:14:15,040 --> 00:14:18,399
so then if you look carefully if you

340
00:14:18,399 --> 00:14:21,639
see 0b011011

341
00:14:22,079 --> 00:14:23,920
is

342
00:14:23,920 --> 00:14:27,920
0 1 1 0 1 1 which

343
00:14:27,920 --> 00:14:31,760
is each bit and after checking the data

344
00:14:31,760 --> 00:14:33,519
sheet you can find out exactly what it

345
00:14:33,519 --> 00:14:34,399
means

346
00:14:34,399 --> 00:14:36,639
so in reality the screenshot that you

347
00:14:36,639 --> 00:14:38,000
saw previously

348
00:14:38,000 --> 00:14:40,240
was for selecting the baud rate and

349
00:14:40,240 --> 00:14:41,440
here's the

350
00:14:41,440 --> 00:14:42,959
useful information that we have been

351
00:14:42,959 --> 00:14:46,639
able to extract only some of it so

352
00:14:46,639 --> 00:14:47,600
the

353
00:14:47,600 --> 00:14:51,279
so zero b 1000 0 100

354
00:14:51,279 --> 00:14:54,160
actually correlated to

355
00:14:54,160 --> 00:14:56,320
the frequency low which gave us the

356
00:14:56,320 --> 00:14:59,120
information that one of the frequencies

357
00:14:59,120 --> 00:15:00,720
that it's operating at

358
00:15:00,720 --> 00:15:02,880
is

359
00:15:03,720 --> 00:15:06,160
433.657070 so like you saw in the

360
00:15:06,160 --> 00:15:08,160
previous gqrx and

361
00:15:08,160 --> 00:15:11,279
um s5 videos we did estimate it to be

362
00:15:11,279 --> 00:15:13,519
about four three three point six five

363
00:15:13,519 --> 00:15:15,600
but this is obviously more precise

364
00:15:15,600 --> 00:15:17,199
and the same with four thirty four point

365
00:15:17,199 --> 00:15:20,560
one seven six nine uh four eight where

366
00:15:20,560 --> 00:15:22,560
we estimate it to be somewhere around

367
00:15:22,560 --> 00:15:25,120
four thirty four point one eight ish and

368
00:15:25,120 --> 00:15:27,040
then something that's also very

369
00:15:27,040 --> 00:15:28,399
important

370
00:15:28,399 --> 00:15:29,279
is

371
00:15:29,279 --> 00:15:31,600
what modulation so obviously we could

372
00:15:31,600 --> 00:15:35,199
see that it was fsk but then this is a

373
00:15:35,199 --> 00:15:36,720
guaranteed

374
00:15:36,720 --> 00:15:39,360
value as well because we know exactly

375
00:15:39,360 --> 00:15:41,839
the deviation of the same now

376
00:15:41,839 --> 00:15:44,959
and going into the baud rate selection

377
00:15:44,959 --> 00:15:47,199
we were able to find out that the

378
00:15:47,199 --> 00:15:49,519
board division is 51

379
00:15:49,519 --> 00:15:50,480
and

380
00:15:50,480 --> 00:15:52,880
we with a little math we can find out

381
00:15:52,880 --> 00:15:55,199
the the baud rate itself which came up

382
00:15:55,199 --> 00:15:56,360
to about

383
00:15:56,360 --> 00:15:59,120
15380 per second

384
00:15:59,120 --> 00:16:01,279
so

385
00:16:01,920 --> 00:16:03,199
what next

386
00:16:03,199 --> 00:16:06,240
so we have manchester so we we did find

387
00:16:06,240 --> 00:16:08,240
out that

388
00:16:08,240 --> 00:16:11,279
the device uses manchester encoding

389
00:16:11,279 --> 00:16:12,880
which is a way of

390
00:16:12,880 --> 00:16:16,320
encoding the data for transfer

391
00:16:16,320 --> 00:16:17,519
and

392
00:16:17,519 --> 00:16:20,320
we didn't know much about it so

393
00:16:20,320 --> 00:16:23,199
