[00:01.470 --> 00:02.730]  Hold on just a second.
[00:03.230 --> 00:04.110]  My timer up.
[00:05.170 --> 00:05.750]  Okay, good.
[00:06.330 --> 00:14.610]  So what we're going to do with this talk is I'm going to give some slides so you're going to kind of see what we're working on with different types of tools, how people traditionally hack cars.
[00:14.890 --> 00:18.270]  It's not going to be a full-blown intro to car hacking.
[00:18.630 --> 00:30.750]  We're going to skip certain smaller, lower-end things I think there's plenty of information on because I really want to get to the point in the second part of the talk, which is an Ask Me Anything style area.
[00:30.770 --> 00:38.590]  So anything, if you think of questions when they're coming up or if you have questions that I'm not going to cover, maybe ones of questionable natures, go ahead and ask those.
[00:38.650 --> 00:39.230]  I like those.
[00:39.310 --> 00:39.930]  Those are good.
[00:40.490 --> 00:41.550]  So that's the goal.
[00:41.650 --> 00:45.470]  We're going to go through slides and then we're going to be whatever happens after that will be fun.
[00:46.010 --> 00:46.450]  All right.
[00:46.530 --> 00:50.250]  So a little bit of background, assuming I can get my slides to work.
[00:51.310 --> 00:52.990]  They are only working on one thing.
[00:54.030 --> 00:54.370]  Nope.
[00:54.450 --> 00:54.810]  There you go.
[00:54.930 --> 00:55.330]  There we go.
[00:55.730 --> 00:56.470]  I use both.
[00:56.670 --> 00:56.890]  Okay.
[00:57.050 --> 00:58.690]  So I'm Greg Smith.
[00:58.750 --> 00:59.990]  I wrote the Car Hacker's Handbook.
[01:00.050 --> 01:09.130]  I'm also the founder founder of Open Garages, which is a collective of performance tuners, mechanics, car hackers, artists from Burning Man, you name it.
[01:09.190 --> 01:16.070]  Anybody who wants to tinker with cars, that's kind of the group to kind of go and collaborate for information on how the internals of your car works.
[01:17.170 --> 01:19.690]  And I'm also part of I Am The Cavalry, which I'll talk about later.
[01:20.070 --> 01:22.990]  And I want to introduce Eric to kind of talk a little bit about his background.
[01:23.370 --> 01:24.150]  Do you want to use this mic?
[01:24.430 --> 01:24.630]  Sure.
[01:24.630 --> 01:25.090]  Eric.
[01:26.090 --> 01:27.090]  So yeah, my name's Eric.
[01:27.430 --> 01:32.130]  I created this open source tool for doing some automotive work called CANtact.
[01:32.350 --> 01:38.170]  My background, I formerly worked at Faraday Future and Tesla Motors to kind of EV companies.
[01:38.650 --> 01:42.090]  And I also built some strange like fuel cell and hybrid cars.
[01:42.190 --> 01:47.490]  I was in a research group at the University of Waterloo, which is kind of how I learned how to mash different car parts into one car.
[01:48.050 --> 01:49.810]  So yeah, that's how I got into it.
[01:51.970 --> 01:52.670]  All right.
[01:56.830 --> 01:57.630]  How are you working?
[01:57.970 --> 01:58.230]  All right.
[01:58.350 --> 02:08.290]  So we're going to go over some quick basics, just to kind of give you a really quick intro to car hacking in general, because the tools we're going to release depend on some knowledge of that.
[02:08.790 --> 02:11.070]  But again, we're not going to spend a ton of time on it.
[02:11.150 --> 02:14.830]  There's plenty of resources online to figure out how the intros work as well.
[02:17.050 --> 02:20.370]  So the main thing is, how do you get access to what we call the CAN bus?
[02:20.610 --> 02:22.290]  The CAN bus is an internal network.
[02:22.750 --> 02:24.830]  There's a bunch of modules inside of a vehicle.
[02:25.050 --> 02:31.690]  You have your ECU and body control module, and even just smaller independent embedded systems all communicate to each other.
[02:31.870 --> 02:34.930]  And they do it on basically a trusted network or a bus.
[02:35.270 --> 02:37.710]  And a bus is like a hub.
[02:37.870 --> 02:39.210]  So everybody sees everybody else's packets.
[02:39.510 --> 02:42.250]  It's a soft, squishy center for the car.
[02:42.250 --> 02:46.010]  So once you kind of get to the CAN bus, it's for the most part, it's game over.
[02:46.190 --> 02:48.110]  Anything attached to the CAN bus is kind of trusted.
[02:48.870 --> 02:53.170]  So a lot of times when you're looking at security researchers' work, that's kind of the end goal.
[02:53.730 --> 02:54.830]  It's kind of like getting root.
[02:55.210 --> 02:57.830]  So when you get to the CAN bus, you usually kind of went.
[03:00.450 --> 03:08.170]  To get to the CAN bus through normal means, you're going to use like the OBD connector, or oftentimes referred to as a DLC data link connector.
[03:08.530 --> 03:10.730]  These connectors are underneath your steering column.
[03:10.850 --> 03:16.210]  So they're usually in the lower left-hand side or lower right-hand side, or sometimes they're in the middle.
[03:16.750 --> 03:18.770]  On occasion, they're covered by an access panel.
[03:18.990 --> 03:20.890]  You can usually just push on it and pull it down.
[03:21.650 --> 03:23.550]  They look like the thing on the right there.
[03:24.010 --> 03:25.350]  It's a standard connector.
[03:25.690 --> 03:27.810]  The CAN wires are standard.
[03:27.830 --> 03:29.710]  There's two wires.
[03:29.850 --> 03:31.090]  There can be CAN high and CAN low.
[03:31.730 --> 03:36.610]  There could be other CAN buses on the vehicle that most usually are.
[03:36.870 --> 03:38.490]  Some are exposed, some are not.
[03:39.230 --> 03:42.590]  But the normal ones will be there for sure.
[03:44.110 --> 03:49.370]  The other interesting way of getting into CAN is to use a T-TAP connector.
[03:49.630 --> 03:51.610]  This is like a type of wire splicing.
[03:53.050 --> 03:55.710]  The OBD is great in the fact that you don't leave any marks.
[03:55.870 --> 03:57.090]  You can just plug right into the car.
[03:57.090 --> 03:58.790]  You can do a lot of things from that.
[03:59.590 --> 04:04.330]  But sometimes you can get way better information if you just go past that.
[04:04.850 --> 04:12.210]  I've seen several vehicles where, you know, they may use the main CAN bus and they have a bunch of communication that goes on to start the vehicle.
[04:12.450 --> 04:13.730]  You know, checking the security and whatnot.
[04:14.030 --> 04:19.790]  And then there's another CAN bus that goes between maybe the body control module and the ECU that isn't exposed.
[04:19.790 --> 04:22.250]  And it just sends a single bit that says, yeah, everything's good.
[04:22.350 --> 04:22.770]  Start the car.
[04:23.770 --> 04:28.590]  So, if you tap into that one, you can just play that bit and the car starts and you can ignore the rest of the stuff.
[04:29.290 --> 04:30.350]  So, always look at that.
[04:30.450 --> 04:31.330]  Look at wiring diagrams.
[04:31.470 --> 04:31.870]  Look for these.
[04:32.030 --> 04:32.670]  Tap into those.
[04:33.190 --> 04:34.370]  They don't leave a big mark.
[04:36.310 --> 04:38.390]  But not saying you shouldn't do it on another person's car.
[04:38.630 --> 04:39.810]  Just, you know, it doesn't leave a big mark.
[04:42.030 --> 04:45.150]  The other area that you hear a lot of is the infotainment center.
[04:45.270 --> 04:47.890]  And so, this is referred to as the IVI.
[04:49.030 --> 04:50.290]  It has a couple other names, too.
[04:50.750 --> 04:52.270]  But it's basically your navigation system.
[04:52.750 --> 04:55.370]  And that's mainly because it has a huge attack surface.
[04:55.370 --> 05:01.470]  You're going to have something that's going to be the closest to what resembles a computer that you're used to hacking.
[05:02.030 --> 05:04.410]  Because it's going to have, like, a full-blown OS for the most part.
[05:05.330 --> 05:06.950]  They're an embedded style of it.
[05:07.010 --> 05:10.230]  But it's usually, like, Linux or UNIX or embedded Windows.
[05:11.770 --> 05:19.870]  But the attacks on that are very similar to any kind of attack you would do on just, like, an embedded router would be a good example.
[05:20.990 --> 05:26.870]  And honestly, from a hacker perspective, if you're a malicious bad guy, you're probably actually going to stop there.
[05:27.490 --> 05:31.450]  Because the IVI also has all the information on it that you probably want.
[05:31.710 --> 05:33.490]  That's going to have the GPS information.
[05:33.710 --> 05:34.830]  It's going to have the person's contacts.
[05:35.450 --> 05:39.830]  You'll be able to turn on, like, say, the Bluetooth to listen in on the communication side of the car.
[05:40.210 --> 05:41.530]  That's all in that same system.
[05:41.690 --> 05:45.070]  So usually, once you pop that, realistically, you're probably done.
[05:45.070 --> 05:50.930]  But if you're doing, like, a pen test for somebody, again, the root demo is to then jump from that to the CAN bus.
[05:51.710 --> 05:52.770]  So just a little bit of background.
[05:52.870 --> 05:55.070]  The real bad guys probably don't care to steer your car.
[05:56.350 --> 05:57.710]  They'll probably just want that piece.
[05:57.910 --> 05:58.750]  But it's something to know.
[06:01.070 --> 06:03.710]  The other way of attacking is through wireless.
[06:04.670 --> 06:07.150]  So, you know, you have a lot of wireless signals that come from the vehicle.
[06:07.150 --> 06:13.310]  Some of the ones that, you know, from the IVI that you would know, which is, like, you know, wireless access points, Bluetooth.
