all right um hello guys this is my talk
about
car hacking plus bug hunting field guide
for
application security hackers uh my name
is jay turla and i'm from bug crowd
who am i um
i'm also known as ship code and twitter
and
uh jetman and rudkon and i'm a security
operations manager
at the philippines or bug crowd and i'm
also
a root can goon or a cfp review board
for the san conference
which is a hacker conference in the
philippines
i am not the author of turtle malware
which is a you know it's a russian
malware
i'm not russian i'm filipino i'm also
one of the
main organizers of the car hacking
village in return and
the philippines which is car hack
village page as the hashtag for twitter
i also contribute to metasploit
for auxiliary and exploit modules but
not much ready unlike before my
my last auxiliary module is related to
the hardware bridge
which can be used for interacting with
the canvas
as a summary this talk will teach you
the secrets or techniques and succeeding
in a car hacking blog bash
bone to own or any hacking contest that
of course
involves about hacking cars
and as what you can see from the video
it's actually a
picture of two successful hackers that i
know
this is a sample
picture from the car hacking blog bash
sample payout
wherein this is the total uh scoreboard
and the total of bounties paid
for car hacking or should i say the car
hacking bug bash
this is a sample clipping from cdnet and
um
for the pawn to own contest a tesla car
was hacked
at the sad contest and the duo
uh was able to win the competition's
overall standings
they also get to keep the car which is a
very good
uh reward and
they use the git bug in the browser
render process
to execute code on the car's firmware
and show a message
on its entertainment system or
infotainment system
so the duo was able to keep the car and
they were also
receive 35 000 us dollars
as a bounty or a one so yep
now how how do i start to be a
to be a car hacker right if
i'm an application security hacker that
usually focuses
on mobile application security bugs
web applications security bugs so how do
i get involved with car hacking
in order to get some bounties as well
from
hacking cars or automobiles
the first thing uh my favorite book of
course
the car hackers handbook a guide for the
penetration tester
written by craig smith there's a
paperback version and ebook version
and there's the online version rendered
on html
of course it's for free the one on the
online version but if you want to buy
the book
there is a paperback version and there
is also
an ebook version i also have one
which is the ebook version i mean i have
two copies
one for the ebook version and one for
the
paperback version which has a signature
of craig smith
here are some good car hacking research
resources that
i always you know give out to folks who
asked me about where's where to start
about
hacking cars first thing first we have
the nano can how you can
create your low cost can sniffer
or carbon hacking tool for just five
dollars so
get that github link from internet
and then there's also getting started
with car hacking from the car
hackingvillage.com website
which uh teaches you how to
play with canutils or how to use it
and then there's also can bus basics
with hands-on fuzzing
by ian sabor ian sabor is also the guy
who made the nano can
and he's my mentor there's also
a curated list of awesome resources
books
hardware software applications uh
people to follow and also more cool
stuff about vehicle security car hacking
and tinkering with the functionality of
your car
it's on github by jared the coder under
awesome vehicle security there's tons of
information there
that you might want to follow or you
know grab on
there's also car hacking village videos
uploaded especially the ones presented
in defcon
and of course if you are in a hacker
conference
i know that most of you guys here love
the appsec village
as well as i do um but also please don't
forget to visit the
visit the car hacking village which has
you know
if you go to carhackingvillage.com
events
you get to know the events um the
nearest events or
when is the next car hacking village
expo
and then the last one is of course made
by
techmaker ua adventures in building a
canvas sniffer if you want to have a
good hardware that you could start i
mean start after building your nanogun
you might want to build a a better
canvas sniffer
which i also like i have a my own
for that and this guy the guys from
techmaker
gave a presentation about it
so how did i started back in the day
aside from the resources
i mostly noticed that people teach
teach car hacking in other countries
without hardware
and they usually focus on virtual can
bus
emulators there's no it's not bad if you
try down one
but please uh i would i would urge you
or advise you to also pick up your own
hardware
uh you can buy your own instrument
cluster which is usually 20 to 30
dollars or
you know if you have a car you can also
play with your infotainment system
i was able to play with my own
infotainment and also
was able to execute command execution
via the usb flash drive and then
from the left image you can actually see
that
i was able to fuzz my instrument cluster
by sending canned messages
on the panel using nanocan which is just
a five dollar
card hacking tool you only need an mcp25
then you hook it up with an arduino nano
so that's why it's called nano cam
like i said there are also some
simulators if you don't have a hardware
yet you can
clone the repository
from craig smith which has
his repository about the uds server
which is free
and also the instrument cluster simulat