and in fact the chip that we had the rf

394
00:16:23,199 --> 00:16:26,160
end of the chip selected it as selected

395
00:16:26,160 --> 00:16:28,639
the encoding as nrz

396
00:16:28,639 --> 00:16:31,360
but the the previous chip had manchester

397
00:16:31,360 --> 00:16:34,320
encoding so the rf chip only transmitted

398
00:16:34,320 --> 00:16:36,480
what it heard which was actually

399
00:16:36,480 --> 00:16:39,279
manchester although it thinks it's nrz

400
00:16:39,279 --> 00:16:41,519
so

401
00:16:41,519 --> 00:16:42,720
um

402
00:16:42,720 --> 00:16:45,759
here's how you calculate that

403
00:16:45,759 --> 00:16:46,560
so

404
00:16:46,560 --> 00:16:48,639
remember the 62.81 microsecond in the

405
00:16:48,639 --> 00:16:51,600
previous slide

406
00:16:51,600 --> 00:16:56,320
so that's the shortest distance between

407
00:16:56,320 --> 00:16:57,360
the

408
00:16:57,360 --> 00:16:59,120
peaks so

409
00:16:59,120 --> 00:17:02,079
you divide one second by that which

410
00:17:02,079 --> 00:17:05,079
gives you about

411
00:17:05,079 --> 00:17:08,319
7961 kilobytes per second

412
00:17:08,319 --> 00:17:11,679
um which is really useful because in in

413
00:17:11,679 --> 00:17:13,839
case we need to demodulate it we need to

414
00:17:13,839 --> 00:17:14,880
know

415
00:17:14,880 --> 00:17:17,520
the manchester bit rate

416
00:17:17,520 --> 00:17:19,280
so here's how you do that as well so you

417
00:17:19,280 --> 00:17:21,119
just once you get that number

418
00:17:21,119 --> 00:17:22,559
you feed it in

419
00:17:22,559 --> 00:17:24,079
and

420
00:17:24,079 --> 00:17:26,480
it will demodulate it for you and gives

421
00:17:26,480 --> 00:17:29,760
you all the information you need

422
00:17:29,760 --> 00:17:31,679
so you might ask

423
00:17:31,679 --> 00:17:34,160
why did we do all of this when

424
00:17:34,160 --> 00:17:37,360
universal radio hacker can do it for us

425
00:17:37,360 --> 00:17:40,799
like really really easily

426
00:17:40,799 --> 00:17:42,799
and i have the answer to that as well

427
00:17:42,799 --> 00:17:44,960
so i'm sure everyone's heard of the

428
00:17:44,960 --> 00:17:47,039
flipper zero

429
00:17:47,039 --> 00:17:48,080
so

430
00:17:48,080 --> 00:17:51,760
out of the box it cannot support

431
00:17:51,760 --> 00:17:53,840
locking unlocking or doing any of this

432
00:17:53,840 --> 00:17:56,720
but with the help of scorp and

433
00:17:56,720 --> 00:17:58,559
through this analysis and the

434
00:17:58,559 --> 00:18:01,039
information extracted we can program it

435
00:18:01,039 --> 00:18:03,280
to do so like i said earlier it's not an

436
00:18:03,280 --> 00:18:06,000
sdr so you have to program it so for

437
00:18:06,000 --> 00:18:07,200
this

438
00:18:07,200 --> 00:18:11,559
uh he added the frequencies for 433.65

439
00:18:11,559 --> 00:18:14,160
434.17 and even added a special

440
00:18:14,160 --> 00:18:16,240
modulation called honda one there's

441
00:18:16,240 --> 00:18:19,520
honda 2 as well which is more sensitive

442
00:18:19,520 --> 00:18:22,960
but that means it's more noisy and but

443
00:18:22,960 --> 00:18:25,520
honda one works perfectly

444
00:18:25,520 --> 00:18:27,600
so

445
00:18:27,600 --> 00:18:29,280
real question

446
00:18:29,280 --> 00:18:31,918
does it work

447