[06:13.770 --> 06:17.150]  So if you have an old Bluetooth stack, that's an area that you can attack.
[06:18.330 --> 06:20.170]  Also, there's tire pressure sensors.
[06:20.630 --> 06:22.610]  There's vehicle-to-vehicle communication.
[06:22.970 --> 06:24.130]  There's other things like that.
[06:24.270 --> 06:28.410]  In those cases, you're going to use an SDR for those, to go after those.
[06:28.410 --> 06:30.170]  Unless it's, you know, wireless or Bluetooth.
[06:30.270 --> 06:31.610]  You can use your standard tools for that.
[06:31.610 --> 06:37.590]  But if you're going to use a, you know, proprietary protocol like TPMS, an SDR like HackRF would be the way to go there.
[06:40.290 --> 06:41.670]  So, I get the question a lot.
[06:41.750 --> 06:42.630]  Should I hack my own car?
[06:43.210 --> 06:43.570]  Yes.
[06:43.810 --> 06:44.910]  You should totally hack your own car.
[06:45.870 --> 06:46.630]  And two reasons.
[06:46.770 --> 06:54.870]  One of them is because if you're doing this for a living, they're going to bring you in to work on prototype vehicles nine times out of ten.
[06:55.490 --> 07:00.010]  Because they want, they don't really want to know what kind of problems are on cars on the road now.
[07:00.410 --> 07:01.770]  Because it's expensive to fix.
[07:02.170 --> 07:03.550]  They kind of want to know the next model.
[07:03.710 --> 07:05.130]  Like, okay, how can we fix this in the future?
[07:05.950 --> 07:07.410]  Which, you know, it's great and all for them.
[07:07.450 --> 07:12.710]  But it doesn't give you a good sample as to how secure the cars are on the road today.
[07:13.090 --> 07:15.870]  And so it really requires, like, individual researchers to look at that.
[07:16.050 --> 07:17.010]  Because nobody's going to pay for that.
[07:17.510 --> 07:20.010]  So looking at your own car, I mean, it's a lot of cars to cover.
[07:20.130 --> 07:21.570]  And I obviously can't do them all.
[07:22.110 --> 07:25.090]  So, you know, we need you to do those cars.
[07:25.890 --> 07:27.570]  You could do a rental car.
[07:28.410 --> 07:32.270]  I'm not officially recommending something like that.
[07:32.270 --> 07:34.730]  It's maybe immoral, but...
[07:35.270 --> 07:35.950]  You've never done that.
[07:36.490 --> 07:39.750]  No, nor have it been in organizations who brought in rental cars to do that.
[07:42.210 --> 07:45.170]  But, yeah, that is potentially an option as well.
[07:45.390 --> 07:48.050]  Pay the extra $8 is what I would recommend for insurance.
[07:51.010 --> 07:51.690]  Yeah, you could.
[07:51.910 --> 07:54.830]  What I really recommend doing is building a test bench.
[07:55.110 --> 07:58.590]  And the way to do that is usually for under $100 bucks, you can go to what's called a pick-and-pull.
[07:58.810 --> 08:00.850]  It's basically a junkyard where you can go pull the parts yourself.
[08:01.310 --> 08:03.150]  It's very therapeutic to smash up a car anyway.
[08:04.070 --> 08:05.830]  And you just pull these, like, components here.
[08:05.930 --> 08:07.470]  There's, like, an instrument cluster on the top.
[08:07.870 --> 08:11.050]  The left-hand side is, like, your mobilizer where your key goes.
[08:11.730 --> 08:13.190]  And then on the right-hand side is your ECU.
[08:13.290 --> 08:14.410]  That's usually underneath the glove box.
[08:14.990 --> 08:17.690]  One picture that's not in here is the body control module.
[08:18.090 --> 08:19.410]  You might want that as well.
[08:20.270 --> 08:24.130]  And these usually run about 100 because people normally only buy the ECU.
[08:24.390 --> 08:27.410]  And nobody usually buys the keys and the instrument cluster.
[08:27.490 --> 08:28.110]  It's a weird thing.
[08:28.190 --> 08:30.270]  So when you go up there, like, hey, I want these.
[08:30.530 --> 08:31.890]  They have no idea what to charge you.
[08:31.890 --> 08:33.930]  You're like, I usually buy these for, like, $2.
[08:34.550 --> 08:36.010]  And it's fine.
[08:36.090 --> 08:37.330]  Like, oh, that seems legit.
[08:37.430 --> 08:38.370]  You know, because it's, like, plastic.
[08:38.590 --> 08:39.970]  And so it doesn't cost you anything.
[08:40.050 --> 08:40.630]  And they're pretty cheap.
[08:42.170 --> 08:43.990]  And when you put them all together, it kind of looks like this.
[08:44.110 --> 08:45.290]  I mean, this looks really, really cool.
[08:45.430 --> 08:46.650]  But it's really just a few wires.
[08:47.670 --> 08:50.930]  All we're really connecting here is your power, ground, and canvas.
[08:52.950 --> 08:54.050]  There's a little bit more going on.
[08:54.130 --> 08:55.550]  But this is the same parts you saw before.
[08:56.050 --> 08:58.190]  And so you'll get a wiring diagram.
[08:58.770 --> 08:59.870]  And you can get those online.
[08:59.870 --> 09:04.290]  And then once you have one, you're just going to look for those areas.
[09:04.590 --> 09:06.630]  And so you just want power to it, and you want your canvas to it.
[09:06.890 --> 09:10.250]  I've attached two potentiometers on the lower left-hand side.
[09:10.790 --> 09:16.430]  What those are doing in this particular picture is they're going to the ECU to simulate certain sensors.
[09:16.870 --> 09:20.570]  In this case, it was a temperature sensor and the fuel gauge.
[09:21.130 --> 09:24.490]  And both of those sensors report basically a resistance value.
[09:24.750 --> 09:27.130]  So, you know, a little pot in the bottom works really well.
[09:27.850 --> 09:29.010]  So you just change the dial.
[09:29.270 --> 09:32.870]  That tells the ECU I have more gas or less gas or I'm overheating or not.
[09:33.150 --> 09:36.670]  And then it sends canned packets to the instrument cluster, which updates.
[09:36.970 --> 09:38.510]  And so this gives you a really good sample.
[09:38.750 --> 09:42.150]  So you can immediately get feedback on things that would be kind of hard to get normally.
[09:42.310 --> 09:48.630]  Like if you want to look into your real car and say, like, okay, well, I'm looking for a packet that shows approximately 50% of gas.
[09:48.630 --> 09:50.230]  That's kind of hard to dig out.
[09:50.490 --> 09:52.530]  But in this situation, you can just change it.
[09:52.670 --> 09:58.490]  And you can actively see which packets are changing the way you change that dial and identify things like fuel gauges right away.
[09:59.230 --> 10:05.130]  And again, these are relatively cheap, take a little bit of time to wire, but very good method, very safe method to analyze vehicles.
[10:07.550 --> 10:09.430]  Speaking of canned packets, this is what they look like.
[10:09.690 --> 10:10.770]  There's not much to them.
[10:11.510 --> 10:13.810]  This is the way I like to show them.
[10:14.010 --> 10:19.150]  The first interface is kind of specific to Linux, but the ID is kind of key.
[10:19.330 --> 10:20.030]  So you have this ID.
[10:20.230 --> 10:21.290]  It's not a source or destination.
[10:21.870 --> 10:24.350]  It's just a kind of like a category ID.
[10:24.590 --> 10:29.070]  And the lower the number, the higher priority it has on the bus, which is kind of important.
[10:31.470 --> 10:35.430]  The idea is if you have two packets talking at the same time, the lower one wins.
[10:35.590 --> 10:40.170]  So if you're looking for, say, engine-specific stuff, that's going to have a pretty low number.
[10:40.510 --> 10:46.250]  Whereas if you're looking for things like maybe the internal cabin temperature of your vehicle, that's going to have a higher number.
[10:46.810 --> 10:49.430]  And so that's something to keep in mind.
[10:49.850 --> 10:52.730]  And also the DLC is just the length of the packet.
[10:52.830 --> 10:54.670]  It can be up to eight bytes, period.
[10:55.150 --> 10:56.570]  So that's as big as the git.
[10:56.570 --> 11:05.610]  And so what happens when you as an engineer, when you work for an auto company, you basically take this system and you decide, okay, well, ID is going to represent a category.
[11:05.850 --> 11:10.570]  Like I'm going to pick ID 1, 2, 3, 4 to represent door-related things.
[11:10.950 --> 11:13.790]  Door unlock, maybe the dome lights, things like that.
[11:13.910 --> 11:15.790]  And you're going to break up those bytes into bits.
[11:16.030 --> 11:19.510]  So you're going to... a whole byte probably will not be for a door unlocking.
[11:19.790 --> 11:22.250]  You're going to use individual bits to do these things.
[11:22.690 --> 11:27.190]  And then if you have all these modules doing all these things, it's hard to keep track of.
[11:27.610 --> 11:30.270]  And so in those cases, you're going to have a definition file.
[11:30.630 --> 11:34.890]  It's basically just a large text file that kind of says which bit does what in the vehicle.
[11:35.130 --> 11:36.390]  And that stuff's not published.
[11:36.830 --> 11:38.490]  And we're going to talk about that in a little bit.
[11:38.590 --> 11:42.510]  But I want to bring it out as to why that's why we have a system like that.
[11:44.470 --> 11:47.830]  To see these can packets, you want a can sniffer.
[11:47.830 --> 11:50.590]  You can get away with spending like less than a hundred bucks on a can sniffer.
[11:51.770 --> 11:53.610]  On the left-hand side, there we have USB to can.
[11:54.030 --> 11:54.830]  That's proprietary.
[11:55.090 --> 11:56.110]  You can see the circuit board.
