start	end	text
400	5840	Good afternoon, ladies and gentlemen. I'm Ian Tabor. I'm here to do my talk on how an
5840	11680	automotive researcher had his car stolen by a can injection. That's the official title of this
11680	17940	talk. The unofficial title of this talk is the irony of how an automotive security researcher
17940	26840	had his car stolen by a method he found on another vehicle. Yeah, great. My colleague who did the
26840	32600	research with me, Dr. Ken Tindall, isn't present, but he has recorded some of the slides here. So
32600	43490	I will be introducing him now, and I'll introduce myself after. There should be audio.
52560	53840	That should be on now.
82470	88370	I'm Ken Tindall, the CAN bus guru. And it's true, I've been working with CAN in the car industry for a long time.
88370	95470	I'm an industry veteran. Started in 1995 with Volvo's P2X, a large platform project.
95490	98910	And that was back when CAN was a shiny new thing, and this was their first major
98910	105550	CAN platform. I helped Motorola design the first real-time CAN controller, and I sold my startup
105550	112450	back then to DeBosch, so I'm an industry veteran. I'm the CTO of CANIS Labs, and that's a CAN
112450	119690	bus security company. And I have quite a few roles there. I've been a hardware IP designer, so I designed
120750	128490	CANHG, the protocol for speeding up CAN by inserting extra fast data inside a slow CAN bit.
128490	135070	And I've been an embedded real-time hardware software designer, and I designed the CryptoCAN
135070	141390	system for encrypting any CAN frame. And today I'm working on the CANon Automation
141390	149590	CANSEC working group for CANXL security. So now I'll introduce who I am. You could say I'm the
149590	155090	ultimate car hacker. I built this vehicle 18 years ago now. It's based on the Ford Sierra rear wheel
155090	161650	drive platform from around the 1990s. It's got a Ford-focused two-liter engine in. It does actually
161650	166590	have three CUs, and it includes CAN, but if you want to try and hack it, I think you would be
166590	173250	sitting on my lap, because the CAN wires are out that long. So good luck. There's a little
173250	178250	disclaimer down at the bottom there. This work was carried out on my own money, on my own time,
178250	183930	and nothing to do with any current or previous employers, just to get that clear. So a little
183930	192490	bit of a history about my car hacking in the past. In 2015, I bought this Citroen DS5, and you
192490	197970	could tether your phone to the head unit and surf the internet from the phone, from the car,
197970	204070	why you'd want to, I don't know, whatever. But if you did an NMAP scan in the other direction,
204070	213270	you could find four ports open. 23, 111, 3333, and 20,000. 23 is telnet, like everyone knows.
213270	218410	Guess what? No credentials, straight in root access. You could then extricate any of the data
218410	228990	via the USB or via FTP server mapped as a path. Yeah, so great. I wrote up my findings, sent them
228990	234770	over to Citroen in France, and said, by the way, is this not a matter of French national security
234770	240550	because the French president gets driven around in one of these things? And they were like, meh,
240550	247610	I don't care. One of my most popular tweets, or one of my most personal highlighted tweets is from
248410	258550	Charlie Miller himself saying, yep, good find. Great. That was in 2017. August 2018, I spoke
258550	267070	at Defcon Car Hacking Village, Defcon 26 now, about the entire findings and what I found, how I
267070	273050	found it, the disclosure process and how they fixed it. Guess what? They disabled the Wi-Fi.
273470	277970	They didn't actually disable the telnet daemon. You could still go back in over the Bluetooth
277970	283230	and turn it back on by modifying those SQLite databases that just happened to be in there.