00:18:32,000 --> 00:18:34,640
looks like it does right so here's a

448
00:18:34,640 --> 00:18:36,960
picture of the key fob capture and the

449
00:18:36,960 --> 00:18:38,799
flipper zero capture as well

450
00:18:38,799 --> 00:18:39,919
so

451
00:18:39,919 --> 00:18:41,760
you can see that

452
00:18:41,760 --> 00:18:43,600
the flipper zero capture might be a

453
00:18:43,600 --> 00:18:45,200
little noisy and that's because of the

454
00:18:45,200 --> 00:18:48,080
cc one zero one one one zero one chip

455
00:18:48,080 --> 00:18:50,720
which we already know is pretty noisy

456
00:18:50,720 --> 00:18:53,280
so here's a video of it working you

457
00:18:53,280 --> 00:18:55,360
might have seen this on twitter and

458
00:18:55,360 --> 00:18:59,639
here's how we actually make it work

459
00:19:41,360 --> 00:19:44,000
okay next up

460
00:19:44,000 --> 00:19:46,559
a civic with a laptop is the most fear

461
00:19:46,559 --> 00:19:48,400
thing in the car keeping you take and if

462
00:19:48,400 --> 00:19:50,960
you don't understand it google it

463
00:19:50,960 --> 00:19:52,400
and this is a pretty sick picture

464
00:19:52,400 --> 00:19:54,240
someone managed to get linux running on

465
00:19:54,240 --> 00:19:56,400
their infotainment system

466
00:19:56,400 --> 00:19:58,080
so

467
00:19:58,080 --> 00:19:59,360
we already know that a civic with a

468
00:19:59,360 --> 00:20:01,840
laptop is pretty dangerous but imagine a

469
00:20:01,840 --> 00:20:04,559
civic with a laptop and a hacker f1

470
00:20:04,559 --> 00:20:08,480
isn't it the ultimate wardrobing setup

471
00:20:08,720 --> 00:20:10,720
okay enough about that so what's the

472
00:20:10,720 --> 00:20:12,159
solution

473
00:20:12,159 --> 00:20:14,720
so obviously i've recommended faraday

474
00:20:14,720 --> 00:20:17,120
pouches

475
00:20:17,760 --> 00:20:18,640
and

476
00:20:18,640 --> 00:20:21,039
we all know that it's not the solution

477
00:20:21,039 --> 00:20:23,360
because it's just a temporary fix but we

478
00:20:23,360 --> 00:20:24,720
all know there are a billion people to

479
00:20:24,720 --> 00:20:25,840
overcome it

480
00:20:25,840 --> 00:20:27,280
so

481
00:20:27,280 --> 00:20:29,919
rolling and rolling keys is the only way

482
00:20:29,919 --> 00:20:32,640
that a simple replay attack like this

483
00:20:32,640 --> 00:20:34,480
would not work right

484
00:20:34,480 --> 00:20:35,679
that means

485
00:20:35,679 --> 00:20:38,720
rolling codes the safe word

486
00:20:38,720 --> 00:20:41,039
right

487
00:20:43,200 --> 00:20:44,080
no

488
00:20:44,080 --> 00:20:46,559
so after we release this

489
00:20:46,559 --> 00:20:49,280
my good friend kevin

490
00:20:49,280 --> 00:20:50,960
carhacking village

491
00:20:50,960 --> 00:20:53,760
managed to break ruling code encryption

492
00:20:53,760 --> 00:20:56,559
as well and he published his research

493
00:20:56,559 --> 00:20:59,600
calling it rolling phone

494
00:20:59,600 --> 00:21:00,880
so

495
00:21:00,880 --> 00:21:02,240
there you go so it looks like even

496
00:21:02,240 --> 00:21:04,880
rolling quotes had been hacked as well

497
00:21:04,880 --> 00:21:08,919
here's here's his demo

498
00:21:17,500 --> 00:21:19,360
[Music]

499
00:21:19,360 --> 00:21:21,140
uh

500
00:21:21,140 --> 00:21:24,339
[Music]