[11:56.490 --> 12:01.050]  Pretty decent, generic kind of one single can option.
[12:01.210 --> 12:01.830]  Works on Linux.
[12:02.310 --> 12:03.590]  The second one, the Carberry.
[12:03.850 --> 12:04.750]  And I just picked out a few.
[12:04.870 --> 12:05.670]  There's a lot more in these.
[12:05.930 --> 12:09.130]  The Carberry has two can buses that can do simultaneously.
[12:09.610 --> 12:15.650]  The key thing about this one, it's one of the few cheap commercial devices that can do single wire can.
[12:15.650 --> 12:21.490]  Like GM LAN, so if anybody's messing with OnStar or something, that's where you're going to want to go.
[12:21.610 --> 12:22.470]  It's the cheapest route to do that.
[12:22.830 --> 12:24.470]  And it has a decent system for it.
[12:24.690 --> 12:26.310]  And then there's like things for Arduinos.
[12:26.430 --> 12:29.570]  If you like Arduinos, there's shields for them so you can like programmatically do stuff.
[12:30.050 --> 12:33.110]  And then you have things like the Canvas triple, which is a fully open source board.
[12:33.410 --> 12:34.830]  I haven't personally used it.
[12:34.990 --> 12:39.450]  But Eric has a device I think he would like to talk about that is open source.
[12:39.610 --> 12:41.490]  And I would say maybe a little better.
[12:42.230 --> 12:43.630]  But a little bias.
[12:43.830 --> 12:43.890]  Here.
[12:44.550 --> 12:46.310]  Eric, why don't you come over here and talk about yours.
[12:48.790 --> 12:49.310]  Thanks, Craig.
[12:49.490 --> 12:57.690]  So yeah, I kind of got frustrated because a lot of the devices out there, there were some others like the Goodthopter, which is based on the Goodfet, a few other things.
[12:57.970 --> 12:59.870]  But you couldn't really buy any of them.
[12:59.990 --> 13:03.470]  It was like you could get a PCB and then you could solder it up yourself.
[13:03.970 --> 13:10.210]  And a lot of the components that can do this stuff are service mount, which you can do by hand, but most people don't want to.
[13:10.450 --> 13:11.810]  So I was like, okay, let's make something.
[13:12.510 --> 13:14.110]  And I made this thing, the CANtact.
[13:14.290 --> 13:17.010]  It's a CANBust USB tool, really simply.
[13:17.310 --> 13:22.510]  It's based on the STM32F0, which is an ARM Cortex M0.
[13:22.950 --> 13:27.870]  And what was awesome is this thing, this microcontroller came out like right when I made this.
[13:27.870 --> 13:45.150]  And I looked at it and I'm like, ah, it's got one USB and one CAN, which is actually really rare in a smaller microcontroller because most of the micros that have CAN and USB are meant for things like in-vehicle entertainment or infotainment systems, high-end applications.
[13:45.790 --> 13:48.310]  So that came out and I went, ah, that's a good solution.
[13:48.550 --> 13:50.330]  And it's also really open source.
[13:50.570 --> 13:57.730]  Like, you can go online and go on GitHub, get the KiCad files, which is an open source EDA tool.
[13:57.970 --> 14:02.990]  You can modify them or you can generate the Gerbers and have it made by Oshpark and solder it up yourself.
[14:03.410 --> 14:04.470]  The firmware is all there.
[14:04.570 --> 14:05.590]  You can do whatever you want with that.
[14:05.750 --> 14:07.330]  The tool chain is open source.
[14:07.330 --> 14:08.290]  It's just GCC.
[14:08.550 --> 14:09.790]  You type make, it builds.
[14:10.550 --> 14:16.670]  So, yeah, you can go online and get all that stuff and at least look at it and see how it all goes together.
[14:17.610 --> 14:22.810]  And Craig's gonna bring us back to the software because once you have a piece of hardware, you also need something to talk to it.
[14:26.090 --> 14:29.310]  Yeah, so I want to highlight one of the things that his can do is the Socket CAN.
[14:29.510 --> 14:34.850]  And Socket CAN is specific to Linux, but it's supported from Linux 2.6.25 and on.
[14:35.110 --> 14:39.450]  So for several years, it's just natively supported CAN, which makes it very, very, very nice.
[14:39.750 --> 14:43.750]  And it links CAN packets to Netlink, which is basically your network interface.
[14:44.130 --> 14:47.050]  And so you can do things like Wireshark and stuff to sniff CAN if you want.
[14:48.010 --> 14:49.870]  I don't recommend using Wireshark.
[14:49.990 --> 14:52.330]  And if you start doing it, you'll immediately realize why.
[14:53.350 --> 14:55.790]  But what I recommend doing is grabbing CAN utils.
[14:57.310 --> 15:00.330]  Most distros, at least newer distros, you can just do an app get or whatever.
[15:00.590 --> 15:02.270]  It's in the repositories.
[15:02.570 --> 15:03.690]  Else you can get them off of GitHub.
[15:04.070 --> 15:08.510]  And it's just a slew of like, I don't know, I think maybe 20 or so utilities.
[15:08.510 --> 15:11.430]  Some key ones being CAN dump, which is like TCP dump.
[15:11.750 --> 15:17.990]  CAN sniffer, which is really the way you're probably going to want to analyze your CAN traffic, because of the way it formats things.
[15:18.670 --> 15:19.970]  CAN send for transmitting.
[15:20.190 --> 15:22.550]  There's CAN gateways for basically a built-in fuzzer.
[15:23.390 --> 15:25.150]  And all these things just come out of the box.
[15:25.230 --> 15:29.370]  And so you can use bash scripting or whatever you want to kind of tie these together to do really quick testing.
[15:29.990 --> 15:30.670]  And it's nice.
[15:30.670 --> 15:34.110]  So just work with CAN, or Linux, just as long as you have a Linux, even in a VM.
[15:35.550 --> 15:38.370]  Some of the things you can do with that, I have some training software.
[15:38.630 --> 15:42.710]  So if you don't want to work on a car, you can work on something like this.
[15:42.830 --> 15:44.770]  So this is on GitHub under Zombie Craig.
[15:45.370 --> 15:47.510]  This one's called SDK Code because it's Super Text Cart.
[15:47.510 --> 15:50.150]  This is an open-source Mario Kart clone.
[15:50.570 --> 15:54.930]  I've modified it so as you drive your little Mario Kart around, it generates CAN packets.
[15:57.590 --> 16:04.790]  And so this guy, he was used for HH3, the Hungry Hungry Hackers CTF Challenge.
[16:05.170 --> 16:08.090]  And they had to reverse engineer by driving...
[16:08.090 --> 16:18.030]  One person would take a game controller and drive it around, and the other person would watch the CAN traffic to figure out how to accelerate, how to go left, right, how to shoot your little cupcakes at people, and all that good stuff, and turbo.
[16:18.550 --> 16:20.230]  And so they had all these events there.
[16:20.690 --> 16:21.370]  It's fun.
[16:21.510 --> 16:22.610]  It's an easy one then.
[16:22.750 --> 16:23.550]  Kind of a fun one to try.
[16:23.810 --> 16:25.710]  It's very, very simple.
[16:25.870 --> 16:28.590]  But if you're just starting on CAN, you can start here.
[16:28.710 --> 16:31.870]  If you want something a little more realistic, I recommend IC Sim.
[16:33.210 --> 16:34.790]  So IC Sim is also free.
[16:35.010 --> 16:36.630]  Same repository under Zombie Craig.
[16:36.910 --> 16:38.810]  And this is for Instrument Cluster Simulator.
[16:39.030 --> 16:45.710]  And so what this one does, also using a game controller because I like games, it has the same kind of controls as Grand Theft Auto.
[16:45.710 --> 16:47.170]  So it should be familiar to a lot of you.
[16:48.090 --> 16:51.330]  And then there is like a speed speedometer on top.
[16:51.490 --> 16:53.290]  It does left, right, and it does door unlocks.
[16:54.730 --> 16:56.150]  And you can't really see it too well.
[16:56.170 --> 16:58.250]  But on the left-hand side is a bunch of CAN traffic.
[16:58.730 --> 17:01.850]  Because this also simulates a real car's output.
[17:02.190 --> 17:10.610]  And so you have to find these signals and reverse engineer like how to control speed, door unlocks, and whatnot through like a bunch of traffic.
[17:10.610 --> 17:11.630]  Not just...
[17:11.630 --> 17:12.430]  And then super text cards.
[17:12.670 --> 17:14.330]  The only traffic you're seeing are the ones you're doing.
[17:14.770 --> 17:16.650]  Here there's a lot of extra noise to sort through.
[17:17.370 --> 17:20.630]  IC Sim can also change difficulty levels and can randomize every time.
[17:20.870 --> 17:22.170]  So you get different game plays.
[17:23.990 --> 17:25.650]  Also some challenges up on GitHub too.
[17:25.830 --> 17:27.570]  Like there is a speed limiter.
[17:27.710 --> 17:29.510]  I think you can only go 120 miles per hour by default.
[17:29.670 --> 17:31.310]  And so some of the challenges are making it go faster.
[17:32.070 --> 17:32.850]  Things of that nature.
[17:33.010 --> 17:35.170]  So there's certain challenges you could normally do with the game controller.
[17:35.170 --> 17:39.870]  But once you figure out how to reverse engineer it, you can send those packets and you can see the output.
[17:40.110 --> 17:42.930]  And this is exactly the way it would work on a real car.
[17:43.430 --> 17:44.910]  So it's a really good training for that.
[17:45.610 --> 17:49.470]  The issue with these two pieces of software is that they only run on Linux.
[17:49.930 --> 17:51.310]  I mean, if you use Socket CAN, which is great.
[17:51.550 --> 17:53.450]  But sometimes it's just not an option.
[17:53.710 --> 17:57.490]  And so Eric here is working on a way of solving some of that.