283310	289410	So, great, wonderful. Eventually, they did actually disable the telnet daemon in about three
289410	294430	versions of software later, but no one actually ever got a recall to actually say, here's a
294430	299770	security update to your head unit. So, good luck. If you've got one of them there, it's probably
299770	307770	still vulnerable. In September 18, I went to the bug crowd bug bash. I was one of 12 global
307770	315030	researchers at the event in Louisville, Kentucky. And the vehicles there all had radar-guided
315030	319810	cruise control. If you look around the radar-guided cruise control sensor, which is that one
319810	326450	there, there's a little plastic shroud. Pop that out with a screwdriver, take two bolts out,
326450	332610	sensors out, you're on the CAN bus wiring. Guess what that CAN bus wiring can do? Start, stop
332610	338990	the car, unlock the vehicle, disarm, unarm the alarm, open the trunk. We weren't actually
338990	344070	allowed to test whether we could actually do any hacks on a moving vehicle, but yes, we did
344070	350110	get a payout between myself, Spectres, and RQU of a five-figure sum. So, thank you very much,
350110	357310	bug crowd. Hell yeah. After I did that, there's a picture of me, slightly slimmer, slightly
357310	363810	younger version of doing a, ha-ha, what's this? Tap, tap, tap, unlock. Tap, tap, tap, fast
363810	369610	started. Yeah. I can steal a vehicle, that vehicle, I can't tell you which, because an NDA in
369610	375850	under 90 seconds from a virgin vehicle. And the car is still vulnerable today, one generation
375850	384510	later. So, great. Security really works, doesn't it? Since then, using that money from that
384510	393090	bounty, I built my own car in a box called PD0. PD0 is a Peugeot 208, P for Peugeot, and D0 is
393090	398710	208 in hex. It's basically most of the electronics from that vehicle, except for the airbag
398710	405510	ECU, and it thinks it's a fully working car. The inspiration was 3P over there, but as you can
405510	412010	see on the left there, there's an ABS simulator for the wheel speed sensors, there's a crank and
412010	417470	cam sensor simulator for the speed, for the engine speed, et cetera. There's some O2
417470	423390	simulators as well. If you want any of the hardware to do that, contact me. I have spares of
423390	429210	those things, and I have instructions on how to do it. It's up on my GitHub. But I now take
429210	433950	this around the UK and Europe as part of the Car Hacking Village Europe. I've actually been
433950	441490	requested to take it to Australia, Brazil, America, Singapore, Philippines, amongst other
441490	448230	places. I took it to Amsterdam once, and that was fun. What's in the box? A car. Well, a model
448230	454090	car? No, a whole car. Security man didn't find it funny. It was like, yeah, what did you do that
454090	463830	for? It was like, on your way. I don't want to fill that for me. So great. In October 2019, I
463830	469650	again went to the bug bash in the global headquarters of the same OEM up in Detroit. Again,
469650	475570	can't mention it, but it's in Detroit. There's one of a few. And there was radar hack version
475570	482530	two. This little device here is based on an ESP32. It has Bluetooth and Wi-Fi, and it also has
482530	488430	an infrared receiver. At the bottom there is a little remote control. If I put that device
488430	495330	between the radar and the radar wiring and go the other side of the car park, press the button,
495330	501430	the trunk opens. There's nothing you can do about it. Yes, it's a targeted hack against a
501430	508230	single vehicle, but you could have some fun with your mate's car. You could also possibly test
508230	513870	it on a moving vehicle because the Bluetooth actually is, Bluetooth can, but they wouldn't
513870	517670	allow us to test it on a moving vehicle because that would be dangerous and we might do
517670	528010	something stupid. So, yeah. In October 2019, I also went to the auto Isaac over in Texas for
528560	536650	hacker one at Toyota's headquarters. That will come pertinent later. Myself, Spectres, and
536650	542990	Mutley did a talk about vulnerability disclosure program and how that's actually valuable to the
542990	547990	automotive industry and how researchers like myself and others can help the automotive
547990	553510	industry and you need to have this program in place so that we can get you that information and
553510	559470	you can start to fix things. Some vendors do have it. Some vendors do it well. Some vendors
559470	571110	don't. But, yep. 2020, or the COVID year as you call it, I made this little box here. It's what I
571110	576030	call the real version of Toyota passes over there somewhere on the PWC stand. Their version
576030	583970	costs you $30,000. That's a car. That version cost me $800 to build. It does almost exactly the
583970	591930	same thing and I've actually retrofitted it with RFID based ignition and the JBL speaker thing I'm
591930	598270	talking about is actually possible to plug it in and basically use this to start the ignition on
598270	604290	the car and the case. So, none of that code is in the code that is on GitHub because I'm
604290	609190	not going to release that because I'm not stupid. It's actually stored in the E prom and no
609190	612890	one's ever going to get that other than me. But it is actually vulnerable. I was going to
612890	619470	bring it but I didn't have enough space in my hand luggage. So, yep. Onto the actual theft
619470	628210	itself. April last year, I came out on a Sunday morning, found my bumper hanging off and the
629130	635510	headlight was unplugged and I'm thinking, that's on the curb side. No one's hit it. That looks
635510	642950	like vandalism. Looks a bit dodgy. I didn't even think it was trying to steal my car. And then a
642950	647650	friend of mine who's another security researcher got in contact and said, by the way, they
647650	653250	might be trying to nick it. I was like, oh, for fuck's sake. I actually tested the radar
653250	658190	sensor on the Toyota. It's on a different network. You can't do it by the radar sensor. You
658190	665350	can do it by the headlight, though. Thank you. Great. Wonderful. So, at that point, I bought
665350	672790	myself a dash cam, installed it front and rear. Come back to that in a second. In July, I
672790	676870	started a new job up the other end of the country. I had to leave at sort of 5 o'clock in the
676870	682230	morning. Came out, found the same thing again. Bumper hanging off, headlight not working. So I
