okay ladies and gentlemen thanks for
your patience as you can see there was
some uh setup to be done but so without
further Ado I'll pass you over to
Dominic thank you
so welcome everyone
so uh let me worry about this session so
when I work from home
I
I have some challenges who who has a
kids at home raise your hand
it
you okay so you know uh when I'm talking
about challenges you know what does it
mean so I have two daughters and we have
unexpected amount of
um slots stuffing slots at home like
this
and
um one time um when I was working on
this project
I was working on this project
she's the most clever one
and realized that uh
uh I when I was working on the on on
this wheel and I found all of the
challenges and passed through them uh
finally I can spin that wheel and it was
really appealing to her and uh I could
not detach from from this project
anymore so we have slots and
she really excited to spin that wheel
so let's get started
um
I
would like to start with the schedule
for today here is the when we go through
the automotive Basics just to understand
our attacking steps uh we'll have a
really preparated attack tree and we go
through and so the first half uh we're
gonna see more theoretical and more
basic uh stuff and then we go through
the consoles and best script to see how
we can spin that wheel
so my name is Domi I've been
working in the field of cyber security
for almost uh 15 years and I have
offensive and defensive background both
in vulnerability assessment to
investigations and
I I have a master's degree and there was
a time I collected certifications
um
and a year ago I challenged myself to
change the I to to to leave the ID
security and go to product and uh I
found a good good way that I joined to
the prologue cyber security at the same
group
and
I like the idea how to extend the extent
activity with Automotive as well and I'm
a happy owner model 6 so I personally
involved in this stuff
and here's our disclaimer so the
following demo was prepared for training
and educational purposes and do not try
to use any information for hacking
against cars and car components
text
so
let's get started
um we all know that safety is more than
important in modern vehicles but
the question is for today that what
about cyber security so
um
do you remember Charlie Miller and
Christopher car hackings in the past 10
years they had awesome researches and it
was eye-opener not just to me for the
whole industry so
um
maybe nine years ago Charlie was here
presenting their their findings and it
was awesome for me so today I will take
a closer look how how to hack into the
car comp how to hack into the car
component and um
we were using back books approach so we
don't know anything about our Target I
don't know I don't care I will just want
to reveal brute force and finally find
my way to to use
for my purposes and there are some
challenges on the road so we we need to
understand how we can talk with this
device how we can have access find
weaknesses in security implementation
and if we find them we try to invoke
routines implemented routines and one
may spin that wheel so let's get started
let me introduce our attack to read
sorry this is the first step so we need
to understand that we are if we are in
the car we have some kind of network and
there are ecu's electronic control units
and physically connected together and uh
I have a hint so campus is used most in
the car snow days so we will focus on
can
uh what what is it so it's a control RL
Network and
as we have this it's it's something like
similar in the it word that we have
ethernet and Erp so it's in the in
physical data link layer and
the problem to me
that's another girl that the dozens of
vcu's hanging on the same bus which is a
analyst nightmare because they're
they are so talkative and we have many
uh communication so if you have a
capture we will see some kind of mess
and we need to understand what kind of
IDs we need to focus on so if we have a
special Target we need to find it and
maybe
you can find uh your Target by its ID
I don't know which one is which one
and after the ID usually in a can you
have the data we will cover it later but
it's inside
so are we going to do let's disconnect
the target device amount from the car
maybe it's it's a hard part so maybe
it's easier just to detach from the
canvas and connect your tester tool for
that on that point and test set up your
test environment wake it up find the
signals and try to communicate with it
sounds easy but ah
just one more question
maybe on what communication protocols so
we have UDS unified diagnostic services
the
fits in all modern cars and with a car
diagnostic tool you can talk in this
language with car issues
so as it's a communication protocol uh
it's it's it's on the top of can in an
application layer we have eods
and
in practice
as a tester with client via VCU as a
server which offers access to its
services and if you know what kind of
service is there and how to uh
request some kind of things based on the
service and its parameters you will get
back some kind of service specific
information as a response in case of
positive response it can be different by
service service in case of negative
responsive fixed message format at the
beginning beginning with the 7f and then
the rejected service ID and then the
negative Response Code
so let me peel this layer
so it means then this is the cause of
rejection what it what you can get so um
let me rephrase it so if I in an I.T
World in as a web server with the web
server do you provide access logs to
your clients no uh and what was the
problem here if you request the service
you will get back a non-existing service
you would have back a service not
supported so isn't that something that
should be hidden from the bad guys yes
but this is the word of UDS so
let me show a small message flow that we
are usually when startup a device in the