[18:00.500 --> 18:04.220]  So yeah, the great thing with Socket CAN is like you get a network device.
[18:04.220 --> 18:07.220]  It's literally like ifconfig can zero up.
[18:07.540 --> 18:08.700]  And it brings a device up.
[18:08.780 --> 18:09.560]  It's super familiar.
[18:10.580 --> 18:13.420]  But it's only on Linux and even OSX.
[18:14.020 --> 18:15.460]  No luck in Windows.
[18:15.840 --> 18:16.560]  Yeah, not at all.
[18:16.840 --> 18:28.500]  And this became kind of a problem because a lot of the folks who aren't so much in the InfoSec maybe or not in the hacking world but are in the automotive world, they don't use Linux that much.
[18:29.220 --> 18:30.380]  A lot of them are on Windows.
[18:30.380 --> 18:34.420]  And so we needed something that was going to be cross-platform.
[18:34.760 --> 18:40.400]  And so with CANtact, I came up with this CANtact app, which maybe should have a better name.
[18:40.560 --> 18:40.880]  But eh.
[18:41.680 --> 18:43.380]  And it's a Java application.
[18:43.640 --> 18:50.420]  It works with CANtact and anything else that supports the slcan format for sending can over USB.
[18:50.920 --> 18:52.960]  And it does a bunch of stuff.
[18:53.360 --> 18:57.300]  It traces basically all the frames coming off the bus.
[18:57.300 --> 18:59.800]  So it'll show you like everything that's coming in.
[18:59.960 --> 19:06.080]  It also has this live mode, which is similar to what Craig was showing, where you only see things that are changing.
[19:06.080 --> 19:11.980]  And this is like elementary reverse engineering and how you do a lot of automotive reverse engineering.
[19:12.200 --> 19:19.020]  Is you just watch the bus and then you change something like move the steering wheel or like hit the brakes, gas, whatever it is.
[19:19.020 --> 19:23.520]  And then you see what changed in about the same amount and at the same time that you did that.
[19:23.740 --> 19:26.880]  And then you correlate that back to actually a real value.
[19:27.100 --> 19:34.840]  So often you'll end up with, oh, this thing's going from 0000 to FFFF whenever I hit the gas pedal.
[19:35.100 --> 19:37.360]  And oh, when I have it at 50%, it's this value.
[19:37.400 --> 19:40.500]  And you can end up, you know, figuring out exactly how that's encoded.
[19:40.500 --> 19:46.140]  And you just basically do that a lot for a lot of different inputs and you can really map out how the bus works.
[19:47.560 --> 19:49.500]  It can also transmit single frames.
[19:49.640 --> 19:53.300]  So if you just want to mash frames onto your CAN bus, it'll do that.
[19:53.880 --> 19:58.920]  And it will support some diagnostic protocols, which we haven't talked about too much.
[19:59.140 --> 20:04.440]  But your car has a lot of features that are not meant to be accessed except for by service people.
[20:05.280 --> 20:10.760]  Some are very standard, which are the OBD set, and they're used for doing emissions control.
[20:11.480 --> 20:22.200]  Some are not very standard and are used for everything from figuring out what's wrong with your brakes to reflashing the firmware on your airbag controller to, like, the list goes on and on and on.
[20:22.600 --> 20:28.200]  So there isn't much out there to help you do that that's open source today.
[20:28.200 --> 20:33.180]  So one of the goals of this is to make that a little bit easier for people and bring it into open source.
[20:35.800 --> 20:38.560]  People kind of razz me for doing this in Java.
[20:39.080 --> 20:40.400]  I don't blame them.
[20:42.120 --> 20:47.840]  Cross-platform GUIs are a pain, and Java is one of the ways to do it quickly.
[20:48.020 --> 20:52.940]  I tried, like, doing a WebKit thing, and then, no, you can't update it fast enough.
[20:53.280 --> 20:56.520]  So the way I like to explain it is this.
[20:56.860 --> 20:58.040]  Now I have a problem factory.
[21:01.760 --> 21:02.820]  But it does work.
[21:05.640 --> 21:06.380]  It does work.
[21:06.500 --> 21:09.120]  And this is a sample output of what one of the views looks like.
[21:09.240 --> 21:12.020]  This is just the trace view with some total junk data.
[21:12.320 --> 21:13.920]  But you get, like, little filters.
[21:13.920 --> 21:18.020]  You can save in a format that allows you to replay data or look at it.
[21:18.600 --> 21:22.820]  We've used this to reverse engineer things like GPS, airbag, signal, all sorts of stuff.
[21:22.820 --> 21:24.140]  And it's open source.
[21:24.560 --> 21:28.460]  GitHub.com slash link layer is, like, all of my cans stuff.
[21:28.580 --> 21:33.400]  So if you go on there, you'll find a bunch of different repos for hardware, firmware, software.
[21:34.880 --> 21:39.860]  So, yeah, I think Craig's going to take this back and talk about vulnerabilities and how to find them.
[21:44.330 --> 21:44.810]  All right.
[21:44.930 --> 21:49.510]  So before we get into some actual examples and some of the newer tools, this, I guess, is a new tool, too.
[21:50.430 --> 21:51.990]  This one is called UDSM.
[21:52.270 --> 21:58.450]  What we're seeing here is an auto learning system that uses those diagnostic packets we just mentioned.
[21:59.050 --> 22:14.890]  It can analyze them on, like, say, if you were to attach a dealership tool and do some functions, it can learn those functions and then simulate a vehicle after seeing them to the point that the dealership tool can't tell if you're talking to a real vehicle or the simulator,
[22:14.970 --> 22:22.450]  which is very handy, especially if you're attacking the dealership tool, which is something I like to do because nobody puts security audits on the dealership tool.
[22:22.450 --> 22:25.690]  They don't expect a malicious car to pull in the lot and say, hey, my engine light's on.
[22:27.750 --> 22:34.130]  So it's a good area to go because those dealership tools also have the keys to write firmware changes.
[22:34.810 --> 22:37.650]  And so, you know, it's a nice, soft target.
[22:37.750 --> 22:39.150]  And that's not necessarily hard.
[22:39.170 --> 22:47.710]  So the way the ECUs, the engine control units and other modules, usually protect themselves is with a kind of a challenge response system.
[22:47.710 --> 22:54.470]  And so it is ability to basically ask for a key and get a, I'm sorry, like a seed value.
[22:54.690 --> 22:57.250]  And then both sides run their same secret sauce algorithm.
[22:57.530 --> 23:01.610]  And if they both match the response, then it unlocks firmware unlocking mode.
[23:01.670 --> 23:02.850]  That's essentially how it works.
[23:02.970 --> 23:11.370]  But there are several vulnerabilities if you want to directly attach or attack these systems to, like, make your own firmware changes because they don't give you the algorithms.
[23:13.150 --> 23:17.530]  So some of the weaknesses is when you ask for this key value, you only have eight bytes to work with to begin with.
[23:18.030 --> 23:21.110]  So your seed is going to be two to four bytes.
[23:21.330 --> 23:22.290]  That's your key space.
[23:22.790 --> 23:23.770]  So it's, yeah, right?
[23:24.290 --> 23:24.930]  Really small.
[23:25.510 --> 23:27.770]  So they do have some brute forcing lockouts.
[23:27.870 --> 23:29.630]  If you try too many times, they'll lock you out.
[23:29.810 --> 23:35.630]  The time it locks you out and how it locks you out varies depending on what you're talking to, who made it, all kinds of things.
[23:35.810 --> 23:37.710]  So it's, there's no standard for locking out.
[23:37.710 --> 23:39.090]  It's just, it typically will.
[23:40.410 --> 23:42.470]  But there's a couple of interesting hacks to this.
[23:43.070 --> 23:51.630]  One is because both sides run that little secret sauce algorithm, if you scan the memory of the controller when you ask for a seed, like, hey, give me that seed.
[23:51.770 --> 23:57.890]  A lot of the times, well, it's a lot, maybe 50% of the time, it'll go ahead and calculate what the answer is supposed to be and wait for you to respond.
[23:58.130 --> 24:02.690]  Well, if you check the memory, you can usually find the seed it gave you right next to the answer.
[24:03.350 --> 24:10.370]  So if you tie those in together, so your device, you know, asks for it, checks memory, and then answers with it, it unlocks every time.
[24:11.610 --> 24:13.150]  The other thing is to get around the brute forcing.
[24:13.330 --> 24:13.970]  Oh, sorry.
[24:14.890 --> 24:23.590]  The other thing to get, for brute forcing, you can get around the lockouts by using ECU reset, which is a diagnostic request.
[24:24.190 --> 24:28.550]  So one thing you can do is you can start asking for, hey, give me another value.
[24:28.630 --> 24:29.210]  I want to try again.
[24:29.310 --> 24:29.910]  I want to try again.
[24:30.010 --> 24:30.210]  Try again.
[24:30.290 --> 24:30.890]  Oh, I'm locked out.
[24:31.410 --> 24:32.390]  Reset your IC.
[24:32.610 --> 24:34.490]  And so that takes like a second to reset.
[24:34.630 --> 24:36.990]  And then it forgets how many times you've tried and you just continue.
[24:38.630 --> 24:39.830]  Sometimes they don't let you do that.
[24:39.950 --> 24:44.870]  And so sometimes you have to just run like a relay to the power of the IC and do it anyway.
[24:45.570 --> 24:47.750]  Again, you can reboot it pretty quick and it's not a real big deal.
[24:47.750 --> 24:54.610]  So you can get around these and that's how a lot of a decent amount of performance and stuff are getting around them today.
[24:56.610 --> 25:03.590]  To give you an example of what it looks like, because we only have this small packet structure, we basically divide up the ID.
[25:03.890 --> 25:07.250]  So we have a sender and we treat one as a receiver.
[25:07.630 --> 25:09.490]  This isn't terribly typical in CAN.
[25:09.650 --> 25:10.930]  It's only typical in diagnostics.