682230	688710	drove to work with one headlight in the dark. Not a good idea. Whatever. Not quite the dark,
688710	693610	but yeah. So when I got to work, I put it all back together. Plugged it all in. Everything's
693610	702010	all hunky dory. Came back home. Next day, everything was fine with work. Go to bed Wednesday
702010	707990	night. Get a nudge from the missus at half past 2 in the morning. Where did you park the car
707990	718830	last night? Same place I usually park it. Oh crap, it's not there. So look out the window. Big
718830	727650	space, no car, shit. So what do I do? Get onto the old my Toyota app. You may or may not be
727650	737710	able to see this, but the my Toyota app says it's got 100% fuel, 11,463 miles, and at the bottom
737710	744910	there, if you see just where it's got the icons, it says vehicle in motion. So the car was
744910	750690	currently in motion. It doesn't track a vehicle that has been stolen. There is no way to track
750810	755690	a vehicle that has been stolen. Because there is the issue of say there was a domestic
755690	759830	violence case and someone wanted to get away from their other half, someone might have access
759830	764250	to the app so they know where you are. So the only time that actually updates is when it
764250	769830	actually stops at the other end, which is great. That comes on to my next thing from the
769830	776590	my Toyota app. I got an update saying the fuel gauge is down at 50%. Where was it when the
776590	781890	fuel gauge was down at 50%? I don't know. It must have known somewhere where it was. But
781890	787310	yeah, great. I'm not going to dox myself because I don't actually live there anymore. So don't
787310	795250	worry. So in the my Toyota app, you get notifications. As you can see, those big orange alerts
795250	801410	are like, oh bugger, something bad has happened. The one at the top says hybrid system, major
801410	807090	malfunction, take it to a dealer immediately. The one below it says sonar system, again, take
807090	813930	it to the dealer immediately. So they basically screwed the car. Bugger. So I couldn't track
813930	819110	where it was. It didn't then appear ever again. I phoned the police. They couldn't do
819110	824730	anything. Tried to contact Toyota online. They wouldn't do anything because they don't have
824730	830830	stolen vehicle tracking in the country, which is a bit shit, really. Actually a friend of
830830	834750	mine, Ken, actually thought it was a targeted hack because I did the radar hack and someone
834750	838650	thought, oh, it must be another car hacker. They nicked the car for a couple of days and it
838650	845270	would reappear in three days' time. It didn't. A couple of weeks later, my neighbor has a
845270	850850	land cruiser, or shall we say had a land cruiser. First time they tried to nick it, the alarm
850850	857350	went off and they run off, the three little scrotes. A couple of weeks later, he left it out on
857350	863060	the road around the front. We went in for half an hour, came back out, it was gone. So it
863060	870320	wasn't a targeted hack. There was two vehicles from my block stolen and also there are a
870320	874560	couple of RAV4s around the area where I used to live that I used to see around and about that
874560	879600	aren't there anymore either. So there are quite a few that were stolen from that area. And
879600	883440	looking on Reddit and things, there are also quite a few in the north London area that have
883440	889140	also been stolen. So on to my initial investigations. I'm not going to play this video
889140	893620	because it's a bit dark and a bit rubbish and you can't really see it. But if you take a look at
893620	900500	the video there, QR code, this video is linked in the blog post. When we first linked it, it
900500	907720	had 20,000 views on it. It now currently has about 330,000 views on it. I think they've made
907720	912800	some money out of us linking to their video. Good luck to them because they had their car
912800	919600	nicked as well. So that's great. On to another vehicle. This one was from Twitter. This is
919600	928120	slightly sped up and takes about 90 seconds in total. So playing around in the corner by the
928120	935060	bumper. Mate comes along with a torch. See the lights come on. Doors are open. Jobs are
935060	943880	done. Car is gone. That's literally 90 seconds. Oh, bugger. So I did a bit of an
943880	949860	investigation. I spoke to a friend of mine who works in vehicle system forensics. He used to
949860	955660	be an ex-police traffic cop and he said he'd come across some of these things with his
955660	961340	colleagues that he used to work with and they are basically a little Bluetooth speaker that
961340	966000	has some extra electronics inside it that you plug into the CAN bus in the back of the
966000	973660	headlight wiring. The giveaway is the two pins here. So USB-C cable. So yeah, great. But this
973660	978420	is used for plausible deniability. They get stopped in the street. It's a speaker. It's
978420	982060	broken. It doesn't work. If they were clever, they could actually put a slightly smaller
982060	988520	speaker in and still work. But whatever. But they're sold as emergency start devices. Why
988520	993080	would a locksmith want something that looks vaguely like a USB speaker to go and open
993080	999800	cars? Yeah, not good. When I first found out about it, the price of this device was 1,500
999800	1005760	euros. When I actually eventually got around to buying it in February this year, the price
1005760	1011080	had gone up to 2,500 euros. I'm not going to give any details of where I purchased it from
1011080	1017640	because they actually don't sell it anymore. But if you Google emergency start device JBL,
1017640	1024340	you'll find it. And there are shops across Europe and in Eastern Europe, in America, other
1024340	1031060	places that now sell it for nearly 4, 5,000 euros or 5,000 dollars. So the price is going
1031060	1038540	up because they're obviously in demand. But yeah. Here's a list of the actually claimed
1038540	1046660	devices it actually believes it works on. So you've got the Toyota Supra, Prius, CHR,
1046660	1054340	F4, Highlander, Land Cruiser, Proace, and the majority of the Lexus range. So that's quite a
1054340	1062960	widespread. So yeah. You can nick quite a few different cars quite easily. Very cheap. So
1062960	1070020	what is actually in this device? You've got externally, it just looks like a JBL speaker.
