1 00:00:07,180 --> 00:00:10,060 We're here in the middle of a car hacking village. 2 00:00:10,120 --> 00:00:11,680 Just talk to me, what's happening? 3 00:00:11,680 --> 00:00:17,180 Sure, so I got involved with car hacking about three or four years ago here at DEF CON. 4 00:00:17,340 --> 00:00:19,320 It's not my primary job. 5 00:00:19,360 --> 00:00:23,540 I have learned all of it kind of self-taught and through awesome people through the village. 6 00:00:23,540 --> 00:00:32,280 I have a $300 laptop, a dongle that I bought at Rite Aid at 4 o'clock in the morning, so that ended up being $45, and one Cat5 cable. 7 00:00:32,280 --> 00:00:37,940 So you're rolling with just three main pieces here that anyone could just buy? 8 00:00:39,020 --> 00:00:45,560 Installed Kali onto this computer, and right now I actually pulled up Wireshark. 9 00:00:45,560 --> 00:00:50,200 I hadn't used Wireshark since 2007 when everything went to HTTPS. 10 00:00:50,200 --> 00:00:51,220 Going old school. 11 00:00:51,680 --> 00:00:58,400 Alright, so what we're going to do is I'm going to teach you how to do basically a packet capture of the car. 12 00:00:58,400 --> 00:01:01,680 It's a giant web app, so we're going to get started. 13 00:01:01,680 --> 00:01:02,160 Are you ready? 14 00:01:02,160 --> 00:01:02,920 Yeah, I'm ready. 15 00:01:02,920 --> 00:01:03,560 Let's go. 16 00:01:03,800 --> 00:01:06,980 So let's go ahead and take it and go to ETH0. 17 00:01:07,260 --> 00:01:12,520 Alright, we got our lovely packets that we're used to seeing from like 2007. 18 00:01:12,880 --> 00:01:15,720 Now I'm going to get in and I'm going to put the car in party mode. 19 00:01:15,720 --> 00:01:19,820 That way I can get a bunch of traffic generated so that I have something to look at. 20 00:01:19,820 --> 00:01:21,860 And you have to guess what song is playing. 21 00:01:22,360 --> 00:01:23,200 Star Wars. 22 00:01:24,100 --> 00:01:25,020 Get in here. 23 00:01:25,020 --> 00:01:26,160 You know music. 24 00:01:27,240 --> 00:01:28,820 Back to the future. 25 00:01:29,420 --> 00:01:30,460 Out. 26 00:01:30,480 --> 00:01:32,140 We're in the middle of an interview. 27 00:01:32,460 --> 00:01:34,180 Hey, out. 28 00:01:34,820 --> 00:01:37,040 Oh, shame on you. 29 00:01:37,040 --> 00:01:37,540 Shame! 30 00:01:37,540 --> 00:01:40,820 If you look around right now, all the lights are going off. 31 00:01:40,820 --> 00:01:42,760 The trunk's opening. 32 00:01:42,960 --> 00:01:45,680 So all this is being captured traffic. 33 00:01:45,680 --> 00:01:51,500 So now I can go back to that PCAP file and actually start looking at what's controlling all the functions of the car. 34 00:01:51,500 --> 00:01:52,200 Okay. 35 00:01:52,200 --> 00:02:00,420 So it's a really neat and basic way to start learning how a Tesla works as far as it being a web application. 36 00:02:00,420 --> 00:02:02,120 And it's all over HTTP. 37 00:02:02,800 --> 00:02:03,400 Insane. 38 00:02:03,400 --> 00:02:05,620 Does that leave like a major vulnerability? 39 00:02:05,620 --> 00:02:08,800 So supposedly that only happens in the party mode. 40 00:02:09,160 --> 00:02:14,680 That it shouldn't happen to like the actual driving controls, the throttle controls. 41 00:02:14,680 --> 00:02:18,000 But we're kind of hoping to see if somebody can figure that out over the weekend. 42 00:02:18,000 --> 00:02:22,780 Just this week, somebody released how to actually jailbreak a Tesla and get all the features. 43 00:02:23,820 --> 00:02:24,500 Wow. 44 00:02:24,520 --> 00:02:27,080 I mean, if we're talking bad, like how bad could that get? 45 00:02:27,080 --> 00:02:28,900 Could that be something like the accelerator? 46 00:02:29,080 --> 00:02:30,160 Brakes , accelerator. 47 00:02:31,000 --> 00:02:35,460 And again, that's like why party mode is kind of fun is we can capture all that traffic quickly. 48 00:02:35,640 --> 00:02:40,300 It doesn't do anything with the brakes, but at least lets us start understanding how to communicate. 49 00:02:40,300 --> 00:02:44,580 What's so fun about like having the community here is like, hey, let's play with this. 50 00:02:44,700 --> 00:02:46,800 Yeah, there's way smarter people. 51 00:02:46,800 --> 00:02:52,380 And it's like, but it's fun to just all get down and like start thinking through everybody looking at it in a different light. 52 00:02:52,680 --> 00:02:56,140 Which makes it so much fun of like, I didn't think of that. 53 00:02:56,720 --> 00:03:02,240 Last year, when we figured out it was party mode, it was like me half drunk going, put it in party mode. 54 00:03:02,240 --> 00:03:03,440 That'll give it a lot of traffic. 