simulator
which is the ic sim and if you want to
have an easy a hardware based ecu
simulator
there is available in cindy but i would
advise to
you know to build your
own ecu kit but if you don't have one
you can have the ecu simulator
available in cindy.com or other stores
like amazon
so my my main inspiration is the car
hacking village really so
uh i've learned a lot from visiting the
car hacking village i've learned a lot
from
playing with some of the test benches
that were in the venue
i've also you know got inspired
into not just opening a car
but playing with a canvas network as
well
[Music]
my other advice really is when you
uh aside from the information you need
to have practical demos or practical
usage of the tools that you have or some
of the
information that you were able to read
on the internet or the resources that i
gave you i would advise to
invest or acquire some tools required
for interacting with can or other
protocols like flex ray
uh i bought a machina p1
i was given by um internet with
besides scotland badge which is actually
a nano can
from before i think that was like three
or four years ago
and then i also bought from uh
from defcon the cantack tool and then
the techmaker guys gave me
the uh their own kanba sniffer
during a car hacking bug bash uh the
good thing about car hacking bug bash is
aside from being able to meet car
hackers
you also get to you know get some free
stuff that
maybe they might have and then i also
bought the
value can four during the second to the
last derbycon
from car or the founder of
the car hacking village and
all i can say is you know you need to
have some of your collection of can
hacking tools
there is also an open source uh github
repo
put up together by jay gamblin and
it's called the car hacking tools it is
a collection of scripts
to help you jump start your car research
and hacking
all the scripts are designed to run on
ubuntu debian and cali
you can just install the repo we had a
command line that is presented on the
screen
next up uh i've seen these tools
as always in car hacking bug batches by
the way to let you know uh my experience
is usually on
free edging box all right but while i'm
there i'm also there to
observe the car hackers and also you
know
play with some of the targets that are
that are there during the bug bash so
most of the tools these are software
tools
or applications uh these are the common
enterprise tools
that i see that were used by some of the
car hackers
that we have uh we have the vehicle spy
which you can see from the left image
and from the right
image you can see the uh canoe
which is also a good tool
and then we also have uh aside from
investing some
you know uh can hacking tools or tools
for car hacking you need to have some of
your hardware hacking tools or
network penetration tools i i even have
my own toolbox that contains my alpha
card
uh some of my can sniffers my hack rf
my wi-fi pineapple because car hacking
is
not just about hacking the can okay what
if there's
uh i um what if the car
of course modern cars nowadays have um
hardware that allows it to interface
with
the internet take for example the
telematics unit or also the infotainment
or entertainment system most of them
are hookup via via bluetooth or wi-fi so
you might want to bring your
bluetooth hardware hacking tools or your
wi-fi penetration tools
okay next up we have
the um sample ratings
um are for that pause
these are the sample ratings or common
classifications
uh which can be used as a guide for
hunting
common bugs and car hacking and so that
you may be able to know
uh what do we look for
during the bug bash and so that you will
be informed
the ratings for um automotive security
bugs like
for example p1 is for critical
p5 is informational p4 is low
p3 is medium and then p2 is high
so p1 of course you get
the most uh highest payout if you get
a p1 a p1 bug and it's usually
you know 25 to 35 000 us dollars so
imagine
getting two p ones uh pretty much like
you earn
50 50 u.s dollars
to six thousand sixty thousand us
dollars
and just you know for the duration of
the car hacking bug bash
which is pretty much like a week or five
days
and then maybe you have some questions
about
why why is there a classification what
if i can just you know
uh do a command execution so when we
when you try to look on the sample vrt
that i've also helped together with our
client or a partner
you can see from there that there's a p3
wherein
even though it's code execution it's
only p3
that's because there is no can bus
private but if you can
execute commands and be able to send
canned messages uh through your code
execution
that's considered a can bus pivot which
is p2
so why why is it that this bug
is rated as p3 and then
this other bug is rated as p2 that's
because
we need to consider in car hacking um
we usually rely on the terra we
we didn't apply this before but we've
seen that
almost all of the automotive companies
right now rely on tara and
for that we usually focus on the kind of
bug
based on the impact of the bug uh how
high can you go
how high can you elevate your privileges
is it only code execution without can
bus
pivot or can you send
messages on the dirty side right and the
exploitability
uh what kind of exploit is it uh how far
you can go as well
and what are the things that you could
do oh what is the attack
surface what kind of proof of concept
can you can you apply for the
exploitability of the bug
uh the proximity how near are you in the
vehicle uh do you need to be connected
to the internet
uh do you need the vehicle to be
connected to the gsm or