[25:11.130 --> 25:15.450]  It's like an ISRTP standard, which is a kind of a layer on top of CAN.
[25:16.070 --> 25:19.130]  And so in this case, when you see 7DF, that's us.
[25:19.470 --> 25:20.510]  We're making a request.
[25:20.690 --> 25:22.510]  And the response is coming from 7E8.
[25:23.330 --> 25:24.650]  And so what we're basically doing here...
[25:24.650 --> 25:26.330]  I'm not going to go through all the different bytes and what they mean.
[25:26.650 --> 25:32.010]  But in general, when we say 2701, we're saying, hey, give me a seed value.
[25:33.090 --> 25:34.390]  The response comes back.
[25:34.810 --> 25:35.950]  It's a positive response.
[25:35.950 --> 25:37.570]  But in the blue area, that's the seed.
[25:37.690 --> 25:39.090]  In this case, it was a four-byte one.
[25:39.630 --> 25:42.190]  And so the seed was, you know, FA91, whatever.
[25:43.310 --> 25:47.310]  And so we send our answer back after our secret sauce algorithm.
[25:47.950 --> 25:52.090]  We say 2702 instead of 01 for secure access.
[25:52.350 --> 25:53.670]  And then we gave it one, two, three, four.
[25:54.270 --> 25:56.270]  It responded with a 7F, which is an error.
[25:56.510 --> 25:57.350]  Like, ah, sorry.
[25:58.030 --> 26:00.450]  If it was, you know, successful, you won't get that.
[26:01.370 --> 26:02.270]  And then it unlocks.
[26:02.270 --> 26:07.610]  That's all there is to standard unlocking of, like, ECUs.
[26:07.990 --> 26:08.910]  There's not much to them.
[26:10.570 --> 26:11.430]  The other thing you can...
[26:11.430 --> 26:12.650]  So that's attacking over the can.
[26:13.030 --> 26:16.750]  If you want, you can go a little bit deeper and attack the embedded system itself.
[26:16.950 --> 26:20.630]  And this is very similar to attacking, you know, like a router or something of that nature.
[26:20.890 --> 26:22.310]  So you can look for JTAG.
[26:22.330 --> 26:23.710]  You can use JTAGulator if you want.
[26:23.710 --> 26:29.150]  So you can connect hardsploit.io is where it comes from.
[26:29.330 --> 26:30.110]  It's like a...
[26:30.110 --> 26:31.450]  It's a device I've been playing with recently.
[26:31.610 --> 26:38.530]  It's kind of similar to JTAGulator in that it makes a very simple method to specify what IC you're using.
[26:38.750 --> 26:45.710]  And it kind of lights up little pins of which ones you should connect, like SPI or whatever, and it dumps the firmware, which is nice to have, obviously.
[26:45.910 --> 26:49.790]  And then ChipWhisperer is a side channel analysis tool.
[26:49.910 --> 26:52.550]  It does power analysis.
[26:52.550 --> 26:56.610]  It does clock glitching, power glitching, and it's relatively cheap.
[26:56.930 --> 26:59.750]  It used to cost around 30 grand to do side channel analysis attacks, minimum.
[27:00.470 --> 27:03.770]  I think that ChipWhisperer lights like $150 maybe.
[27:04.610 --> 27:05.730]  It's really, really nice.
[27:05.850 --> 27:08.050]  It comes with a really nice target board to practice on.
[27:08.730 --> 27:09.530]  Highly recommended.
[27:10.110 --> 27:11.070]  But it does take time.
[27:11.270 --> 27:14.010]  So if you're going to go that route, it's usually the last route to do side channel.
[27:14.530 --> 27:19.570]  But if you're in a tough problem, like say it uses AES keys, ChipWhisperer will break the AES keys.
[27:20.530 --> 27:24.290]  Once you have the firmware, I recommend, you know, of course, decompiling it.
[27:24.970 --> 27:27.030]  You'll typically use, like, or disassembling it.
[27:27.450 --> 27:30.030]  You'll use, you know, like Radar 2 would be like the cheap end.
[27:30.170 --> 27:31.550]  IDA Pro would be the expensive end.
[27:31.690 --> 27:32.630]  Hopper lies in the middle.
[27:33.410 --> 27:34.270]  They're all good tools.
[27:34.510 --> 27:36.310]  So whichever works for you.
[27:37.830 --> 27:41.670]  So the new tool that we are working on that did not show up yet.
[27:42.490 --> 27:43.170]  It's coming.
[27:43.650 --> 27:44.110]  It's coming.
[27:44.270 --> 27:44.650]  Yeah, wait for it.
[27:45.650 --> 27:46.250]  There we go.
[27:46.790 --> 27:49.710]  So the new tool that we're working on right now is called CANiverse.
[27:50.510 --> 28:03.850]  And so with CANiverse, the point of CANiverse is, as I mentioned, there are these files that the auto industry has that defines what ID does what, what bit does what, and it's necessary.
[28:03.990 --> 28:06.610]  It's necessary for them to know what all modules are talking to each other.
[28:06.730 --> 28:10.850]  When they buy modules from tier suppliers, they have to get this information.
[28:11.450 --> 28:15.750]  You, as a consumer, also need this information to integrate with a car.
[28:16.230 --> 28:20.110]  You can't easily drop in a module to a car without knowing how the car is communicating.
[28:20.370 --> 28:23.390]  And this varies for every make, model, and year, oftentimes.
[28:23.870 --> 28:31.050]  And so what CANiverse does, it is just a collaborative database of all these pieces that you had to reverse engineer anyway.
[28:31.190 --> 28:32.750]  Most people are doing it and putting it on forums.
[28:32.910 --> 28:38.870]  We're going to put it in one location that you can just search, download, or upload.
[28:39.270 --> 28:44.290]  You can also rank them, very similar to the way the Wi-Fi maps used to work when we used to war dial.
[28:44.810 --> 28:46.910]  And people used to be like, oh, that one's there, you know, that kind of thing.
[28:47.370 --> 28:48.770]  We'll do the same thing with this.
[28:48.910 --> 28:54.150]  What we'll do is, if you have, say, a certain car, like, oh, here, RPMs are these bites.
[28:54.650 --> 28:57.750]  And then, you know, you can verify, yes, that was true on my car.
[28:57.870 --> 29:02.230]  It was also true in the year after or the year before, because sometimes they'll transcend for certain pieces.
[29:02.650 --> 29:04.250]  It usually depends on where they buy their parts.
[29:04.250 --> 29:10.170]  And then the format we're using is Kayaks has an XML format.
[29:10.470 --> 29:12.390]  Kayak is an open source tool I didn't show.
[29:13.370 --> 29:18.050]  The tool itself is okay, but the format is really nice, the way they do definitions.
[29:18.390 --> 29:20.270]  And so we're going to use that as the open format.
[29:20.790 --> 29:22.150]  DBC is the closed format.
[29:22.330 --> 29:23.070]  That one's by Vector.
[29:23.550 --> 29:25.050]  That's the one the auto industry uses.
[29:25.470 --> 29:34.310]  And so dirty little secret is that those leak from auto industries all the time, because everybody needs those to do any kind of work.
[29:34.550 --> 29:36.890]  And so they get sold on the side and all kinds of things.
[29:37.990 --> 29:39.470]  And so we're going to support that as well.
[29:39.690 --> 29:41.990]  You can export to those formats because other tools will use it.
[29:42.270 --> 29:43.710]  You can also import from those formats.
[29:43.910 --> 29:45.170]  And you can also manually add it.
[29:45.350 --> 29:46.310]  This is an open source.
[29:46.470 --> 29:48.210]  It's written in Python, Django.
[29:48.910 --> 29:51.790]  Still in the early stages, and we're looking for additional help on it.
[29:52.370 --> 29:54.110]  This one's going to be completely collaborative.
[29:54.570 --> 29:57.550]  We just created github.com slash open garages.
[29:57.730 --> 30:01.230]  And we're going to move a bunch of open source tools there within the next month.
[30:01.710 --> 30:03.130]  This is going to be one of those tools.
[30:04.010 --> 30:04.150]  All right.
[30:04.530 --> 30:05.290]  You want to talk about the future?
[30:05.550 --> 30:06.050]  The future.
[30:06.190 --> 30:06.710]  The future.
[30:08.230 --> 30:13.530]  Actually, one kind of nifty thing with CANiverse is it's browser-based, right?
[30:13.910 --> 30:15.710]  And it should be...
[30:15.710 --> 30:20.750]  Well, actually, it's already possible to make CANtact talk to your browser, which is strange, but works.
[30:21.330 --> 30:32.090]  So it should actually be possible to make a means of plugging into your car and then going to this website and decoding data based on what's in this collaborative database, which would be really cool for testing.
[30:32.270 --> 30:34.810]  So that's kind of like the grand vision in my mind.
[30:35.570 --> 30:36.610]  But yeah, the future.
[30:36.870 --> 30:38.590]  So there's some new protocols coming down the pipe.
[30:39.530 --> 30:43.490]  CanFD is one that you probably won't find in any car on the road today.
[30:44.570 --> 30:47.290]  Let me know if I'm wrong on that, but I don't think anyone has it yet.
[30:47.290 --> 30:52.890]  Basically, it's flexible data can, meaning instead of eight bytes per frame, you can do 64.
[30:53.670 --> 30:57.570]  And also, I think it's up to five megabits a second instead of one.
[30:57.770 --> 30:58.830]  And that's about the only difference.
[31:00.070 --> 31:06.770]  Kind of good for security, folks, because you can put Macs and things in there that are sufficiently long and not just a byte.
[31:07.510 --> 31:08.270]  So that's good.
[31:08.790 --> 31:10.310]  That will need some new tools.
[31:10.470 --> 31:15.750]  You need different controllers to talk that and also actually different transceivers to do the analog part.