501
00:21:31,840 --> 00:21:34,840
uh

502
00:21:50,640 --> 00:21:51,840
so there you go

503
00:21:51,840 --> 00:21:53,520
rolling codes have been broken into as

504
00:21:53,520 --> 00:21:54,960
well

505
00:21:54,960 --> 00:21:55,760
and

506
00:21:55,760 --> 00:21:58,480
he did report this to the automotive

507
00:21:58,480 --> 00:22:00,000
company at first and they straight up

508
00:22:00,000 --> 00:22:01,120
denied it

509
00:22:01,120 --> 00:22:03,360
until he reached out to rob stumpf from

510
00:22:03,360 --> 00:22:04,400
the drive

511
00:22:04,400 --> 00:22:06,080
and he confirmed it as well you can go

512
00:22:06,080 --> 00:22:07,520
check out his

513
00:22:07,520 --> 00:22:08,640
page on

514
00:22:08,640 --> 00:22:12,240
twitter and see the demo for yourself

515
00:22:12,240 --> 00:22:13,039
so

516
00:22:13,039 --> 00:22:15,760
after all of that they did acknowledge

517
00:22:15,760 --> 00:22:17,760
the issue and they said that it's not as

518
00:22:17,760 --> 00:22:20,720
easy to exploit and

519
00:22:20,720 --> 00:22:21,600
yes

520
00:22:21,600 --> 00:22:24,080
they're right car thieves are obviously

521
00:22:24,080 --> 00:22:27,039
more sophisticated than all of us and

522
00:22:27,039 --> 00:22:28,720
they've been doing it for years they i'm

523
00:22:28,720 --> 00:22:30,320
sure they must have found a billion

524
00:22:30,320 --> 00:22:32,799
women which are more efficient

525
00:22:32,799 --> 00:22:34,880
so in response to that

526
00:22:34,880 --> 00:22:36,799
honda came up with a statement saying

527
00:22:36,799 --> 00:22:40,159
that our vulnerability has no indication

528
00:22:40,159 --> 00:22:41,919
that

529
00:22:41,919 --> 00:22:44,480
you can actually drive an acura or a

530
00:22:44,480 --> 00:22:46,080
honda vehicle

531
00:22:46,080 --> 00:22:48,640
but i think everyone already knows

532
00:22:48,640 --> 00:22:50,159
especially at the car hacking village

533
00:22:50,159 --> 00:22:52,480
that once you're in a car it's yours

534
00:22:52,480 --> 00:22:55,039
because you have access to the canvas

535
00:22:55,039 --> 00:22:57,280
and

536
00:22:57,520 --> 00:23:00,960
yeah so this vulnerability alone cannot

537
00:23:00,960 --> 00:23:03,360
let you drive away with it but we

538
00:23:03,360 --> 00:23:06,000
already know we have key programmers and

539
00:23:06,000 --> 00:23:09,360
it's already known that car thieves do

540
00:23:09,360 --> 00:23:11,760
buy these things and they can program

541
00:23:11,760 --> 00:23:15,440
new keys for the car it's like

542
00:23:15,440 --> 00:23:18,080
this so when honda came up with that i

543
00:23:18,080 --> 00:23:21,879
said challenge accepted

544
00:23:58,970 --> 00:24:02,119
[Music]

545
00:24:08,560 --> 00:24:12,639
[Music]