default session by default there are a
few Services you need to extend your
session to an undefault one to get more
services to work on on the device and
this is you this can be done by session
control so
requesting a session to extend your
session to level three you will get back
response and
this is if it's a positive response your
section section extended to to this one
to level three in case of uh negative
response uh it will start with the 7f
the rejected service ID which is 10 and
the negative Response Code in this case
is 12 sat function not supported what
does it mean that my session control
service 10 and
the requested level is five the liquid
state session was five and it was
rejected because that function not
supported but the sub function was the
survey the session so that session level
session five is not existing in this
system so thanks to the NRC we can we
can we can we can figure out uh what is
available in a device
so uh here is our setup
we have a two-word steering it's a it's
preparated with a custom firmware it's
totally uh different than what you can
see on the road it's prepared for
security weakness and it's it's nothing
else you can find this and it's
connected in a canvas with a Canon
interface to its laptop by USB and this
USB added to my virtual machine which
has Linux open source tools can utils uh
what you what you want to do
is just to start to communicate with it
so the first thing uh
we usually see in a unknown Network just
to
listen so we we started with the
Staffing on the bus with Ken Smith and
well we could see periodical messages so
it's it's always changing the red red
bite red bytes are always changing it
can it's I don't know it's some kind of
information a current value of something
the direction the angle the torque or
anything
but this is these Droids are not the
ones you are looking for because you uh
need to find a server which will respond
to you
so
we need to identify what which can ideas
can be used for our
uh attacking scenario and by session
request which we know that you can
request
on this issue a normal session request
to the default session and you will you
can wait for the positive responses and
if you enumerate all of the canadies you
will find your
once so I numerating all of the canadies
with can send the tool
uh here are our responses I use the
search
okay so I use the filter for only the
positive responses for the default
section change and
there are only two ones so we have can
IDs and we can where we can send
messages and then we know uh which can
ID will get back some response that's
good that was the first step that we
need so we have canadis and no we know
that we need to go for the UDS messages
the first thing what kind of sessions
are in the system available
so there is a manual request for
1001 for the default and maybe I tried
an unknown one 21 and see the
differences between the the results
for the default on we get a positive
response in the green so in the green
box and
we have negative response for an unknown
service session 21.
as we know the the negative Response
Code NRC 12 with sub function not
supported which means that session is
not available
[Music]
find boot services
going to an extended session
okay
which kind of services are available we
know that the session session control is
is there so uh on the second line it's
uh
requesting it's a session control
request without parameters so it's it's
a it's a easy priced
in our case and for the 10 we get back a
negative Response Code which means that
sub function it's so
so this means that the service is
available but it's some function was
wrong
however in other case for example
service 9 we get back NRC 11 server is
not supported what does it mean I'm
interested in the supported services
so filter out the non-supported services
thanks to the NRC it can be done
enumerating all of the services
we get back
not supported ones so we found Services
what kind of services are there
we have obviously we have diagnostic
session control which can be used to
extend our session to a diagnostic
session to unlock additional diagnostic
functions we have issue that may be good
sometimes to go back to the Baseline and
start everything anything from the
beginning
we have security access to requesting
seats and then sending calculated keys
and get get outed authenticated get
access to something which is
secured
and we have routine control maybe that's
the most interesting one because rooting
control can call routines implemented
routines and one maybe May uh spin that
wheel so that's that's a good one and
that's the present it helps to uh keep
alive your session so where we are we
know the services and we start to to
hunt down hunt down the most interesting
one the rooting control
um rooting control flow shows you that
um
it's a service service it has a service
ID 31 and the start routing zero one so
with the with this you can request to
start a routine that's all what we need
so
we just try to start a routine and if
the routine is there and it's everything
is okay we get back a positive response
service ID Plus 40.
uh the rooting start uh byte is there
and here is the routing ID is two bytes
so
if you want to start this routine and
you will get back a positive response it
means that this routine is executed
that's good
in the other case if you get back some
negative responses you need to
understand
that oh this was the rejected service ID
and what is the negative Response Code
and i52 energy again we see that
security access denied that's the point
that we need to understand that okay
there are routines but you need to
elevate your security level to go there
and run that routine so this routine ID
at one a b does not performed
in this case because it's a negative
response
so get it real we started by manually
the first few rooted IDs
3101 and from 0 to 3.