1070020	1075000	Internally, there's the electronics from the speaker, the blue PCB. The black blob is the
1075000	1079960	electronics for the actual device itself. I can't give you the details of the underneath the
1079960	1085920	black blob because that gives away what it actually is. But basically there's a PIC18F25K80
1088840	1094700	and a modified can transceiver. I can't go into details on how that modified can transceiver
1094700	1104640	works or what it does. Ken's going to go through that in a minute. So yes, it is modified. That
1104640	1109100	details will never get out. I tried to do a bit of reverse engineering with my old picket
1109100	1115340	thing, but there's no one amongst thieves and the bastard had locked down the firmware so you
1115340	1120920	couldn't read it out. But there is a heart of darkness attract that you can do on that chip.
1122240	1126340	But you potentially need two of those chips because you have to read it out half of the chip
1126340	1131080	at a time, which is, I'm not buying another one, especially as it's four and a half thousand
1131080	1138180	euros now. There is possibly a few other ways to glitch it and get access to the firmware as
1138180	1142460	well, but we believe we've actually got the data out anyway by just what it does on the
1142460	1150480	canvas. I'm now going to hand back to Ken. So let's look at some bench testing that they did
1150480	1156180	to investigate how this device works. First point I want to make out is this is using fake
1156180	1161660	data. So we renamed the CAN analyzer and payloads because we're not here to help people make
1162340	1170300	devices to steal Toyota cars. So this is a logic analyzer trace and we've got some CAN
1170300	1177600	data here from various ECU traces and the theft device. And there's a signal here called
1179020	1185840	inject JIT select. So that enables the override transceiver, which we'll talk about in a moment.
1186680	1193740	And then this is the TX line for the injector, the theft device that's injecting CAN frames.
1193960	1199840	And then we can see here all the other ECUs. Here's a transmit line from one of the ECUs
1199840	1204540	and then various CAN high and low signals on the bus. And then we have another receive
1205680	1210800	pin on the CAN transceiver so we can see what comes through. So this is a standard CAN frame
1210800	1216080	so it's not very nice. So here's the visual line as it goes through. Here's what's transmitted.
1216440	1222520	Here's the CAN high and low. Lines are pulled apart when we have a dominant bit. And that
1222520	1228400	all comes through just fine here. So this is a perfectly fine CAN frame. Now let's have a look
1228400	1237220	when we turn on the inject JIT select line. So this turns on the transceiver and that forces a
1237220	1243460	recessive state onto the bus. So here we're injecting a one bit onto the CAN line so we're
1243640	1247600	injecting a recessive state. And here's an ECU trying to transmit and it goes through this very
1248180	1252700	very funny pattern here. Trying to insert a dominant state and you can see it's trying to
1252700	1257600	pull these CAN high and low lines apart but it doesn't really succeed so what the other
1258280	1262820	ECU see on their CAN receive pins is just a recessive which is the same as the transmitted
1262820	1269620	signal. If you want to know why this pattern is like it is, this is one of my CAN quiz questions
1269620	1278720	on my blog post which we'll point you at. So you can see here when we're actually trying to
1278720	1287200	transmit a frame. So here is a spoof frame being transmitted and here the ECU is receiving that.
1287440	1293280	Now one of the interesting things about CAN is the sender transmits a recessive bit for the
1293280	1300140	acknowledgement slot and then all the ECUs respond with a dominant bit. Now normally this override
1300140	1304400	transceiver would cause that to fail and there would be an error because you wouldn't get an
1304400	1312260	acknowledgement back. But when all of the ECUs are all pulling together they can drive enough
1312260	1316400	voltage onto the bus through the combined transceivers and that's just enough to push
1316400	1322860	CAN high and low apart enough to then come through as a dominant bit. So everyone sees
1322860	1327660	that as a valid CAN frame. So that's one of the nice properties of the way this transceiver works.
1328020	1333420	Nice as in it works, is it allows all the ECUs to pull together. So you have one ECU on the bus
1333420	1339580	that's not strong enough to drive an acknowledgement bit. So I've been talking about that custom CAN
1339580	1346360	transceiver circuit. It's inside that resin blob. It's not a proper CAN transceiver of course because
1346360	1352580	criminals don't care about CAN standards. So it's designed to break all the protocols to push weird
1352580	1358080	voltages onto the bus and that's enough to spoof all the CAN transceiver circuits for all the
1358080	1365200	real ECUs. So it can push any CAN bus traffic onto the bus that other transceivers will see
1365200	1371200	as proper CAN frames and most importantly it can't be stopped. You can't, other ECUs cannot drive
1372100	1376160	a dominant bit onto the CAN bus unless they're all acting at exactly the same time.
