[Music]
okay
oh
all right it is 8 30 so i will commence
and uh we'll talk about connecting to a
car in 2022.
um i guess the genesis for this talk was
just you know we do a lot we connect to
a lot of cars i'd say we bring about two
or three cars a week into my office
and we're connecting all different types
of them and older cars were super simple
to connect to but the newer cars have
gotten a lot more difficult uh raise
your hand if you've ever tried to like
connect to a car before ever that guy
that guy so a couple people have are
like veterans and connected to a car so
i'm going to talk a little bit about
what it was like and what it's like now
raise your hand if you have a newer car
like you know like 20 in the past few
years
okay
so if you're if you're planning on
hacking your car that's the real
question raise your hand if you plan not
to hack your car
so everybody's gonna hack their car okay
good that's what i wanted to see yeah
okay that's that's the important thing
like good as
like that uh i'll do a real quick intro
just so you guys know who who the car
i am uh my real name
is robert lee alley
um i you know i go again go by car
i didn't put my hand over that
um
i had cars since really since i i got my
first car in 96 so that ages me um a
little bit um i started my company can
bus hack in 2010 we specialize in
hacking cars i mean that's really what
we do it's based on the trade area
and so you'll see a lot of a lot of the
initial research on the internet was all
stuff that we did
and a lot of the stuff that people are
doing now is really based on that i did
i started the car hacking village in
2015 at def con
and we have done even smaller versions
of it as well so it's been a lot of fun
um yeah right here i'm gonna go right
into the obd2 connector the good old
days the obd2 connector
um for those of you aren't familiar it's
uh it's this connector it's kind of a
trapezoidal connector that is really in
the kick panel of every car 1996 and
newer vehicles are required by law to
have it
so you have an obd2 connector if you
have a car that's from 96 model year 96
or newer
so you'll see them there easy to find
in the in the beginning they had all the
networks every single network that was
on the vehicle which is usually a single
can bus or a something called j1850 used
to be on there or k line there's a bunch
of different networks they were all
there
it was like plug and hack right you just
plug in and start hacking super simple
that was an easy easy easy situation
there's nothing in our way right we
could just plug in and start retrieving
data immediately it was it was a
beautiful day right we could send any
data we wanted we could if we wanted to
like emulate a particular controller a
lot of a lot of the stuff that i do and
continue to do um on cars is really
we get a lot of requests from companies
who are trying to build um gps systems
tele telematics systems and they want to
they want to send the unlock commands
right we just want to unlock and lock
the door
because they'll they'll make their own
hardware module and they'll give the
user a key fob and they just want to
lock and lock the door right so super
simple you can
you can take your existing key fob
copy the data that was sent from like
that happened to be sent when the key
fob was pressed and just replay it you
can send anything and and then you can
do it right from the obd2 connector
really nice
beautiful simple way to do it you could
receive all of the data that means as
soon as you plugged in you're just
bombarded with lots of data
really cars from 2019 and older
still have this feature if it's not a
german vehicle unfortunately during
vehicles they they have had gateways for
a very long time
so it's really super easy to send and
receive data from that obd2 connector i
would say more than half of the vehicles
on the road today
or made
that are on the road today are um are
able to do that still so it's still very
possible so the good old days we had our
freedom
uh the freedom to attack the system so
that's been really nice
um initially research was really simple
you could plug into the vehicle get some
data from it it was super fun um
[Music]
pivoting you know at that time it was
hard but
data was easy to find so pivoting
meaning
like i can get on the obd2 connector uh
so if i'm inside the vehicle super easy
but if i'm outside of the vehicle there
weren't a lot of attack surfaces um that
was back before really telemetry really
had any connection to the vehicle's
networks
um and stuff like that so it was really
really challenging um so they didn't
really care if you had access to
everything because really one you had to
be inside the vehicle to do anything
anyways that was pretty common so but
the problem was you know hackers hackers
came along and they hacked all the cars
i mean i'm definitely partially to blame
one of the first times i met
a gentleman from general motors