and we get back always the same negative
Response Code 31 which is a bit sad that
it's out of range
in this case it means that that routine
ID 0 1 2 3 was not there so
the only thing we need to we need to do
at first just filter out this kind of
negative responses Maybe
one has different response
and the numerating all of the routines
is by Script you will you will get back
in the green only one different
routine ID and different with the
different response negative response
as we've seen before
NRC searches three so it's accurately
access denied so where we are we know
that there is a routine
which can be called but we need to have
kind of access kind of security
authentication to run it
that's where we are and
here is our attacking tree so we need to
step back and go to security access we
need to bypass somehow this security
find some weaknesses so I promise this
is the last message flow we need to
cover and is it so this is also useful
for our Capture the Flag game so uh
service ID is 27 security level from one
and I did it by two
you can authenticate yourself requesting
in this first case there is a security
assessment request for seed for the
level one and you if in case of positive
response so the security level is there
you get like a positive response with
the seed it can be one by two by three
bytes more and maybe it's good to
understand that if it's small you can
build up your dictionary and try to
guess all of the possible keys for a
seed and you will build up to your
dictionary and you will find a key
maybe it's useful later however if you
get back a seed in normal way you need
to understand you need to know the
security algorithm in the sacred key and
then you can send back a key
uh
based on this process you need to
add one more
one more to the security level and then
you can send your calculated key if it's
good you will get back the service ID
plus 40 and
and uh
and it's something so it's it's okay
it's positive it's authenticated so you
are in the security level one
and based on this process you need to
understand that you need a security
access level and then a good key that's
all what you need what we need but we
don't know about too too much about the
security
uh process in this device so what we
need to do figure out everything about
this service
so going to the live demo part we will
try to find out available security
levels we will analyze the seats maybe
it's random or not the length and what's
the behavior of the wizard we will do
the same on the security Keys calculated
case but maybe we need to Brute Force
the key space and as we have
Google and the standards we know all of
the nrcs so everything can go wrong but
NRC will help
this is the demo time
and
I need just a minute to change my
desktop
okay
and for doing that
I would like to
use
the webcam just to see if if you are
seated in the in the back to see what's
going on because we are focusing how to
bypass the security then how we can call
the routine to spin that wheel so that's
why we need to see this cam
to focus our
Target
what's the password
so this is the live demo part everything
can go wrong
Okay so
so we have a Canon interface uh what's
the password
should be up and running yes it's there
and
uh okay maybe I need to
zoom in
okay so we will use the right part of
the screen to see the responses the
messages that sent out and the response
is from the ECU you use the left part to
send some
uh cam messages and I have prepared
scripts so first we need to enumerate
all these security levels one May
respond differently
going through this process
okay let me stop it so at the first
as you see after the extended session
we'll get always back a negative
response
responses and one is different so we
have a positive response what is the
positive response 67 which is the
positive response for 27 and we have
it's requested security level it's 0b
maybe we can use a different filter just
to
get closer
this word
and I will highlight this again
so going through all of the security
levels I'm I filtered out all of the
negative responses which we are not
interested and so
filtered only for those responses were
very positive responses and check the
line before what was the request so we
know that we requested a level B and we
get back a positive response so we know
what is the security level
one checked
the next one we need to request seeds on
this level
to see what kind of seeding is there
I don't know so we
we check all
and I'm filtering only for the responses
I'm not interested but I sent out
because I know what is there
so as we see there there are always a
get back seats so 67 0b and 0b and then
seats
it's kind of Randomness so it's not good
for a quick win we can use it to build
up our dictionary we'll skip that way
and we try to see what's the behavior of
the reset
so
in the next example we sent we will send
out a easy Wizard and see what is
changed so from now we have an extended
session and get backseat oops and the in
the positive responses the seats are
always the same 40 to 40 to 42
nine or ten times so in the first 10
seconds let me stop it in the first 10
seconds uh we will have fixed it what
does it mean that if we have a challenge
let's fix it we can answer
a fix we we should find a fixed answer
which is which one we need to send back
to the server to authenticate it so
we can Brute Force the key space
and one will help
that's going deeper six seven
and brute forcing the
keys
so after is it okay let me stop it I see
so what's the problem uh at first
here is our seed and then what what
happened we get back always a negative
response and what is the negative
Response Code 35 then 24 okay I have a
help
from Google or anywhere else
35 means that invalid key so I I had a
key attempt tried a key and it was
installed that's good and after that
what happened I get back
24s which means request sequence error
because
I will show you what what's the problem
so the problem is that after reset in
the extended session we we have a CD
request and then in a loop just sending
keys and this is
not good it's not in the process so it's
you need to request to see then after a
key
and do it again time by time so going to