to the radio station or the radio
frequency
and of course um just like any cvss
it also relies on the cia triad
not the mafia but it's all about
confidentiality
integrity and availability so
it's pretty much like plc jpfl
so what are the some common checklists
that
are submitted in the book or i mean in
the bug
bug bug bash event and then some common
issue
issues that are submitted when you say
common issues
these are some of the bugs that are
submitted to us
at first or common bugs submitted to us
and are duplicated uh for other car
hackers
because you know it's really common bugs
and it's the
most common uh things that or
bugs that researchers look for
so next up
we'll get to know about this so one one
of the most
common checklists or bugs that are
submitted
and in fact some of this could be p1 as
well or p2 or v3
one of this is being able to send
messages
from the dirty side to the clean side
take for example
being able to
[Music]
do an easy reset or airbag deployment
via the obd2
the infotainment the radio consoles etc
and then are you able to inject uh
disallowed messages in the can bus
uh what if it's not that kind of can
messages
is not really allowed so if you can do
that then it's also rewardable
other common things for iot devices in
the car
are you know of course format string
vulnerabilities to the infotainment
to the radio head unit the bluetooth or
the wi-fi and the radio
and then of course because these are iot
boxes
you might want to check the services
that the these boxes have or these
computer boxes have
um for the telematics the infotainment
or the radiohead unit
if you connect to your car and then you
try to scan the ports or the services
running maybe you can find some
services where you can just get shell
without authentication
we've seen bugs like that previously
telnet ftp ssh
or any apis that you could
connect to and then denial service on
the can bus network using can bus floods
um the common fire fire hose attack
there are a lot of fuzzers out there
dedicated to conducting
their own service on the can bus there's
also a metasploit module related to it
or there's also
a common bash script that i'll be
sharing later on
to do this kind of attack replay or
relay
and roll gem attacks on the key fob can
you do this
sometimes this kind of bug is out of
scope or it's informational because it's
really common
back then but right now because of um
you know some of these attacks are
getting common so sometimes it's out of
scope ready
and then we also have ota firmware
manipulation
which also is related to the
infotainment can you try to reverse
engineer it and replace it with
your own reverse engineered firmware
with malicious
information or code execution
also have k5 cloning are you able to
clone the k-pop then
source code dump of the hardware
that's also one of the common issues
that
researchers are submitting as well and
you are rewarded with a pretty handsome
reward for it it's usually p2
of course the common bluetooth stack
buffer overflow which could
lead to code execution or sometimes just
deny of service or the breaking of the
device
it's also rewardable the breaking of
device of the device is usually p4 but
if you could escalate it to code
execution being able to
run code on it and then being able to
send messages from other decide and
that's
of course a p1
and then uh tencent security la
keenlab has a lot of pocs relating to
this one
there's also uh code execution via the
usb
drive the sd card or the cd drive so
any of the attack surfaces that maybe
your car has
if you can do code execution via this
input devices that's also rewardable
and then of course uh
the sample this is a sample for being
able to send uh
frames on a dirty side via the obd2 or
the onboard diagnostics from the
infotainment system
or other dirty side
the radiohead unit so if if you can then
it might be considered as a broken off
or secure gateway bypass
if the car has a firewall and in fact
some of the cars have firewall nowadays
actually 2018 vehicles from above from
a certain company that i can't disclose
but of course some of you might know
what
what brand is this so if you can send up
this two frames
two frames from the cdf or seven e1 or
any
uh known uds messages
if it gets successful uh the positive
reply from the frame should be zero two
five one zero one if you can do that
it's rewardable so you can get a
a reward for it which is really good as
well
negative responses usually starts with
zero
three which is negative zero two five
one zero one that's the positive
and as an information these two frames
do ecu hard reset so you can
uh do a hard reset to the ecu by sending
to
these two ken frames um
even even though just one one of this
frames from the 7df with it which
is a common arbitration id for uds if
you can do that then
you should be able to do an ecu hard
reset
there's also some of this unauthorized
scan access so
if you are able to find uh twisted wires
that you can
sniff or send can messages and then you
are able to open the car
or do an ecu hard reset
bypass for the firewall then of course
uh that's also rewardable but take note
of the proximity so
uh it might have to be a p1 anymore
because you need to rip off something
but if the war
is something that you could just plug
directly on the back of the card and
you know it varies on the proximity of
the car
this is a sample of a fire hose attack
which is of course a can injection dos
it's a bash grip and then you know send
this
message uh consecutively
under arbitration id 0 0 and then with 8
bytes of data
so what if it works and you're able to