1376320	1382940	So this means hardware security approaches like NXP Stinger transceiver which has a kind of
1382940	1387560	blacklist white list for destroying CAN frames and it knows it spoofs. That won't work because
1387560	1393100	it can't send an error frame onto the bus because it can't drive a dominant state and the CANHG
1393100	1398620	protocol I mentioned earlier also uses the same technique to destroy frames and it knows are bad
1398620	1403420	in some way and again it can't do that if this transceiver circuit is driving a recessive state
1403420	1412560	from the bus. So let's have a look briefly how this works in a bit more detail. This is a network
1412560	1420000	topology diagram for the Toyota RAV4. It's very very simplified just for clarity so the actual
1420000	1425320	wiring diagrams are complicated with an awful lot more ECUs in it and many more CAN buses but this
1425320	1431120	is the rough schematic. So up here we have the left headlight where the themes break in the
1431120	1437580	connector so they can access the CAN high load on this red bus. Also on this bus is the smart key
1437580	1445660	ECU. So this is the ECU that enters into a nice dialogue with the driver's keys, it uses asymmetric
1445660	1451440	encryption certificates and things so it must be secure and the driver's keys can be authenticated
1451440	1457280	and then once it's been authenticated it sends a message over CAN bus to the door ECUs to unlock
1457280	1463620	the doors and to this gateway ECU which is forwarded on to the engine management system
1463620	1472040	on a CAN bus that disables the immobilizer. And so the thieves basically disable this whole bus
1473840	1479120	and inject CAN frames that spoof the smart keys CAN frames to say that everything is fine
1479120	1485020	so all these ECUs see everything, see the smart key frames and act on them so the door
1485020	1489220	module is open, the gateway sees a valid frame and turns it on and the engine management system
1489220	1496000	obviously just operates on that. So that's how the CAN injection works.
1498920	1505620	There's a blog post I wrote up on this and it's been very well received and it's in fact used for
1505620	1512960	the CV that's been awarded for this vulnerability and it generated an awful lot of comments.
1513580	1520780	So we thought we'd do a top three frequently asked questions here except they're not frequently
1520780	1524920	asked questions, they're car security mansplanations from people who don't understand
1525340	1531160	how cars work. So I thought I would give the top three why your mansplanation of how easy it is
1531160	1539120	is not actually true. So coming in at number three is just add a firewall to isolate the headlights
1540720	1547720	so but unfortunately a firewall costs money. It's a PCB, power, metal case, connectors,
1547980	1552120	a couple of CAN buses, all kinds of stuff like that and some more connectors on the other side.
1552620	1558340	Even if it costs ten dollars, which it won't, it's more than that, but even if it costs ten dollars
1558340	1565120	multiply that by 50 million cars, which is what Toyota made in the last few years, that is a
1565120	1570760	half a billion dollars. So this is a brilliant security solution and about as smart as Elon Musk
1570760	1576460	because you've wasted about the same amount of money he's just wasted on Twitter. Number two,
1576460	1582180	just use TLS and WireGuard to encrypt all the messages. Well, CAN messages are eight bytes long
1583600	1588840	and CAN messages contain small sensor and actuator data like turn the main beam on.
1588840	1594120	This is not the sort of thing that you throw huge overheads of mainstream IT solutions for.
1594120	1599320	Car electronics is a distributed, real-time, embedded, safety critical, mechatronic system
1599320	1606020	controlling wheels. It is not a phone on wheels, it's not a computer on wheels, it's a distributed
1606020	1611860	control system. And it's all about short, worst case latencies, not about bandwidth. So even
1611860	1617520	though CAN is relatively slow, because the data is relatively small, this is a perfect solution for
1617520	1622680	it. A car isn't this data center on wheels and all these mainstream IT solutions, they're solving a
1622680	1626840	completely different set of problems. And so those solutions are not appropriate for real-time
1626840	1633160	control. And number one, just use a relay to turn the headlights on. Why do you need a CAN bus in
1633160	1640040	headlights? Well, first of all, it's not called a headlight cluster for nothing. Inside that are
1640040	1644100	the main beam, the low beam, side lights, the indicator lights, the daylight running lights,
1644100	1650460	different lighting modes, washer pump motors, wiper motors, LED projector lights, and then
1650460	1654760	there are multiple ECUs that want to control all of this stuff. And some cars, of course, even
1654760	1659480	have motors for steering the headlights. The idea that you can just turn it on and off with a
1659480	1669680	switch is simply not workable. But a superlative suggestion and one that we'll bear in mind.
1669680	1675220	No, we're not going to do that. Can't just chuck it back to a relay. So on to media coverage.
1675220	1680740	Here is a sample of the different reports about what happened after the blog post was released.
1680900	1686420	Most of them come out with, oh, headlight hacking. It's not the effing headlight. It's the effing
1686420	1692820	headlight wire. Yeah, you unplug the headlight. The headlight is now nothing to do with it. But
1692820	1698920	life happens. They make up the stories. It's quite interesting. There was a story in Sweden
1699480	1705660	about a shed load of RAV4s and RX450s being found in a container warehouse which were
1705660	1711460	allegedly stolen for payment for drugs to be shipped abroad. So they sort of pinned it together
1711460	1717180	that it was actually done by can injection after we published our details on our blog post
1717180	1722040	because they actually thought it was done by a relay attack because both of them look exactly
1722040	1729500	the same. I will go on to another bit in the press. If you know of the AA in the UK,
1729760	1736380	Automobile Association, the chairman Sir Edmund King had his wife's Lexus stolen and he then
1736380	1743980	published a post saying, by the way, put your keys in the microwave because that's a Faraday cage.