[31:16.470 --> 31:18.670]  Automotive Ethernet is starting to come along.
[31:19.510 --> 31:23.010]  Now, putting IP into things doesn't typically make them more secure.
[31:23.510 --> 31:25.410]  So we'll see what happens.
[31:26.370 --> 31:32.070]  But yeah, what happened is this little company called Broadcom came out with this thing called BroadRreach.
[31:32.430 --> 31:42.690]  And basically, they can do 100 megabit Ethernet over a single twisted pair set of wires, which is the exact same thing that CAN usually runs over, if it's differential CAN.
[31:42.690 --> 31:48.030]  So you can just replace that with Ethernet and it's 100 times faster.
[31:48.910 --> 31:51.770]  But now you have like a way more complex system.
[31:51.950 --> 31:53.430]  You have way more layers.
[31:53.450 --> 31:57.510]  You have, you know, either TCP or UDP or something else.
[31:57.710 --> 32:00.430]  No one's really standardized much of that yet.
[32:00.430 --> 32:04.890]  So that's going to be a whole, whole, I don't know, fun time.
[32:05.790 --> 32:09.590]  And V to V or V to X, which is vehicle to vehicle.
[32:09.790 --> 32:13.730]  Vehicle to X is just vehicle to stuff infrastructure.
[32:14.450 --> 32:28.090]  And this is the idea that your car is going to talk to other cars in order to, you know, know what they're doing, maybe know if they're going fast or slow, and talk to infrastructure to do things like, you know, figure out, hmm, is your car meeting emission standards right now?
[32:28.670 --> 32:32.630]  Or maybe just to retime traffic signals based on traffic flows.
[32:32.710 --> 32:35.290]  There's a lot of different, like, conceived applications of this.
[32:36.150 --> 32:44.490]  Obviously, like, the security on this is insane because everyone who has a car has to kind of be trusted, but not really.
[32:45.410 --> 32:51.390]  And, yeah, that's... there are proposed standards, but it's a really hard problem.
[32:52.170 --> 32:53.870]  Also, vehicle use is changing.
[32:54.030 --> 32:58.150]  Cars are getting way more autonomous, and that's not going anywhere.
[32:58.450 --> 33:00.870]  We're also seeing the concept of self-driving.
[33:01.350 --> 33:06.790]  So right now, we are at advanced driver assistance systems is what the industry calls it, which is ADAS.
[33:06.790 --> 33:11.770]  This is what Tesla Autopilot on all those, you know, competing things.
[33:13.210 --> 33:16.690]  I forget the name, the brand names of the others, but everyone's doing this now.
[33:16.990 --> 33:20.250]  These are features that are meant to make your car easier to drive.
[33:20.470 --> 33:23.150]  They are not meant to drive the car for you.
[33:24.110 --> 33:27.990]  But we're getting further downs that you will have cars that maybe will drive themselves.
[33:28.250 --> 33:29.390]  Obviously, Google's been working on it.
[33:29.510 --> 33:35.990]  And that changes the amount of trust you have to put in these systems because you don't have the human element that can smash the brakes if something's going wrong.
[33:36.650 --> 33:39.170]  And then you also have car sharing, rental cars.
[33:39.430 --> 33:43.610]  I mean, if you rent a car that I was in before you, how do you know I didn't do something bad to it?
[33:43.750 --> 33:44.810]  You really don't.
[33:44.890 --> 33:48.470]  And there's nothing in the vehicles that's really logging this sort of stuff today.
[33:48.730 --> 33:53.890]  So, you know, if you get a zip car, who knows what the guy before you is doing or wasn't doing.
[33:54.670 --> 33:58.850]  And as you see people push models like, oh, well, we won't sell people cars.
[33:58.850 --> 34:00.810]  We'll just make cars available on demand.
[34:00.810 --> 34:03.830]  And that becomes a more and more important piece.
[34:04.790 --> 34:10.570]  So, yeah, the car security, car hacking world is kind of in its infancy still.
[34:11.270 --> 34:15.030]  And I think it's only going to get bigger and more complex as time goes on.
[34:18.850 --> 34:21.630]  So, how to get involved...
[34:23.750 --> 34:24.590]  There we go.
[34:25.730 --> 34:28.490]  So, opengarages.org is something Craig founded.
[34:28.670 --> 34:37.230]  But it's a really great resource with lots of information just on, like, you know, everything you'd kind of want to know about hacking cars.
[34:37.230 --> 34:39.130]  And it's a wiki you can stick stuff on.
[34:39.290 --> 34:40.990]  They also have a mailing list you can get on.
[34:41.190 --> 34:42.870]  And an IRC on Freenode.
[34:43.670 --> 34:47.590]  So, all those options if you want to get in touch with people doing similar things.
[34:48.250 --> 34:52.030]  I am the cavalry is doing more kind of policy type stuff.
[34:52.610 --> 34:56.270]  Trying to figure out what our lawmakers should do about some of these things.
[34:57.250 --> 35:02.810]  And, yeah, there's lots of different places this information is popping up.
[35:02.810 --> 35:10.450]  We're obviously trying to consolidate some of it because often you'll find this in, like, a text file on some forum or whatever.
[35:11.070 --> 35:16.050]  Or someone made an HTML, like, site with tables that shows you the canvas layout, which isn't very useful.
[35:17.430 --> 35:19.390]  So, yeah, there's lots of stuff you can do.
[35:19.530 --> 35:28.130]  And I think from here we're going to move into Ask Us Anything time, which we have about 25 minutes, 20 minutes.
[35:28.450 --> 35:29.870]  And we'll just take your questions.
[35:33.850 --> 35:37.150]  Yeah, you can go to that mic and make a line.
[35:38.850 --> 35:39.290]  Yeah.
[35:41.810 --> 35:49.810]  Without mentioning the OEMs, what was the most interesting problem you discovered during your research?
[35:52.210 --> 35:53.350]  You want to go first on this one?
[35:53.490 --> 35:53.930]  Sure.
[35:54.290 --> 35:55.510]  Just don't mention the OEMs.
[35:55.570 --> 35:59.110]  This works on basically every OEM, so it doesn't really matter.
[36:01.810 --> 36:05.110]  The truth of CAN, right, is it's this bus system that's trusted.
[36:05.590 --> 36:07.350]  And it also has this priority thing.
[36:07.570 --> 36:11.670]  So lower value IDs, they're going to be higher priority.
[36:11.810 --> 36:14.010]  They're going to get out on the bus and block other stuff.
[36:14.010 --> 36:26.350]  So if you literally write the code, while one, send CAN message with ID zero and eight bytes that are zero, loop, you will just crash the CAN bus you're connected to.
[36:26.510 --> 36:33.990]  And this can have some pretty awesome results, like you lose power steering, power brakes, your engine kind of goes into this weird open loop control mode.
[36:34.470 --> 36:41.190]  You will set every fault code if you do this to the right CAN bus, which I have done by accident in my boss's car once.
[36:45.050 --> 36:50.390]  But fortunately, if you know what you're doing, you can send OBD mode four, and that will clear all the fault codes, and you're good to go.
[36:50.530 --> 36:51.410]  Turn the check engine light off.
[36:53.950 --> 37:01.190]  What about black boxes and vehicle data recorders and the ability for them to record this information?
[37:01.670 --> 37:09.110]  Have you typically, I know in the commercial sector, it's like hugely expensive, like $60,000 to get the suite, and then even then it takes work.
[37:09.670 --> 37:17.270]  So is there anything on that about being able to retrieve recorded data for telemetrics, for instance, for the vehicle?
[37:17.610 --> 37:19.430]  Oh, yeah, I'm actually really glad you asked that.
[37:20.750 --> 37:22.090]  So there's two different areas.
[37:22.250 --> 37:25.550]  There's, you know, the black box from the airbag controller, and I'm going to let Eric talk about that one.
[37:25.910 --> 37:30.590]  There's also this whole area where we're using the IVI systems to record a bunch of stuff.
[37:31.010 --> 37:32.610]  And that one's not a standard.
[37:33.230 --> 37:41.270]  And that information, I guess, is kind of questionable sometimes, because a lot of times it's just developer debug logs, too.
[37:42.010 --> 37:45.590]  So even, you know, the manufacturer doesn't know what's being recorded.
[37:45.810 --> 37:54.590]  And sometimes you see manufacturers do things like, well, we don't want, you know, Google and Apple to take over the space, and they like data, so we must like data, too.
[37:55.070 --> 38:04.450]  We don't know what we're going to do with it or even how to sell it, but we're going to just take as much as we can and stick it up on servers, with no retention policy, no real security issues of, like, of how to protect it.
[38:04.610 --> 38:07.650]  It's a little scary right now when it comes to that.
[38:08.570 --> 38:15.090]  But as far as black box systems and using, like, the airbag sensor, you're right.
[38:15.230 --> 38:16.810]  It's very proprietary at the moment.
[38:17.350 --> 38:18.890]  Eric, have you done some research on those?
[38:18.890 --> 38:26.190]  Yeah, so after 2013, I believe it's 2013 in the US, every car has a black box of sorts.
[38:26.230 --> 38:28.350]  And a lot go way before that.
[38:29.050 --> 38:35.910]  And what this is, it's really just a part of your airbag module, and it's always recording a five-second rolling buffer of data.
[38:36.350 --> 38:44.470]  The data it records seems to depend on the OEM and not on who made the module, so it seems to be specified by the OEM.
[38:44.470 --> 38:51.750]  And when you crash your car and have a deployment event, so if the airbags go off, it will freeze that five-second buffer.
[38:52.250 --> 39:06.350]  Also, if you crash your car minorly, and I don't know what the definition of minorly, it seems to also vary from OEM and year to year, it will record an event as a, like, temporary or non-deployment event, it calls it.
[39:06.350 --> 39:08.350]  It can overwrite those if you have multiple.
[39:09.170 --> 39:14.770]  That data sometimes is just, like, the airbags went off, and here's the ones that deployed.