like the head at the time they didn't
have a cyber security division uh for
their automotive side they had obviously
the network side but they didn't have it
on a motorcycle
i i met him this was probably 2013 and
he he and i had a conversation and he
saw my blog at the time i had canvas
hack was just a blog on how to
hack your own car
he saw he goes robert what you're doing
is very dangerous and i go don't you
call me robert
um but yeah so it's very dangerous i
know why i don't understand what what is
what we're doing dangerous you know you
provide a port that anybody can connect
to and send data on what's the problem
he goes well here's the thing that we do
and something i learned is like gave
away some really interesting information
we like if i send out a message that
like with like if you don't know about
can bus it has an arbitration id and
data bytes the arbitration id is the
identifier for the message
if you sent a particular arbitration id
the car would think that
a module which isn't normally there is
there all of a sudden because i sent
this idea maybe i said id111
and normally one one one isn't on the
bus but i sent one one now all of a
sudden the car thinks there's a
uh a hatch you know it's like it's not a
car anymore it thinks it's an suv
because this id is on the bus
and i was like oh that's dumb you guys
shouldn't do that
it really was that was more sort of like
you know here's this guy from you know
really a multi-billion dollar company
saying we do something stupid and i was
like yeah i know don't do that
and then like he
was immediately just frustrated with
that whole concept i was like but this
is how
it works this is a computer we're going
to hack it
i don't know what the rule is on that
what's the internet rule is this
computer we're going to hack it but um
that's what we we do and um so we we
decided like eventually he decided that
i was right and now he has 173 people
that work for him in their cyber
security group right so
so they they changed their mind
you know and i probably gave him like
three promotions and he probably has a
nice new house because you know i
decided that his idea was stupid
um and then they obd2 connector kind of
in their latest version
gm's latest version of vehicles that ob2
connector does not have the can bus on
it anymore right they got rid of it it
took them
12 years you know to get rid of it but
they eventually did right so you can see
that that's the direction hackers are
definitely
making helping the companies make really
big decisions um internally and costing
you know essentially
billions of dollars to the companies
right um
i'll give you another example i was on a
call with uh with all very large uh
another different oem and they were
talking about they wanted to change
their obd2 connector they wanted to move
some pins around
uh well we were recommending it and they
said uh they were like well if we do
that that means we have to
change the tooling
on our diagnostic connector tool the
scan tool that we use if we want to
change the tooling on that that's going
to be
that'll be you know a few million
dollars probably in development and cost
and then we gotta tell all of our
dealerships that they have to buy a new
one uh so that'll be another four
three to four billion dollars so we're
probably not gonna do that i'm like yeah
i guess that makes sense that's not so
easy so making these changes is a very
very big deal they tend not to do it
because it costs so much money
to a lot of people so that's the reason
why i took them so long but now that
it's there i think it's going to be it's
going to be there to say so
manufacturers said hey stop stop
connecting to that connector
they added new security features and
i'll talk about those in a second
and they added new technologies to
prevent um us hackers from connecting
directly at the ob2 connector so
again this is a cat mouse game as
everybody knows in this field me as
acker
i say okay how are we going to do that
so remember the automotive industry
industry is very slow so whatever we
come up with whatever i talk about today
anybody actually anybody here from the
automotive industry if you don't mind
okay
yeah i know um some other issues real
slow they have to be slow right they
just you can't they're behemoth they
cost billions of dollars to make a
change right one time i was talking with
another manufacturer and they're like
hey we need to
we are going to remove cruise control
from this vehicle so we can add
bluetooth they're trying to save so many
pennies they try to save pennies on
vehicles because everything costs so
much money when you multiply a penny
times a million dollars right
so
um
so there but they will respond right
they will eventually get there
their shareholders will require it right
the the
when um chrysler fca got hacked with the
g-pack if you're not familiar with it
pretty big news in the hacking community
2015.