55 00:03:03,440 --> 00:03:05,460 And everybody's like, oh, you told us one of the flags. 56 00:03:05,460 --> 00:03:06,920 I'm like, I didn't fucking know. 57 00:03:07,720 --> 00:03:11,100 You know, some of the best and realizations happen when people are half drunk. 58 00:03:11,100 --> 00:03:12,140 Yeah, I mean, really. 59 00:03:12,620 --> 00:03:13,600 We met that way. 60 00:03:13,600 --> 00:03:14,440 Yeah, exactly. 61 00:03:14,620 --> 00:03:15,500 Exactly. 62 00:03:15,860 --> 00:03:16,860 There we go. 63 00:03:16,860 --> 00:03:23,140 Now, should we take a look at this next part with Raj here and see this other half of what you've been working on today? 64 00:03:23,140 --> 00:03:28,960 So, hey guys, what we'll be doing right here is messing with the RDS, the radio data system. 65 00:03:28,960 --> 00:03:32,280 So most FM stations to this day, we still use this. 66 00:03:32,280 --> 00:03:40,220 So it's essentially whenever you tune into any frequency, your car can tell you what radio station you're tuned into and any sort of radio text. 67 00:03:40,220 --> 00:03:43,720 So over here we have GNU Radio, which is an open source and free tool. 68 00:03:43,740 --> 00:03:48,240 And we are running this through a hack RF, which is an SDR. 69 00:03:48,260 --> 00:03:51,440 They used to be really expensive and now you can get them for under $200. 70 00:03:52,040 --> 00:03:58,120 But then as of GNU Radio, you can simulate this entire environment and learn how to use this on your computer. 71 00:03:58,120 --> 00:04:01,280 All you need is maybe Windows. 72 00:04:01,360 --> 00:04:05,760 I mean, an Ubuntu machine and with GNU Radio and you'll be able to do this. 73 00:04:05,760 --> 00:04:14,260 So what we're doing right here is we're broadcasting text through this, through the hack RF at 88.7 megahertz. 74 00:04:14,300 --> 00:04:18,880 And if we go over to the car and tune into that frequency, you're going to be able to see the text. 75 00:04:18,880 --> 00:04:23,100 If you start fuzzing it, it can cause certain infotainment systems to crash. 76 00:04:23,220 --> 00:04:26,420 And like with a Tesla, it's essentially a computer on wheels. 77 00:04:26,420 --> 00:04:28,100 So what would happen if that crashes? 78 00:04:28,100 --> 00:04:29,680 Does that crash the entire car? 79 00:04:29,680 --> 00:04:32,320 Does it just stop or what happens? 80 00:04:32,320 --> 00:04:39,220 Some other Japanese OEMs, a simple percent symbol can crash the entire infotainment system. 81 00:04:39,220 --> 00:04:41,060 So we can... 82 00:04:41,060 --> 00:04:42,940 While running, while the car is running. 83 00:04:42,940 --> 00:04:43,660 While running. 84 00:04:43,660 --> 00:04:44,540 Let's hop in. 85 00:04:44,980 --> 00:04:48,800 The radio text over here is Car Hacking Village 2023. 86 00:04:48,980 --> 00:04:51,780 So what you can then do is you can start fuzzing this. 87 00:04:51,780 --> 00:04:57,620 And RDS has certain features where you can set it to be an alarm or an emergency. 88 00:04:57,620 --> 00:05:01,780 So all cars around are automatically programmed to tune into that frequency. 89 00:05:01,780 --> 00:05:05,320 And you can mess with a lot of people if you wanted to. 90 00:05:05,320 --> 00:05:11,180 Anything from I think 76 to about 90-ish megahertz is the same as FM radio. 91 00:05:11,180 --> 00:05:11,840 Got it. 92 00:05:11,840 --> 00:05:19,600 Could you also, other than text being notifications, could you put say like a video file that would pop up on the screen or like a GIF or anything like that? 93 00:05:19,600 --> 00:05:21,140 Could that be transmitted or... 94 00:05:21,140 --> 00:05:25,720 Most certainly not with RDS, but there is DAB, Digital Audio Broadcast. 95 00:05:25,720 --> 00:05:27,500 So you can put images on there. 96 00:05:27,500 --> 00:05:33,760 And what you can also do with images is that you can cause buffer overflows and other attacks that can again crash it. 97 00:05:33,760 --> 00:05:41,860 Or the NCC group did some research with DAB where they were able to inject canned frames into the car, essentially controlling the car. 98 00:05:41,860 --> 00:05:46,640 With an amplifier, you can maybe do an entire city or even more. 99 00:05:46,800 --> 00:05:48,900 So you can do them all multiple at the same time? 100 00:05:48,900 --> 00:05:49,160 Multiple. 101 00:05:49,160 --> 00:05:50,160 Oh my god. 102 00:05:50,160 --> 00:05:50,820 OK. 103 00:05:50,860 --> 00:05:52,160 That's amazing. 104 00:05:52,160 --> 00:05:53,880 Give me a lot of ideas here. 105 00:05:54,160 --> 00:06:00,300 And hopefully the rest of the crowd out here, be safe about what you're doing and make smart decisions.