dos the canvas
that's rewardable under p4
and then um of course just like
attacking a web application or a net
network
network on your client you might want to
do recon right
so if you are able to uh do a recon
you can achieve more attack so you can
able to understand what are the possible
attack services
right of the scope so i would advise to
use carrying caribou
which is a python tool a car
security exploration tool that i love
and if you do if you want to do a uds
discovery
uh you can just uh run this tool with
cc.py
uds discovery so you can
uh for this kind of module that carrying
caribou has
i'm actually sending diagnostic session
control to this
uh uds arbitration ids
and that's what you can see
i was able to discover on the ece
simulator that it has 710
7df7e0 as
uds arbitration id and then the reply
for the diagnostic session control is
77a so these are the responses
for the said arbitration ids when i send
something on it
there's also a couple of metasploit
modules
that are available
and of course metasploit is free so
one of them is of course for interfacing
with
the can network you have the hardware
bridge server
and then from there you have
if you're already connected to the can
you can launch canon flood
you might want to do this you also have
a module called pdt which allows you to
check for
and prep the pyrotechnic devices like
the airbag so if you can
actually do this execute this module and
then you're on the obd2
it's pretty much like a gateway bypass
because you were
able to send um messages to the dirty
side
to the clean side so imagine if you
could pop up the airbags or
the battery clumps you can do something
to interact with it
with just the obd2 yeah that's a bug of
course
and then there's also a module called
uh malibu overheat which is a sample
module to flood a temp gauge
on a 2000 2006 malibu and what if
this kind um this kind of
module also affects other cars so
and then cause a denial of service
that's also rewardable
then there's also identified modules for
scanning the can bus
for diagnostic modules then there's also
a module for getting the vehicle
information just as the bin
from the target module and then of
course
a module that allows you to probe
different data points in a can packet
this is a menace button action and i'm
connected to the hardware bridge
i was able to execute the auxiliary
module for the can flood targeting the
uh
virtual can zero just as a poc
and you know it executed the module
and i tried to dump
on the virtual can network and
i see tons of arbitration ids that were
sent
together with their data so
if if you want to practice with the
hardware bridge
uh metasploit modules you can do so with
just
you know um snipping your virtual can
bus
and then targeting the virtual canvas
with the metal switch modules already
available
there's also a good hardware hacking
cheat sheet
by m aaron magesh from payattu labs
this is also very useful when you know
you have test benches that you can
actually rip off
during the car hacking block bash and
you know
especially getting with the ui rt uh
uart
shell uh the open cd and some debug
debuggers so this is some of the this is
really a good guide
and there's also a good uh reference
pretty much like iot hacking on an
infotainment so there's a
there's a good link for massdepweeks.com
serial
i actually have this kind of
infotainment so that's why i
i just you know posted this as a slide
as well
and i was able to get the urt shell
for the shell i mean so
there are some misconceptions that car
hacking is just for car hackers
it's actually not the case okay that's
actually not true
it's not just about iot even hacking
it's not just about hardware hacking
it's not just about radio it's not just
about flex ray hacking it's not just
about canvas attacks
um the sample can bus attacks that i've
actually uh
you know presented a while ago some of
the mess
images that you were able to see as a
proof of concept
it's not just about that web and mobile
hacking
skills are also essential skills
there are android and io ios apps
connected
through telemetry or for interfacing
with the info
infotainment or entertainment system
there are
also update servers when you try to
update your infotainment
or some of the telematics in your unit
so there's firmware updates and maybe
you could try to sniff
or you know perform sql injection
or buzzing on the web
the most common thoughts here are are
how connected is your car does it have
api endpoints so you need to do a recon
and identify
attack services that have web servers
and apis
and all what's top 10 is your friend for
this
web hacking essential skills uh take for
example the os top 10 vulnerabilities
like i said does it have api server
is your car running on a web server so
you might want to try the os top 10
checklist for that
and then burp and os zap is a friend
um you just need to intercept the
request from the mobile app as well if
you have a mobile app and then
you need to check on the update servers
and the pki bridge
i would highly recommend although this
is not related to car hacking
the sqli py burp extension
which allows you to interact with
the sql map api to your birth so
like i said web hacking is an essential
skill so you need to check
if you can manipulate some vehicle
functions with some of the unprotected
apis that maybe your
car is hanging is connecting to or
running
mobile hacking is also an essential
skill um you might want to decompile the
binaries the apk or the ipa
which allows you to interface with the
infotainment or the entertainment system
you might want to use the