when that happened their stock price
went down by like 10
right that's a significant movement
right especially if you're a stock
stockholder so you want to want to do
that and then regulation now they're
adding a lot of regulation to force them
to react
so what do they do how did they solve it
they added secure gateways that's right
secure you know what secure means right
is it secure sure yeah there's some
features that are secure so they added
these gateways to isolate the obd2
connector so that obd2 connector is no
longer just connected to the rest of the
vehicle
and they also took the telemetry device
that thing that's actually connected the
internet and they took the obd2
connector the telemetry connector and
they moved them to their own network
they called it the dirty side i think
that's the actual network terrarium the
dirty side and then they have the clean
side which is the rest of the network
thing then the rest of the vehicle
controllers are all on the clean side
and then you have the dirty side which
is and then what separates them is this
gateway
but the good news is it's easy to bypass
in fact
this cable that you see here is you can
bypass the secure gateway
um this is just for your own car right
it's your own car so you can just unplug
a connector
plug that connector back into this this
two prongs over here and then it makes
an ob2 connector out of it and you can
bypass the secure gateway quite easily
so you can still do all the things you
were able to do with the old obd2
connector but now you have to you have
to do some manual work you have to get
to the connector to find it maybe pull a
panel down and then reconnect but if you
want to do it on your own vehicle it's
not that hard so it's easy to bypass but
it's also hard to bypass right because
you can only do it for one vehicle not
for multiple ones and then it takes a
little bit of time to figure out where
the connector lives and maybe you don't
really want to do that to your wife's
car right so she might yell at you so
you know those are the kind of hard
things that you got to worry about so so
that's the other problem and the other
problem
that we have here is they're adding
non-can bus networks so one thing is um
this thing i don't know if you guys
heard of this thing called ethernet it's
this new technology and he likes that
joke
twice um so they added ethernet to cars
um i know you're surprised to hear that
they haven't had ethernet and cars
really
um ever so they're just starting to add
it which means that it's
it's hard to connect to ethernet right i
mean you have to plug in well it sounds
hard right well this isn't actually
ethernet this is automotive ethernet
which is impossible to actually tap i
know that's crazy to hear but it uses a
technology called three pam and five pam
which if you're not familiar with it uh
you know i'm not gonna it's a 30 minute
talk i don't have time to go into it but
it's it's it's essentially impossible to
just tap it and see what's happening
or read the data on the bus because you
have to be a transmitter in order to be
a receiver on this type of network so
that means it can only have two nodes
maximum on the network so
it's really hard it's really really
really hard as a an attacker to even
read the data let alone write data on
other internet well so only two nodes
are allowed on the network evil like an
evil attached third node is uh is
essentially you have to cut the wire
right now so that's the only way
automotive ethernet really works so it
becomes really challenging
you have to break it so you can simulate
or be a transmitter in order to be a
receiver it's really really challenging
and of course they can add
ip security encryption if they wanted to
so it and it's very costly so
automotive ethernet is becoming really
challenging in fact they're adding
switches though but the good news is
there are managed switches so we could
probably do port mirroring if you guys
are familiar with that on those switches
um are looks like they are supporting
some port mirroring concepts
and
for the most part there might not be any
security built in so that's really nice
so why do we want to connect to the
vehicles well we want to reverse
engineer data so we can replay it
we want to interact with vehicles via
diagnostics if you're not familiar with
diagnostics it's a way to send data to a
controller and get data back it's
essentially an api to talk to the
controllers if you want to do a little
bit more reverse engineering and
diagnostic stuff definitely come to the
caring village we could show you a
little bit about how that works as well
you can read data write data
control outputs you can turn the lights
on turn the lights off uh you know
unlock a controller re-flash the
controller using diagnostics
you can bypass the controller's features
you can read out secret keys i've done
all of this it's awesome you can combine
those attacks to do multiple like really
interesting attacks to bypass security
you can pivot through that do do control