1743980	1751400	Yep, great. He then said his keys were actually in the microwave. So how did they steal it?
1751400	1758100	Probably can injection. Didn't go anywhere near his keys. So I did send him the details and he
1758100	1761720	is going to have a look at it and get back to me. But he was busy with some smart motorway
1761720	1768820	stuff. So that's an interesting story that the man in charge of AA had his Lexus nicked and he
1768820	1774440	still doesn't know how it was nicked. He does now, but whatever. On to a bit more media
1774440	1782520	coverage. Vice.com did this video. Try the door handle. Cable is already plugged into the back
1782520	1789620	of the headlight under the wheel arch. Plug the thing in. It's doing some messages. He now tries
1789620	1796320	the door handle again. Oh no, it's still locked. Whoops. Press the play button on the side. That
1796320	1801780	triggers the locks. Now we just unplug the thing because you don't need it anymore.
1801780	1809160	Wander around to the side of the vehicle. Open the door. Press your foot on the brake. And if
1809160	1817680	you look carefully, the rev counter now shows 1,000 RPM. That again, less than two minutes.
1817900	1825580	There is a Vice video with the same story showing the older 3210 Nokia version which will steal
1826420	1833620	2012 to 2015 type varieties. So there are links on my website to all these stories and things and
1833620	1839420	videos. So if you want to have a look later, my website is at the end. There's also been quite
1839560	1847400	a lot of industry coverage. Upstream producer, half year 2023 auto cyber trend report. Our
1847400	1853920	research got mentioned and our blog post was linked. Oh no, can injection. Yep. It's been
1853920	1860500	around for years. Just no one speaks about it. They think things are secure. It's not. C2A
1860500	1868760	also published this other one, can injection, a rising threat to the auto security. Yep. Again,
1868760	1876120	links are on there to my website, on my website to those. So we actually got the CV issued by
1876120	1883140	ASRG and we did that so that other manufacturers can be made aware. That website, I bought the
1883140	1890620	device for Toyota and Lexus. Sell devices for every make that is available at the moment.
1890620	1902680	Ranging from a few hundred dollars to $25,000-ish. So no manufacturer is immune. And yep, I'll go
1902680	1911740	on to some of that later. I did actually log the name of the CVE as can injection with the
1911740	1918040	emojis. That's the U.K. spec emojis because we drive on the correct side of the road. That's
1918040	1922860	the American spec emojis because you drive on the wrong side of the road or the right, whichever
1922860	1930080	you want to say. But I'm English. I'm right. Currently the CV is only listed against my 2021
1930080	1936280	RAV4 because that's my car. I'd like to get it updated with the other ones when we confirm
1936280	1945060	which ones actually do work. But that may take time. So on to actual numbers. So in the last six
1945060	1952120	years, the RAV4 has sold just over 5 million vehicles. The Prius, about half a million. CHR,
1952120	1958680	about 4 million. Land cruiser, 100,000. Highlander, 2 million-ish. Lexus, I couldn't find
1958680	1965300	individual details of all the different models. But over that five, six years, 4.2 million
1965300	1971060	vehicles. So potentially across the globe, there's at least 15 and a half million cars that can be
1971060	1980800	stolen by this $20 worth of electronics. Yeah. Great. Wonderful. And going back to that number
1980800	1988200	of 50 million-ish cars, over the last six years, they sold 56 and a half million cars. Again,
1988200	1994780	times that by $10, that's half a billion dollars. Security ain't that cheap. All these figures
1994780	2001880	were taken from either Wikipedia or Google or Toyota's website themselves. So when we
2001880	2009780	actually bought this device, I did some testing on a friend of mine's car. Lexus NS300H. I made
2009940	2015660	a device here. As you can see, it's got a little missile switch. That does the unlock. The other
2015660	2022560	switch here turns off and on the additional transceiver component. I went over to see my
2022560	2027800	and we tried it without the additional transceiver because I didn't want to break his car
2027800	2035240	because I know when my car was stolen, it threw 26 DTCs and probably had to be reset. So I was a
2035240	2041160	bit cautious. Check the one for unlock. That worked. Check the one for start the engine without
2041160	2047680	the additional transceiver. Didn't work. After I left, curiosity got the better of him and he
2047680	2054100	used my version of this and had a little play himself. No keys in the car. Nowhere near. Plugged
2054100	2061420	it into the headlight. Let it do its thing. Pop the thing up. Press the button. Car unlocked.