546
00:24:19,039 --> 00:24:22,279
that's perfect

547
00:26:48,480 --> 00:26:52,840
you wanna try driving it yep

548
00:27:02,640 --> 00:27:05,640
wow

549
00:27:20,480 --> 00:27:21,919
so there you go

550
00:27:21,919 --> 00:27:24,960
you can drive away with a locked car in

551
00:27:24,960 --> 00:27:27,360
just just under four minutes and that's

552
00:27:27,360 --> 00:27:30,080
insane right

553
00:27:30,080 --> 00:27:32,320
something alarming is that these devices

554
00:27:32,320 --> 00:27:35,200
cost anywhere between 3 000 to 4 000

555
00:27:35,200 --> 00:27:37,360
and i also learned that in the state of

556
00:27:37,360 --> 00:27:39,279
massachusetts you actually don't need a

557
00:27:39,279 --> 00:27:41,600
license to go ahead and buy one of these

558
00:27:41,600 --> 00:27:42,399
so

559
00:27:42,399 --> 00:27:44,960
just for a video buying one didn't make

560
00:27:44,960 --> 00:27:48,240
sense but if you were a car thief it's a

561
00:27:48,240 --> 00:27:50,559
great investment i don't encourage it

562
00:27:50,559 --> 00:27:52,880
and obviously

563
00:27:52,880 --> 00:27:54,000
but

564
00:27:54,000 --> 00:27:56,159
it's very much possible and it does

565
00:27:56,159 --> 00:27:59,279
happen unfortunately

566
00:27:59,520 --> 00:28:01,039
so

567
00:28:01,039 --> 00:28:02,480
in the future obviously we know that

568
00:28:02,480 --> 00:28:04,720
canvas attacks are a thing

569
00:28:04,720 --> 00:28:07,039
just imagine

570
00:28:07,039 --> 00:28:08,240
anyone can

571
00:28:08,240 --> 00:28:11,200
reverse engineer such a key programmer

572
00:28:11,200 --> 00:28:12,640
code into

573
00:28:12,640 --> 00:28:16,240
a great tool like jtella scan taught

574
00:28:16,240 --> 00:28:17,120
and

575
00:28:17,120 --> 00:28:19,440
just defeat the immobilizer or make it

576
00:28:19,440 --> 00:28:21,760
program a new key

577
00:28:21,760 --> 00:28:23,760
you can you can do it much quicker than

578
00:28:23,760 --> 00:28:26,559
four minutes as well

579
00:28:27,120 --> 00:28:28,880
so

580
00:28:28,880 --> 00:28:31,039
quite recently about two weeks ago even

581
00:28:31,039 --> 00:28:32,159
senator

582
00:28:32,159 --> 00:28:35,200
markey uh sent out about 20 different

583
00:28:35,200 --> 00:28:37,919
letters to the other to all different

584
00:28:37,919 --> 00:28:40,159
automotive companies

585
00:28:40,159 --> 00:28:43,200
um asking them questions about security

586
00:28:43,200 --> 00:28:45,360
in remote keyless entry systems or

587
00:28:45,360 --> 00:28:47,360
keyless entry systems itself

588
00:28:47,360 --> 00:28:49,760
which i think is a great thing just

589
00:28:49,760 --> 00:28:51,360
because

590
00:28:51,360 --> 00:28:53,760
many of these systems are vulnerable and

591
00:28:53,760 --> 00:28:55,919
i've also heard from other researchers

592
00:28:55,919 --> 00:28:56,799
that

593
00:28:56,799 --> 00:28:59,120
car companies either acknowledge it and

594
00:28:59,120 --> 00:29:01,440
say that oh it's fine

595
00:29:01,440 --> 00:29:02,559
but

596
00:29:02,559 --> 00:29:05,520
i don't think it's fair um to know that

597
00:29:05,520 --> 00:29:07,840
you have a vulnerability and don't fix

598
00:29:07,840 --> 00:29:10,320
it at all especially

599
00:29:10,320 --> 00:29:12,240
fixed codes

600
00:29:12,240 --> 00:29:13,919
the first time i heard about it was

601
00:29:13,919 --> 00:29:16,559
about seven years ago through um

602
00:29:16,559 --> 00:29:20,000
sami kankar and that's why garage doors

603
00:29:20,000 --> 00:29:22,799
now have rolling codes so why not a car

604
00:29:22,799 --> 00:29:24,399
it's it's the least that can be done

605
00:29:24,399 --> 00:29:27,200
right

606
00:29:27,200 --> 00:29:30,240
and in fact the nhsda

607
00:29:30,240 --> 00:29:32,159
only for 2020

608
00:29:32,159 --> 00:29:34,080
approximates the cost of stolen vehicles

609
00:29:34,080 --> 00:29:36,320
to be about 7 billion dollars and that's

610
00:29:36,320 --> 00:29:39,360
a huge number just in the us

611
00:29:39,360 --> 00:29:42,880
and that's from 804 000 vehicles stolen

612
00:29:42,880 --> 00:29:46,000
in 2020 alone

613
00:29:46,000 --> 00:29:47,440
so what next

614
00:29:47,440 --> 00:29:49,360
you can join us on this journey

615
00:29:49,360 --> 00:29:50,880
if you want to show your support please

616
00:29:50,880 --> 00:29:54,279
grab a free sticker for cve 22