do controller functions you can borrow
cars
we'll show the video later if you ever
need to see a video aspiring car adam's
got one for you we did it in one of my
classes so what are some of the
solutions to get around these
these kind of things um
we can just connect right so how do we
connect to a car right now like okay so
we have a gateway we have a secure
gateway we want to bypass we want to get
around it how do you do that
well you got to go behind it right you
can't go over it you can't go
you guys have kids everybody has kids
so you got to go around it right um we
gotta go around this gateway so we gotta
go behind it so
we could just find the gateway often the
gateway is right by the obd2 connector
they don't really run it very far
um you might have to do some lookups to
find out where gateways are
unfortunately but that's what you have
to do you can use wiring diagrams you
know imagine a situation where you're an
iphone hacker you're trying to figure
out how iphones wired you know the
microphone and the the accelerometer and
the bluetooth the main processor
wouldn't it be great if iphone just
released all of their schematics that'd
be awesome right everybody would like
that if you're an iphone hacker would
love it well the good news is we
actually do this in automotive we call
them wiring diagrams and by law they
have to give them to you because they
have this thing called right to repair i
know they should have it for iphone they
should have radio repair but we actually
have a regular repair and a pretty
strong one in automotive so that
requires them to give you their access
to all of their wiring diagrams and you
can access those through your local
library you can access them through
internet you know searches manufacturers
each manufacturer has a tech info
website that you can go and download it
right from their website you have to pay
a small fee for a couple of days access
it's usually between 20 and 50 dollars
but you can get access to any vehicle
that you want to
um
or you can just look underneath the pack
you know under you know underneath the
driver or passenger seat and see if you
can find some wires right what kind of
wires are you looking for well you're
likely to find something at a body
controller in the trunk there's a
connector
look behind the dash usually the dash
has some end caps there probably some
can buses or other wires there
so that's
another way to get around it um we can
also
we have some other types of ways to
connect or connections manufacturers
scan tools
might also be able to bypass the
security so for instance um the fca i
was talking about the fca which is
chrysler now
now they've changed their name to
something called stellantis because
they've added more
car companies to the group
so stellantis has a
little micropod this little like obd2
dongle that connects over wi-fi to the
car
and it's capable of bypassing all of the
secure features
if you've logged in
and had credentials so you can use that
tool
to
to just sort of assist you with the
bypassing of the security features
it could send can bus maybe over the
gateway as well
here's some attack scenarios maybe we
can connect to the secure gateway notice
that you are locked out
but you don't have a scan tool you can
you know phone a friend ask a friend to
maybe hey could you connect your scan
tool on your end and then you can use
like things uh like
a raspberry pi and then have them have a
raspberry pi there and we've done this
before two raspberry pi's and you can
connect them and tunnel the uh the data
over candy udp uh there's a there's an
application called candy dp or another
one cannelloni uh ways of connecting can
buses to each other virtually over udp
traffic just over the internet
and you can reliably have a scan tool
that's living you know somewhere else
do all the bypasses for you this is a
this is the thing that we do often as
well if we want to bypass some of these
features
also your local library will have wiring
diagrams it looks like these are a
little out of order so i'm going back to
the wiring diagrams
just go to your local library
garage repair
[Music]
you know it's very easy
to get access to a lot of these a lot of
these things from the local library you
just ask them for it
internet sites that are there there's
some good tech tech sites as well all
data or mitchell one are two good uh
resources if you're running taking notes
for um
for connecting or getting wiring
diagrams from these things as well the
manufacturers bmw mercedes gm vw
stolantis all of them will have some
sort of wiring diagram feature that you
can download these wiring as well
you can hunt and find as well so looking
in the driver kick is always where i
typically will find things what you're
really looking for um are the body
controller i already kind of have this
one but it looks like i had some out of
order slides i apologize um
[Music]
finding that taking a multimeter
voltmeter and just looking for 2.5 volts
on a wire so just tapping some wires