[39:15.090 --> 39:29.250]  Other times, it's here's the vehicle speed, here's the pedal positions, here's the roll rate of the vehicle, the delta V and acceleration in all directions that it has, was your seatbelt fast, and is a very common one.
[39:29.970 --> 39:32.610]  And that goes on and on and on, and this is in basically every car.
[39:32.830 --> 39:36.010]  So, you know, this gets into the insurance side.
[39:36.370 --> 39:41.290]  That kind of data, if you're going to try to make fraudulent insurance claims, becomes sort of useful.
[39:41.530 --> 39:46.410]  And also, if you're not wearing your seatbelt, the insurance company can know after the fact.
[39:46.630 --> 39:46.910]  So, things to keep in mind.
[39:46.910 --> 39:47.910]  How much you weigh is there, too?
[39:48.210 --> 39:48.570]  What?
[39:48.650 --> 39:51.790]  I've seen how much you weigh also recorded from the weight sensor in case you switch seats.
[39:52.210 --> 39:53.130]  That is also in there.
[39:53.130 --> 39:58.950]  Yeah, they have occupancy centers that can tell if it's like a baby or infant or adult, at the very least.
[39:59.250 --> 40:03.010]  Sorry, as a quick follow-up, is there any software that you know of that will...
[40:04.010 --> 40:06.410]  Unfortunately, no, because everything is super proprietary.
[40:07.570 --> 40:08.310]  Oh, sorry.
[40:08.550 --> 40:11.970]  Question was, is there any software to dump that stuff, that airbag data?
[40:12.190 --> 40:14.690]  Unfortunately, today, there isn't really.
[40:15.030 --> 40:17.510]  It's all really proprietary, not only in...
[40:17.510 --> 40:24.350]  It uses the standard diagnostic protocols, but you have to request really specific, like, I want you to run this routine.
[40:24.790 --> 40:27.410]  Some of them literally give you the ability to just dump memory.
[40:28.050 --> 40:32.170]  And what the real tool does is it just dumps certain regions of memory right off the chip.
[40:33.290 --> 40:35.010]  So, you need to know what to do.
[40:35.150 --> 40:38.730]  And then you also need to know how to take that information and correlate it back.
[40:39.170 --> 40:49.450]  Right now, the way you do it is you buy the crash data recording hardware from Bosch, who does it for almost every OEM, which costs a few thousand dollars plus like a thousand bucks a year in subscription.
[40:50.090 --> 40:51.290]  And you can do that.
[40:52.010 --> 40:58.070]  I'm looking at some ways that we might be able to make that more accessible, but nothing solid yet.
[40:58.590 --> 41:01.350]  It's on the open garage's to-do list, so more volunteers will help.
[41:02.470 --> 41:02.710]  All right.
[41:03.050 --> 41:04.730]  My question is a two-fold question.
[41:04.910 --> 41:07.910]  What's your take on the Tesla incident with the tractor trailer?
[41:08.290 --> 41:13.630]  And the second thing, how did Volkswagen cheat the data for the New York State or for the state inspections?
[41:15.830 --> 41:16.950]  Do you want me to take this one?
[41:20.110 --> 41:29.590]  What I'll say about Tesla, because I have to be a little careful, but what I will say about Tesla is all the features in vehicles today that are on the road are not...
[41:29.590 --> 41:33.790]  They're not autonomous driving, they're not semi-autonomous driving, they're assistance systems.
[41:34.430 --> 41:37.450]  Your hands need to be on the wheel and your feet need to be on the pedals.
[41:37.930 --> 41:44.550]  Much like cruise control is a driver assistance feature, you'd never think of turning cruise control on and like reading a book or watching Harry Potter.
[41:47.010 --> 41:47.870]  Don't do it.
[41:47.990 --> 41:56.270]  It's like they're not test... no ones are tested to the rigor that it should be for something that's semi or fully autonomous today, and that's just the reality.
[41:57.270 --> 42:00.650]  Yeah, the other thing I want to bring up too is like there's a really interesting spot we're in right now.
[42:00.890 --> 42:11.230]  So like we have NISTA, NHTSA, who in 2018 says we need sensors to detect if like say vehicles in front of you and automatically apply the brakes.
[42:11.230 --> 42:14.950]  Now in that situation what we have is a computer overriding a human.
[42:15.490 --> 42:17.790]  So you know myself, I'm trying to give it a gas.
[42:18.010 --> 42:21.950]  The computer is saying not only am I not listening to you and giving it gas, I'm going to do the opposite of what you said.
[42:22.090 --> 42:23.010]  I'm going to apply the brakes.
[42:23.610 --> 42:33.570]  Now at the same time in California we have people saying like okay well Google you have to add a steering column to your self-driving car because we need a way for humans to overwrite computers.
[42:34.010 --> 42:35.250]  Now we can't have them both.
[42:35.490 --> 42:38.610]  We can't have computers overwriting humans and humans overwriting computers.
[42:39.010 --> 42:42.530]  So at some point in time, we have to decide which one is safer.
[42:43.870 --> 42:49.750]  I personally lean a little more towards Google's rod not including a steering column because it puts the liability on them to do all the work.
[42:49.870 --> 42:52.470]  You don't get that excuse, well, they should have their hands on the wheel.
[42:52.610 --> 42:54.810]  Well, this is just an assistant driving system.
[42:55.310 --> 42:58.550]  Because if you are building one with a new steering column, you better get that right.
[42:59.190 --> 43:02.150]  And I like that option.
[43:02.190 --> 43:11.190]  Plus, with self-driving cars, there's also a different architecture because they don't have this kind of, well, one of the reasons is because they don't have this kind of excuse.
[43:11.550 --> 43:12.990]  They can't trust their own sensors.
[43:13.230 --> 43:15.770]  Some kid could run up and put like duct tape over one of them or something.
[43:16.030 --> 43:23.250]  So they kind of have multiple sensors of different types to determine if that's a curb or if that's a bunch of wet grass or a puppy on the road.
[43:23.430 --> 43:24.370]  What is that?
[43:24.550 --> 43:25.830]  Can I drive over that or not?
[43:26.410 --> 43:30.210]  And so the nice thing about that is the internal network isn't trusted.
[43:30.690 --> 43:31.850]  The sensors aren't trusted.
[43:31.890 --> 43:32.730]  That's a key piece.
[43:32.870 --> 43:34.610]  I mean, I actually think corporate networks should work that way.
[43:35.690 --> 43:39.230]  Because that's a huge problem is that once you're inside, you're inside.
[43:39.610 --> 43:43.970]  And the auto in the self-driving systems, their architecture is a little different.
[43:44.290 --> 43:47.470]  I think that actually, maybe not intentionally, but makes them a little more secure.
[43:47.630 --> 43:50.230]  It's much harder to fake multiple sensors at once.
[43:50.470 --> 43:53.350]  And right now you can just kind of say, like, oh, brake in the current car and it does.
[43:54.350 --> 43:55.770]  And a diesel gate was the other thing.
[43:56.430 --> 43:58.190]  The Volkswagen diesel incident.
[43:59.170 --> 44:04.830]  With emissions, a lot of the certifications that get done are kind of done by the manufacturers themselves.
[44:06.210 --> 44:08.570]  People think that's the reason that managed to just slip through.
[44:08.850 --> 44:11.850]  But basically, Bosch, I believe it was Bosch that made the engine controller.
[44:12.370 --> 44:16.490]  And the understanding is they put a mode in there and said, don't use it.
[44:16.590 --> 44:17.190]  And they used it.
[44:17.790 --> 44:19.530]  That's pretty much what we got out of it.
[44:19.550 --> 44:24.770]  There's actually a great CCC talk on, like, reverse engineering the firmware from there.
[44:24.810 --> 44:28.210]  So if you're really interested in that, like, go watch that talk.
[44:28.330 --> 44:29.230]  It would be my biggest recommendation.
[44:29.890 --> 44:30.310]  All right.
[44:30.430 --> 44:31.170]  And now my statement.
[44:31.330 --> 44:32.750]  I own a car rental company.
[44:32.890 --> 44:35.210]  So if you're going to use a car rental, use zip car.
[44:37.050 --> 44:37.410]  Fair.
[44:40.230 --> 44:40.730]  Hi there.
[44:40.850 --> 44:43.990]  Since he already asked about diesel gate, I'll ask about something else.
[44:44.130 --> 44:45.450]  How about Flo from Progressive?
[44:45.610 --> 44:52.110]  She wants me to put a little thing in my car that's going to tell them when I'm speeding and when, you know, I don't know, when I run lights.
[44:52.530 --> 44:54.870]  So it plugs into OBD.
[44:55.010 --> 44:56.590]  It uses CAN bus, I take it.
[44:56.670 --> 45:03.210]  Is there any way I can appear like a much better driver to flow or is this pretty much hopeless?
[45:05.830 --> 45:07.870]  That would be insurance fraud.
[45:08.130 --> 45:08.410]  Okay.
[45:08.950 --> 45:09.370]  I thought so.
[45:09.370 --> 45:10.170]  But yes, you can.
[45:11.370 --> 45:14.370]  May have done some research on that and yeah.
[45:14.790 --> 45:16.590]  I mean, some devices are better than others.
[45:16.730 --> 45:19.310]  Some have GPS to, like, actually make sure you're moving.
[45:19.530 --> 45:24.610]  Not that GPS is, like, impermeable to being forged in so many different ways.
[45:24.750 --> 45:26.310]  But some are better than others.
[45:27.110 --> 45:34.250]  But typically they're looking at the standard OBD signals because that's the only thing that's the same across every single vehicle that they can plug into.
[45:35.250 --> 45:38.010]  So if you look like a car, you look like a car.
[45:38.970 --> 45:39.030]  Yeah.
[45:39.450 --> 45:44.330]  Only it's opt-in now, but eventually if it's ever opt-out, it's kind of...