2061600	2068280	Drove it around the car park a couple of times. Yeah. Oops. He then put it all back together,
2068280	2074640	started the car with a key properly, with a key present, et cetera. And the rotating headlight
2074640	2078740	on the left-hand side of the vehicle stopped working. So he had to take it back to the dealer
2078740	2084720	and say, ooh, my headlight stopped working. I haven't been playing around with it. Luckily it
2084720	2090520	didn't cost him anything because I feel a bit guilty that he broke his car for me. So, yep,
2090520	2095620	thank you very much. Yep, cheers. I'd like to actually get access to all of the different
2095620	2101340	models that are actually claimed to be used and then have the full Toyota diagnostic tool
2101340	2107360	with the cooperation of Toyota to then reset them and then update the list on the CVE to then
2107360	2114760	actually see which ones are and are not possible. The interesting one is, though, if you know
2114760	2123380	anything about the Toyota Supra, that may or may not be a BMW Z4. So is the BMW Z4 also vulnerable
2124000	2130480	to the same thing? I don't know. I would like to check it. If you have a Z4 in the car park,
2130480	2136820	hit me up later. We'll have a go. No, don't, please. I don't want to get done doing anything
2136820	2142520	stupid. And the Toyota Proace van, if you know anything about that one, that's based on the
2142520	2148300	Peugeot Citroen platform in Europe. So, again, there are other vehicles also based on that
2148300	2155140	platform that could potentially be vulnerable. Onto the disclosure process. This was fun. In
2155140	2162660	March earlier this year, I put a tweet out, does anyone have a contact in Toyota, either Japan or
2162660	2169500	U.S. or anywhere, to help us with the disclosure. I've got this thing that's used to steal cars.
2170040	2176280	I got nothing. I said, okay. I rang my local dealer. I nearly bought the car off and said,
2176280	2181540	by the way, have you had any issues with cars being stolen? And the receptionist was really
2181540	2186240	helpful and said, no, but I'll get the service manager to ring you back. About a half hour
2186240	2190820	later, the service manager rang me back and went, actually, yeah, one of my demonstrators, I was
2190820	2197320	out for a night a couple of weeks back or a couple of months back, parked it up, went home, came
2197320	2203660	back the next morning, it wasn't there. He did a bit of an investigation and then found out, yep,
2203660	2209580	they've been nicking it by the headlights. I spoke to him and he said, at one point late in
2209580	2216720	last year, there was his garage alone that he worked at was getting three instances a week of
2216720	2222420	vehicles either being stolen or being potentially stolen. There was a memo put out by someone
2222420	2227320	somewhere in Toyota UK or Europe or something saying, by the way, make sure you lock your
2227320	2232640	vehicles up behind the bars and things because they will go walkies off your forecourt. So,
2232640	2239340	yes, they are aware of it. They've known about it. Great. I then sent some details to him about
2239340	2245220	what we found out. He then sent them off to somewhere who he was dealing with and then a few
2245220	2251160	days later I got a direct email from someone from Toyota Japan copied into quite a few people in
2251160	2258280	Toyota Europe and it basically said, use hacker one vulnerability disclosure program. So, yeah,
2258280	2264300	that one that I went to in 2019 to talk about vulnerability disclosure, that was at Toyota's
2264300	2270620	headquarters. Great. Their vulnerability disclosure program has a couple of caveats. There's a
2270620	2276120	restriction to modifications to the vehicle. Tell that to the criminal, rip the bumper off to
2276120	2280980	actually get to the headlight. So, yeah, you can't do that to steal my car. Yeah, no, you're not
2280980	2287420	allowed to do that. So, yeah, great. And there's an implied NDA. And then implied NDA says when
2287420	2293720	you tell hacker one something about it, basically you then can't tell anyone else about it. So,
2293720	2299820	you can't warn anyone that you've actually told Toyota via hacker one. So, great. Wonderful.
2300800	2305600	I did actually get an email back from Toyota Japan saying, by the way, we're going to waive
2305600	2314640	that NDA. But a few weeks later I got someone I know was on the auto Isaac panel and they were
2314640	2319840	discussing our vulnerability in one of their meetings and the discussion basically went along
2319840	2326580	the lines of how can we shut these people up? Because it's cheaper to silence them to actually
2326580	2333380	then fix the problem. So, someone sends me a random NDA disclaimer thingy that may or may not
2333380	2339900	be on an email that I can't guarantee is genuine. You think I'm going to trust that? Do anyone
2339900	2346500	see what happened to Carlos Ghosn? Yeah? Great. No. Got done for fraud. Had to be smuggled out
2346500	2352860	of Japan in a flight box. So, currently we're in the process of disclosing via ASRG,
2352860	2357700	automotive security research group, and they are, again, getting exactly the same response
2357700	2364340	from Toyota and the response is report it by hacker one. This morning I actually had a
2364340	2371520	meeting with someone from Toyota USA and basically told them some of the details of my
2371520	2376200	findings and they basically said it needs to go via hacker one because we need to track
2376200	2381460	things, which I understand. That's fine. And I said to him, as long as you get me a piece of
2381460	2387600	paper that is a signed proper piece of paper on Toyota headed paper, we will do it. We will
2387600	2391960	share some information. There may have to be an NDA in one direction because you might tell me
2391960	2396600	some stuff that you don't want getting out, which is fine, but anything that is currently out
2398540	2402300	isn't dangerous because I'm not going to tell you all the secrets. And I can't tell you all
2402300	2409280	the secrets because it's how to steal a bloody car. So, yeah. After that thing, I did
2409280	2413860	actually put a LinkedIn post with a bit of tongue in cheek thing that basically said, by the
2413860	2419480	way, if you want some information on this stuff, hit us up. We can have a private meeting
2420060	2427980	without too many people around so that we can discuss it with other OEMs, et cetera. So back
2427980	2432560	on to my colleague, Ken, with some potential fixes.