looking for 2.5 volts ethernet negative
1 to 1 volt
but look for twisted pairs right there's
really only three things in the car that
are twisted pairs there can buses
automotive ethernets or speakers so if
it's not a speaker it's probably a data
wire so twisted pairs are your friend
just check the voltages on them they're
two and a half volts you probably got
yourself a can bus
again check the trunk and caps things
like that
um i went a little fast but i wanted to
leave time for questions after words as
well so
a little bit of recap again car hacking
is getting more challenging i know you
guys are just getting used to it you're
like what you're telling me i have this
thing that i haven't done is harder now
well it's not it's just as easy as it
was before for you guys so you're fine
right um we're trying to make it easier
for you so you just got to stay on top
of it
check out our simulator at the car
hiking village little shameless plug not
that shameless um you know we built this
simulator
and one of the like sort of like my
general philosophy for getting into the
car hacking is just you know just start
right just find
um you know a car maybe it's your car i
know everybody's like like the number
one thing i hear is like i don't want to
break my car you won't
you just won't break your car guys it
doesn't work like that right like just
sending can frames to a car even if
you're like fuzzing it doesn't break
your car or when it does break your car
because i said it won't but it when it
does because robert you said it would
the one percent of the time that you
break your car take the battery off and
put the battery back on you just need a
10 millimeter socket and you'll be fired
the one time that that doesn't work
you know tell your dealership like i
don't know what what happened man this
is really weird this is so weird i have
no i mean this is a head scratcher what
is going on here it's literally one time
i've been hacking cars for the better
part of 20 years i've had one failure i
knew it was gonna happen when it did i
was like i was pretty sure i was gonna
make this thing not work anymore and
sure enough now i've been a part of
definitely definitely a bunch of groups
of students and things like that and
we've definitely hit cars pretty hard
and one other time a student did put a
car into the shop and it never returned
but we knew that could happen right it
was like one of those things we're
really trying to break the car and we
succeeded in the task if you're not
trying to break it you won't break it
it's just not going to happen um you
know what you could do like you can fuzz
a car to your heart's content now the
thing that i had happened to me when i
was buzzing a car
especially getting my early example of
when i had a jet like gm like i had at
the time a buick uh lacrosse phenomenal
car i recommend i made it think that it
it was it was a hard top it was it made
it think that it was like a convertible
right it's like they had a little
warning a convertible controller not
available and then add another one
then that one really weird situation
again we have right to repair we can
that means we can reflash controllers
and i just had to reflect the controller
myself now that wasn't an easy task but
when i reflashed the controller you know
what i found even more information from
the reflash because guess what happens
when you reflect your controller it
sends it over the canvas and then i
could capture that traffic and now i
have the firmware for that controllers
that i was reflashing so it's even
that's just a good idea to do like
that's the first thing you should do
when you get your car is reflexive right
it's totally legit like the thing you
can do and everybody has this ability to
re-flash the controllers in your car my
favorite reflash actually was i was
trying to reflash
not because it was broken i was trying
to reflash my
onstar module
plugged it in so i want to re-flash
outside module look to the list of
modules no onstar module they're like
i'm like i can't read this is the one
controller i want to get the firmware
for i want to re-flash it i'm like
there's got to be a way there's got to
be a way no there wasn't a way and then
uh
six months later i tried again no wasn't
there a few months later i tried again
it was there i'm like what just happened
why is there a reflash for this thing
that's never been a reflex forever so i
immediately reflash it capture the
traffic and then a month later it was
gone i'm like i just got lucky right
like they just they screwed up i don't
know what happened they saw that robert
logged in and
they said what what did you guys just do
and i got a chance to see the reflash
and i was glad i saw it because i
learned something really cool about the
onstar module
is the normal way reflash has happened
on vehicles there's a there's actually a
diagnostic service called
transfer data that everybody uses they
didn't use it for that one they used
something totally different a totally
backdoor way of reflashing the