[45:44.330 --> 45:45.010]  Right.
[45:45.410 --> 46:02.630]  The other thing is people should understand that really depending on what car you drive and how it's DLC is connected to the rest of the vehicle, you may be giving progressive or anyone that manages to take over the progressive device a lot more power than just reading if you're speeding or not.
[46:02.790 --> 46:04.970]  Like, they might be able to change firmware on your controllers.
[46:05.150 --> 46:05.290]  Yeah.
[46:05.410 --> 46:06.210]  And I think that's a great point.
[46:06.310 --> 46:09.610]  These dongles, a lot of them are like the monitor teens driving and stuff like that.
[46:09.810 --> 46:14.650]  You're taking a car that maybe didn't have cellular and telematics connections to it and you're adding it.
[46:14.850 --> 46:22.850]  And these startup companies, you know, while they're great and I like innovation, they don't go through some, well, sometimes any security rigor.
[46:23.390 --> 46:27.410]  And so you're kind of really opening up a car that didn't have previous vulnerabilities.
[46:27.670 --> 46:31.870]  So you have to really keep that in mind if you're going to drive around actively with one of these dongles attached.
[46:33.870 --> 46:34.910]  Two quick things.
[46:35.170 --> 46:39.590]  Has anyone done any looking at modern motorcycles as well as cars?
[46:40.870 --> 46:52.270]  And also services like Zipcar and Car2Go, are those basically just interfacing over the CAN bus for information about the car, like door locks, if it's moving, et cetera?
[46:52.990 --> 46:54.070]  I don't know the Zipcar.
[46:54.190 --> 46:54.650]  Do you have Zipcar?
[46:55.350 --> 46:56.310]  They have a box.
[46:56.370 --> 46:58.890]  I think most of them do connect into OBD.
[46:59.590 --> 47:01.850]  I don't know what data they use exactly.
[47:02.050 --> 47:03.390]  And I think it really depends on the company.
[47:03.930 --> 47:05.710]  No one's really looked at those devices either.
[47:05.910 --> 47:07.030]  They're maybe bad.
[47:08.690 --> 47:13.010]  Motorcycles, I may be in a position to do some research on that.
[47:13.010 --> 47:14.810]  I'm talking... we're trying to get the motorcycle.
[47:15.910 --> 47:16.790]  I don't know if you have anything.
[47:16.930 --> 47:19.770]  Yeah, I've done motorcycle stuff and they do have CAN on them.
[47:19.950 --> 47:21.290]  They don't always like...
[47:21.290 --> 47:22.510]  a lot of times it's just informational.
[47:22.830 --> 47:24.690]  You know, it's more for using like your...
[47:25.370 --> 47:29.550]  you know, if you were to replace like an IVI, you know, like a little head mount unit so I can tell the shifting gears.
[47:29.790 --> 47:32.750]  If you play back shifting gears and stuff, it usually won't affect it.
[47:34.210 --> 47:35.390]  But, you know, that's going to vary.
[47:35.470 --> 47:36.290]  I haven't looked at a ton of them.
[47:36.290 --> 47:38.270]  I've only looked at maybe a three.
[47:38.930 --> 47:40.710]  So, you know, your mileage may vary.
[47:41.590 --> 47:47.770]  Have you guys had any luck owning a car through Bluetooth or any wireless signals?
[47:48.230 --> 47:49.390]  Are you asking if we've done that?
[47:49.930 --> 47:50.930]  Like owning a car through Bluetooth?
[47:51.250 --> 47:51.470]  Is it possible?
[47:51.470 --> 47:51.530]  Yeah.
[47:51.670 --> 47:52.050]  Oh, yeah.
[47:52.170 --> 47:52.790]  Yeah, totally possible.
[47:53.010 --> 47:58.550]  So, a lot of times when you have an IVI system, they don't have a nice update.
[47:58.990 --> 48:03.770]  And I mean, how... if you get an IVI system that has an app store, you realize there's been no apps for it ever since you bought it.
[48:03.770 --> 48:07.330]  So, they won't even update apps, more or less the Bluetooth stack.
[48:07.910 --> 48:10.250]  And a lot of times they don't restrict the Bluetooth stack either.
[48:10.670 --> 48:14.810]  So, they didn't like go through and say like, well, the only Bluetooth device we think they're going to connect in are these things.
[48:14.990 --> 48:16.130]  It's just the full thing.
[48:16.590 --> 48:18.450]  So, yeah, I would look at those.
[48:18.630 --> 48:26.490]  And usually all you have to do is if you use it like an embedded attack, pull the firmware, or you get access to it where you're looking at just the version number and check the CDEs.
[48:26.910 --> 48:28.690]  It's really not much harder than that.
[48:30.290 --> 48:31.490]  That's one more question.
[48:31.490 --> 48:34.790]  How far are we from an iPhone app that just unlocks cars?
[48:36.090 --> 48:38.850]  Oh, like watchdog style using an app and just walking up?
[48:41.370 --> 48:44.810]  I don't think it could just be an app in the general case.
[48:44.910 --> 48:50.690]  But one thing you do see a lot of problems with are some of the remote keyless entry systems.
[48:50.930 --> 48:52.010]  We didn't really touch on that.
[48:52.150 --> 49:01.950]  But, you know, a lot of these, if you can range extend the key signal, the car thinks the key is near it and it unlocks, which is convenient, but probably not secure.
[49:02.490 --> 49:07.910]  And those systems have some major issues because, like, that's not an easy thing to fix.
[49:08.350 --> 49:22.970]  There's some timing analysis stuff and some positioning analysis that's happening, but it's, you know, there was one group that was like a non-technical group that managed to, like, make a box to rearrange extension for, like, less than a thousand bucks that would work on actual cars on the road.
[49:23.890 --> 49:23.890]  So.
[49:28.990 --> 49:30.630]  So you're right about the dongles.
[49:30.790 --> 49:36.970]  I bought an automatic on sale on Prime Day, and it drained my entire, a very large battery flat in a day and a half.
[49:38.490 --> 49:54.990]  If you wanted to do, you've made a good point about integration, if you want to do reverse engineering on a most meteor-oriented systems transport fiber ring, do you know of any kind of test hardware platform for under 10k that makes that easier?
[49:56.210 --> 49:57.470]  So, sorry, Pete, what is your target?
[49:57.710 --> 50:03.030]  So, my car has, I think, two CAN buses, maybe three, but it has a most bus.
[50:03.230 --> 50:03.350]  Yes.
[50:03.370 --> 50:05.750]  It used to have D2B, but then they moved to most.
[50:07.310 --> 50:16.850]  And everything interior, anything that makes any noise or has any sound, anything that has any microphone and telemax and everything else are all in this fiber ring.
[50:17.550 --> 50:21.430]  If you want to do protocol analysis of that, what's a good platform?
[50:22.530 --> 50:25.310]  Yeah, most in FlexRay are two other kind of like advanced bus systems.
[50:25.630 --> 50:28.970]  And FlexRay actually thinks a little harder, but most is kind of a pain in the ass too.
[50:29.110 --> 50:31.150]  It is IP based, which is nice.
[50:31.510 --> 50:34.610]  But again, you don't have a device, a standard device, you usually get on it.
[50:34.810 --> 50:36.450]  I haven't done a crap ton of that.
[50:36.450 --> 50:39.350]  I think... and don't... well, I'm not positive.
[50:39.490 --> 50:41.830]  I think Intrepid Systems has one.
[50:43.050 --> 50:43.990]  Intrepid Systems has one.
[50:44.070 --> 50:44.750]  They make Vehicle Spy.
[50:45.010 --> 50:47.030]  And I think it's probably around two to four grand.
[50:47.370 --> 50:49.310]  So, that technically fits under your limit.
[50:49.450 --> 50:50.270]  And that's super cheap.
[50:50.650 --> 51:00.090]  I was just trying to figure out the PHY looked like, you know, Thousand Base T or FX or something where you could sort of swipe a fiber, like an SFP from a router.
[51:00.230 --> 51:01.450]  I haven't spent a lot of time on it.
[51:01.450 --> 51:02.750]  So, there might be cool hacks to it.
[51:02.890 --> 51:03.250]  Thanks.
[51:05.450 --> 51:09.810]  So, some of us in this room have been in the security area for a few decades.
[51:10.510 --> 51:16.450]  And every time an industry discovers networking and stuff, oh, no, here we go again.
[51:17.670 --> 51:29.650]  Don't the people in the automotive industry, like the above a certain level, not necessarily the C level, read the newspapers, understand that they should start hiring security people to look at their stuff?
[51:30.650 --> 51:33.470]  We're definitely seeing the auto industry paying more attention to the security.
[51:33.510 --> 51:37.450]  Well, it doesn't, from what you said today, it doesn't look like they've paid much attention in the last 10 years.
[51:37.690 --> 51:39.450]  Well, it takes a long time to get on the road, too.
[51:39.770 --> 51:42.530]  You know, their return cycle, when they're developing a vehicle, it's about five years out.
[51:42.670 --> 51:46.670]  And this is why responsible disclosure is a little more tricky, also, when dealing with automotive.
[51:46.910 --> 51:48.450]  And I know we're running out on time here.
[51:49.150 --> 51:55.050]  So, if anybody wants to like ping, like open garages, or you can even meet me, I'm going to be out signing books with no starch.
[51:55.870 --> 51:57.050]  Just come out and ask me questions.
[51:57.630 --> 51:59.270]  I'll find you on the net.
[51:59.730 --> 52:00.950]  I'll stand up there, too, for questions.
[52:01.090 --> 52:01.230]  Thanks.
[52:02.490 --> 52:03.030]  Thank you.
[52:04.190 --> 52:07.690]  Craig is going to be doing a book signing right outside of this room momentarily.
[52:07.930 --> 52:10.790]  You can ask him questions there, too, and get a copy of his book signed.