617
00:29:54,279 --> 00:29:57,679
2022-27254 or a rolling pond sticker at

618
00:29:57,679 --> 00:30:00,399
defcon's car hacking village

619
00:30:00,399 --> 00:30:02,240
this is what they look like

620
00:30:02,240 --> 00:30:03,679
and also

621
00:30:03,679 --> 00:30:07,799
if you are interested in this

622
00:30:16,960 --> 00:30:19,960
is

623
00:30:22,559 --> 00:30:25,039
this is being done by woody who you guys

624
00:30:25,039 --> 00:30:27,039
might know him from hack five

625
00:30:27,039 --> 00:30:29,679
um kevin uh two six hundred of course

626
00:30:29,679 --> 00:30:30,880
and me

627
00:30:30,880 --> 00:30:32,080
so

628
00:30:32,080 --> 00:30:34,320
and also if you do want a copy of the

629
00:30:34,320 --> 00:30:37,440
flipper zero custom firmware do stop by

630
00:30:37,440 --> 00:30:39,120
the car hacking village we will have a

631
00:30:39,120 --> 00:30:42,080
qr code there that you can scan and we

632
00:30:42,080 --> 00:30:45,120
also include a video on how to

633
00:30:45,120 --> 00:30:47,200
flash the firmware and

634
00:30:47,200 --> 00:30:49,440
guide you through how to do it

635
00:30:49,440 --> 00:30:51,840
so additionally we'll also be doing a

636
00:30:51,840 --> 00:30:53,919
live demo so you if

637
00:30:53,919 --> 00:30:55,679
if you guys want to try this out

638
00:30:55,679 --> 00:30:57,360
yourself please do come by the car

639
00:30:57,360 --> 00:30:59,440
hacking village and we're going to have

640
00:30:59,440 --> 00:31:01,679
a 2018 civic there as well

641
00:31:01,679 --> 00:31:04,880
so come try it out yourself

642
00:31:04,880 --> 00:31:08,240
so a huge thank you to the umass cyber

643
00:31:08,240 --> 00:31:10,720
security center and umass dartmouth

644
00:31:10,720 --> 00:31:13,440
the flipper zero team especially

645
00:31:13,440 --> 00:31:15,919
scorp and pavel

646
00:31:15,919 --> 00:31:19,120
and my friend avishi for the stickers

647
00:31:19,120 --> 00:31:21,519
you can scan on qr code to go to her

648
00:31:21,519 --> 00:31:22,720
portfolio

649
00:31:22,720 --> 00:31:25,440
and my professors from umass dartmouth

650
00:31:25,440 --> 00:31:27,840
professor kaslingam fiondela professor

651
00:31:27,840 --> 00:31:29,760
liu zao and

652
00:31:29,760 --> 00:31:31,519
professor vail of course

653
00:31:31,519 --> 00:31:33,760
and also my mentor

654
00:31:33,760 --> 00:31:36,640
mr sam curry who not only taught me a

655
00:31:36,640 --> 00:31:38,799
lot about cyber security but also taught

656
00:31:38,799 --> 00:31:40,880
me a lot about soft skills and

657
00:31:40,880 --> 00:31:42,799
guided me throughout the process of

658
00:31:42,799 --> 00:31:45,279
giving interviews to the media which was

659
00:31:45,279 --> 00:31:46,640
really helpful

660
00:31:46,640 --> 00:31:50,159
and also my mentors from ncipc

661
00:31:50,159 --> 00:31:51,919
both the mr kumars

662
00:31:51,919 --> 00:31:53,200
um

663
00:31:53,200 --> 00:31:54,320
also

664
00:31:54,320 --> 00:31:56,320
a huge shout out to

665
00:31:56,320 --> 00:31:57,279
um

666
00:31:57,279 --> 00:31:59,679
defcon car hacking village

667
00:31:59,679 --> 00:32:00,880
especially

668
00:32:00,880 --> 00:32:03,840
robert justin and

669
00:32:03,840 --> 00:32:04,799
jerry

670
00:32:04,799 --> 00:32:08,080
kevin 2600 woody as well as conor

671
00:32:08,080 --> 00:32:09,200
mclaulen

672
00:32:09,200 --> 00:32:10,399
as well as

673
00:32:10,399 --> 00:32:12,559
magnus india and east coast chip keys

674
00:32:12,559 --> 00:32:16,240
for making this happen but most of all

675
00:32:16,240 --> 00:32:18,880
sami is my hero

676
00:32:18,880 --> 00:32:21,279
and here's a few more references

677
00:32:21,279 --> 00:32:22,880
or if you want to

678
00:32:22,880 --> 00:32:24,960
learn more about this you please feel

679
00:32:24,960 --> 00:32:28,480
free to read through all of this and

680
00:32:28,480 --> 00:32:29,519
also

681
00:32:29,519 --> 00:32:31,679
everything after the talk will soon be

682
00:32:31,679 --> 00:32:34,720
published on my github repository so

683
00:32:34,720 --> 00:32:37,440
please do look out for any of my tweets

684
00:32:37,440 --> 00:32:40,640
or you can go to my portfolio website

685
00:32:40,640 --> 00:32:43,039
and we will have everything open sourced

686
00:32:43,039 --> 00:32:47,158
for you to learn as well

687
00:39:39,280 --> 00:39:41,359
you