the next one and
let me check
all right
okay going through
let me stop it so in the next example uh
we get back a seed and then invalid key
and then a seed and then invalid key so
we try the key and we get back I got the
response it's not there it's not there
it's not there going through
uh let me use let me just filter out
this noise
and
what is the noise so
I'm more interested everything else but
not the seed
that's good oh that's not good again
I didn't say that it's easy
it's easy easy weaknesses but we have
some challenges so the next step is that
after one two three four five attempts
we get back
negative response 36 and then a 37 what
does it mean
exceeded number of attempts and then
require time delay not expired Brute
Force protection is there it's not good
it's not an easy win we need to work
with this so what we did we requested we
sent out five different Keys got back
invalid Keys negative response and then
band so we need to work in a loop and
visit the ECU time by time that's why we
have scripted and brought different
script
okay
so this one is the next one
so what we're gonna do
is just to see
so we're gonna do that we are interested
all of the can IDs started with seven
and filtering for the positive responses
because we know the security access
protocol sending sending a request for
seed then get back positive response
with the seed and then sending a key
with secret level plus one so if you
have a zero B level we need to go to
we are interested in the zero C for in a
positive response and in this case
uh there is a small small chance that we
will find a good key
it can time consuming if we started from
one byte from zero to effect and go
further and we need to reset Time by
time so
depends on the key space and the
delays
it can be a minute or more yeah okay so
let me stop it so you need to understand
that the key space is only one
byte and the C C is always here is just
one byte so here is the whole process we
have a security seed request for zero B
we get a positive response with the seed
then we have a calculated key we brute
forced all of them but this one is the
only one who had a positive response so
we have a positive response for the zero
C it means that we are authenticated to
the level B
so um
I think we bypass the security so we we
need to rerun the routine and
it should be there
okay
let me
so
um let me warn you that the routing will
be executed I'm really expected that
something gonna
happen
so
see everything let's start the dump
let's start the routine so what we're
gonna do authenticate it to the security
level and call back the routine which we
know what is the routine ID sending this
out
and
yes a negative response again
sorry guys this is the way when we
authenticated to the will be we have a
positive response with level C and then
we started the routine but what what
went wrong NRC
I need to check it
13 incorrect message length so we call
the routine
and you need to understand that
here
is the length of the cam message and
and with four it means that I use the
routine control started the routine with
the routine ID in two bytes and without
parameters
so
the incorrect message length means that
we need to extend this length and give
and get some parameters
okay so here is my last script and after
an issue with it
uh we're gonna go to go to extended
session
access to security level B
requesting the seat sending a well known
key which we
which we had
and if it's granted
we call the routine uh in in the
previous uh step we call the routine
with four it was not good
so
we will call it with
length five and I placed FF in the at
that bite
and then I will call with length 2.
with length 6 which means that a
parameter has two on two bytes so I just
added FF on the last one and going
through I tried all of them so
let's have a chance
to do it
and
sorry I need to
reply
all right so last chance
that there is no way
no sound in the
in the jack
okay do we have a Zone
in Jack no okay you can skip this
so I'm really excited to spin that wheel
slot is there
is there
three
thanks
okay
okay let's finish this previous up we
have five minutes I hope
so as we have two parameters I
understand uh which is what so one is
for direction oh sorry it's been wrong
so uh I just skipped some steps so one
parameter is for the direction and one
parameter is for the speed so
spinner to you
slowly like that
it's
okay and going to the presentation
oops
just meanwhile
meanwhile I found oh
slot even
and here we are
so after this have some demo time uh
going back so we understand that we have
routine and security access denied we
need to understand that there's a lack
of entropy so in the first few seconds
we have no random just a fixed seed it
means that no entropy and the small key
space small key small seed Smoky
and a weak Brute Force protection
because we could drive five keys
each time uh means that we went through
all of all of the process and security
bypassed
so what we've seen is the lesbian
so some conclusions that
why UDS in all vehicles by default there
is no cyber security and
keeping in mind that uh
possible effects on safety you need to
require design and implement the layers
of it and
it can be weak it can be I don't know we
have seen many things in the past so
so what I would like to highlight here
is just we need to validate somehow we
need to test our our stuff and this is
all about this presentation and that's
all you need so you need a
testers who can spin that wheel
and thank you
[Applause]
uh maybe just one more thing that come
to our booth challenge yourself and get
to have some prizes
yeah based on this damage do the closing
time for the
teaching competition or challenge isn't
quite known yet the Bosch will close at
three o'clock
uh all of the uh winners the winners
will be announced here for each of the
three challenges the the winners
announced and the prize is given
sometime after three this afternoon when
I know exactly the the times for those
announcements I'll of course let you
know now it's time for a break the
mid-morning session will recommence at
11 15 so if you can be back please for
11 15. no more questions again thank you
um