controller and i also learned a lot of
reflashes in fact every reflash has some
sort of security exchange that happens
in the beginning this one didn't have a
normal security exchange in fact the
security exchange mechanism was like a
red herring it's fake they made a fake
security exchange
so that people thought they were doing
security and they really weren't they
had a totally side door and i only
learned that through reflashing the
controller right so and now i know how
to unlock
onstar modules
everywhere and then guess what onstar
modules can do they can make phone calls
and so i learned how to reprogram the
phone number
that the onstar module calls so that i i
didn't have to pay so like call somebody
anymore i just hit the button and it
just called that person if i wanted to
redial something else i just reflashed
that particular parameter and you got to
dial somebody else and so i just like
every time so just call that person
every time so you know there's a lot of
like really stupid things obviously that
was a really stupid one that you can do
on your car
um finding secret keys finding ways to
start the car like right now i have a
tesla
and a great car highly recommend it
totally possible to like
make that car start from a cam message
and drive away from a single bit of a
cane message just like flip this one bit
set it high
drive it away
you know those are the kind of fun
things that you can do
all you have to do is just like read the
cam messages and then send some other
ones and you can do some really
interesting things you can get they get
more complicated as well but anyways uh
it's four minutes to the end so i want
to take some questions
or two yeah
so um so my wife's got a 20 20 car okay
got an lte modem in it that neither of
us wants okay yeah we've done any
research into
what type of telemetry is being gathered
by automotive manufacturers not only
i've done research i actually had a good
conversation well before they changed
their terms of service with somebody
from a manufacturer who showed renamed
names just because i didn't want to get
them in trouble but they said that they
were capturing essentially a lot here's
what they really do they captured drive
data
because they want to know
how people drive because people are
stupid i mean this really is true like
they gave me a really good example they
go we got this one woman they just
assumed it was i don't know why i think
this one they really stood
got this one woman she just hits the gas
and then takes it off like she's like a
digital driver she says no analog she's
got either it's full pressed or it's off
it's full press starts off i'm like oh
my god i drove i had a uber driver that
did that and i got so sick like it just
makes you ill like he just did like rev
um but yeah so there's just people drive
all different ways so they're usually
doing it and
to the extent that it's possible they
you know anonymize it you know like
everybody else and ionizes you know you
can clearly gather where you're driving
to and where you're driving from
so how anonymous is that but they're
capturing every every bit of information
that they can and it's even getting even
crazier the cool thing is you can opt
out
by just uh uh not subscribing to the
services that they offer
um that means you don't get the offers
to the services and do they actually
follow through
the short answer is yes and i'm going to
tell you why because i had a lawyer
contact me
saying hey can you prove that they're
not that they're can you tell me i want
to sue them right and we did we did all
the work so i can say
yes that we actually monitored the uh
the modem itself and how much of
emissions it put off and it shut off it
did not transmit a thing for a month
they had no it was not even it wasn't
even trying to connect unless you hit
the button of course it was it was in
this full sleep mode it wasn't even like
broadcasting an mz or anything like that
so they did a really good job that
particular manufacturer i'm not saying
that for everybody but i bet you they do
because it's easy to test right it's
super easy and heck i recommend you test
it because if you find out that they're
buying in terms of service give me a
call
the fiber the most yeah like so there's
a fiber network called most that existed
in cars i actually had one for a little
bit
most is toast it's dead network it's not
going to exist much longer
the only way to do it unfortunately is
obviously you have to you have to remove
a module to put something in there and
you have to get a controller or a as
tool and i think there's only one
company that made that and they went out
of business because most is toast
um
so
i and i don't so i don't know what tool
they use
but it's a really cool network i would
love to see somebody actually trying to
hack it because i never actually even
tried because it was so hard to even
connect to so i have zero
recommendations unfortunately
yeah that's it okay we're good thank you
everybody
okay
[Music]
you