genie motion for android emulation and
burp proxy
to intercept the request and then check
for possible clear text database storage
uh like the sqlite database and then you
know
check for the api host intercepted of
course for this os
applies and then what uh there are also
android devices being deployed as
entertainment system or some system
connected to the car
so you might want to check if you could
execute adb shell on it
then you can check for hard-coded api
keys
and it's pretty much like hacking any
other apk files
or you know mobile devices
so repeat and check how the app
interfaces with the car
being able to understand that one that's
a very essential
essential skill you know
for knowledge uh one of the examples
why i always say this is because um one
example is the
nissan leaf fiasco wherein the bin was
used for
authorization purposes in controlling
some of the features
take for example the czech climate
control
the website is is actually reducted for
this one
but the vin number
allows you to check the climate control
and if
you know the other vin numbers of the
car which you can just actually
see from behind the window
and you know check for the vid number so
you can control their
check climate control or you know maybe
control some of the vehicle features so
the whole api
is unauthenticated for this one and only
required event to target the vehicle so
any vehicles
for the nissan leaf uh during uh before
and i give credits to troy hunt for
writing
um this kind of article for controlling
vehicles
vehicle features of a nissan leaf so
yeah
it's not just about can bus attacks
right
mobile mobile and web hacking are also
essential skills
so right all right what if during the
event right now
what if you were uh you're in the bug
bash right now
what's next it's already day zero or day
one
so first you need to read the program
brief or rules in a blog bash
uh take note because um
you need to get to know the scope of the
program and the exclusions of the
program
uh one of the most exclusions there are
the kind of bugs that will be reported
that should not be reported take for
example
uh jps spoofing uh does vs
via can injection so
those are actually uh
you know some of the things that you
might not want to report
and then you need to check on what
security bugs
are of interest to the program so
you might want to check if they really
want to check on the authentication or
firewall bar
firewall bypass can injection attacks
code execution and then what can
messages can you send from the dirty
side so
there are also it's also possible that
in the program brief you can see some of
the known issues that were reported
before and maybe you can find
some bypasses for it
next is do you have any more questions
regarding
the scope or you know you have any
questions regarding
the target vehicles you can probably ask
the program owners
for dbc files which are proprietary
format that describes the data over a
can bus
then maybe you might want to to get the
known issues from before
if it's not set in the program brief and
of course
the vehicle network architecture and
from there
hack the planet so do you have friends
in the event do you know someone
who who you met online from twitter um
or you met them during any other car
hacking conference and you know that
this guy has
a talent same as you or maybe this guy
could help you with some of the tools
that you have
so how about you team up or collaborate
and i've seen a lot of car hackers who
have succeeded by
doing so so there was this uh
one hacker wherein he doesn't have this
kind of tool
and then so he team up with that guy
and they work on together and they were
able to
open something from the car right
they were rewarded with 25 000 us
dollars for that
okay so yeah like i said uh it's all
about collaboration
or helping each other okay
if you want to chain about together then
yeah
team collaboration is great so
next up is red you already found a bug
so how do you write a good report
so you need to write clear reproduction
steps
here's a sample so you need to describe
what is the vulnerability
sample the infotainment is vulnerable to
a dos brick
caused by format string values via
bluetooth
here are the reproduction steps step one
rename your phone to
person p person p percent p
person p blah blah blah blah then
connect your uh
second step connect you or pair your
phone to the infotainment via bluetooth
uh third use the navigation buttons to
control the infotainment
and it should remain stuck which means
you were able to break the infotainment
system
okay then give more information
like i also tried restarting the
infotainment and this does not resolve
this
this issue it only works fine after
doing a hard reset
and of course attach a screenshot or a
video
i would like to give a shout out because
uh
you know credit to this people
for my inspiration of this stuff so i
would like to give a shout
shouts to carnhacking village craig
smith
for the book of course uh ian sabor car
uh will corona fronders techmaker ua
asrg or automotive security research
group
asrjsyn or asrg singapore and of course
spectres
jammy and semprix and of course the uh
cdp.com for the article that i rip off
uh you know just a proof that
you know tesla actually gave out 35 000
usd
to hackers at the phone to own event and
also
rewarded the duo with a car
if you have any questions just message
me on twitter i'm on twitter
at chip code and then you know
or if you're my friend at facebook you
could also message me
so stay tuned for defcon and
you know i hope that you will enjoy
other apsec
uh villages uh talks
as well