2432600	2437380	So we've talked a lot about how this theft device works and how it uses a transceiver to bust
2437380	2442380	through all kinds of defenses and we've talked about all the things that won't work like
2442940	2450340	relays to headlights and $50 billion of money spent on electronics. What fixes are there? So we
2450340	2457460	offered two. One of them is to do a quick and dirty short-term fix. So make the gateway
2457900	2463580	paranoid about CAN bus errors at startup. So when the vehicle is first being started up and
2463580	2469060	this theft device is working, it's a very crude device so it blasts its frames onto the CAN
2469060	2474860	bus and everyone else's frames don't turn up so there are heartbeat messages missing and stuff
2474860	2481000	like that. So if the gateway device is a bit paranoid and sees a bunch of errors on the CAN
2481000	2485900	bus, its own frames are not being sent, it's on, it can basically say I'm not going to forward
2485900	2490320	any messages until that happens, until it's all gone away. And if there was a false positive on
2490320	2495720	that, you would just try your smart key again. So this is a quick and dirty hack. The theft
2495720	2500780	device vendors, I won't explain how, but they could work around this after a while with a bit
2500780	2505960	more work and effort or maybe just move on to someone else's car. But either way, it's a
2505960	2514220	short-term fix. A permanent fix to this is to use cryptographic messaging between the smart
2514220	2523040	key, up here, smart key, see you, and the doors, and the smart key, and the engine management,
2523040	2530020	or possibly just the gateway. And you can use solutions like CryptoCAN, which I developed,
2530580	2536720	CanisLabs, or you could use SecoC, which is Autosar's secure on-board communication, to
2536720	2542100	secure those messages against spoofing. There's no need to encrypt everything, of course,
2542100	2546700	you don't need to encrypt everything, because thieves are not going to get by with some of the
2546700	2552940	boring sensor messages. It's important, it's the smart key, traffic to the immobilizer and the
2552940	2561260	doors are the things to encrypt. Just a couple of slides left. This one's quite funny. I think
2561260	2567960	Toyota might be trolling me. 2024 Toyota Tacoma gets a JBL speaker that has a nifty
2567960	2574940	removable speaker. Looks a bit like this. Is this just in case you lose the keys out on the
2574940	2580200	trail? It's got the hardware in it, a little extra wire, poke it underneath the wheel arch,
2580200	2586140	job's a good'un. I don't think it does, but it would be bloody hilarious if you could retrofit
2586140	2592220	it. I could do that. I'm not going to, because we don't get the Tacoma in the UK, but it would
2592220	2598960	be funny. This is potentially my last slide with any sort of information. The fallout of
2598960	2606960	our findings, a friend of mine, David Rogers, found this article about Jaguar Land Rover.
2607520	2613100	Insurance companies in the UK are not insuring them anymore, because they are so easy to be
2613100	2618960	stolen, or they're basically pricing it out of the market. So car makers need to get their
2618960	2627160	finger out their ass and fix it, because cars are going to be either uninsurable, or no one's
2627160	2630940	going to want them, because no one's going to be able to afford a few grand a year to
2630940	2637260	actually insure their car. But the problem is, they will fix it going forward. They won't fix
2637260	2643040	it going back, so all those cars that are previously made are still vulnerable. So yeah, not
2643040	2651780	much more, but on to my final slide. I'd just like to say thank yous. First to the ASRG, to
2651780	2659640	specifically John Hildreth, he's been helping us with the disclosure process to OTA Japan. We
2659640	2666400	are doing this, this is exactly the same talk at the ASRG SOS conference next month in
2666400	2674080	September, so look it up. I'd also like to say thank you to Bug Crowd and all the team of car
2674080	2682200	hackers that were there in the 2018 and 2019 events. Wave if you're in the audience. There's
2682200	2687660	some down at the front, there's some at the back, yep. Noel Loudon, my colleague, my friend
2687660	2693620	that's an incident investigation chap, ex-policeman, he's the one that pointed me in the
2693620	2700260	direction. Zoltan may or may not be the crazy bugger that broke his own car for me. Thank you
2700260	2706760	very much. I didn't ask you to do that, you idiot. Finally I'd like to say thank you to
2706760	2712360	Car Hacking Village for allowing me to be here and share this story. I don't have time for
2712360	2717780	questions because cock ups with audio and I can't give you any more information than has
2717780	2724560	already been given, so don't ask. Yeah? I can't give it. I cannot tell you anything about how
2724560	2728960	it was made, the messages or anything. So thank you very much.