hello everybody
my name is jay turla and i'll be talking
about
bug hunter's guide to bashing for car
hacking bug bash or contest
okay so who am i uh i'm jay torilla or
ship code um jetman and ruthcon
uh i'm a security ops manager
from the philippines at bug crowd and
i'm a i'm also a rude gun goon which is
a
hacker conference in the philippines and
also with cfb review board
i'm not the author of touring malware
despite my
family name i'm not even russian i'm
filipino
so i'm also one of the main organizers
for
the car hacking village at rutgon and
the philippines or
carhack village ph so i
i've also contributed to metasploit uh
some auxiliary and exploit modules so
from time to time before i contributed
some modules
and actually the last module that i've
contributed
is related to car hacking or
the msf hardware bridge which you could
use for
you know hacking your car
so um about this topic
it's actually not a mental health topic
so it's
but the purpose of this is to encourage
other bug hunters especially
application security hackers or
researchers
to hack cars you know to invite them
that
they are also welcome to try out car
hacking even though
they might only know web or mobile
hacking
so there are tips and tricks that i'll
be
showing showing in the presentation and
also some preparations to do for day
zero
which is uh
a day before the event or the bug bash
or the contest
so there are also some
tips and tricks to focus for
the bug bash and also to clear out
misconceptions
that car hacking bug bashes are not just
for
hardware and car hackers right
like i said there are there are a bit
tips and tricks but there will be no
demo
for nda purposes because some of the
demos
usually for you know bug bashes
have nda so and lastly
it's more about my experience as a tree
edger
for car hacking bug bashes so my
experience really
i've learned a lot from my experience as
a car hacker myself and as the one who
triaged
bugs that were submitted to a bug bash
where the company that i work with
so yep as a summary it's really
how to succeed in in a car hacking bug
bash
phone to own um any hacking contest that
involves hacking cars
and as what you can see from the picture
uh
you got spectres and
ian's aboard or mintenet and some of the
guys that you may be familiar with who
are in the car hacking village or
car hacking bug bashes and
the guys that that you can see in the
picture are actually successful
in being able to hack some of the
components of the vehicles or
some of the uh scopes of the
of the bug bashes so
this picture tells collaboration between
teams real
all right so this is a sample picture of
the car hacking blog bash
sample payout so two years ago we've
actually paid
224 hundred thousand us
dollars and you can see some of the top
uh car hackers the private user that you
can see
is uh wrong one and
um he choose to be anonymous but
if you go to the car hacking village you
might be familiar with him
i just don't want to you know spoil the
fun of
you know challenging you who that guy
might be or
uh maybe you want to guess him but he's
really a good car hacker
and then this is a sample clippings that
i got from zitidet
from the pawn to own contest so as what
you can see
a researcher duo who hacked tesla car
win the competition's overall standings
they also get to keep the car so imagine
that
team florist eight made up of amad kama
and richard
zoo hacked the tesla car via its browser
they use a
jet bug git bug in the browser renderer
process to execute
code on the car's firmware and show a
message on its
entertainment system or infotainment
system
as per the rules announced last fall the
dual now gets to keep the car
so which is very interesting you know if
you also get
the car itself from the car hacking bug
bash
so they also receive 3 500 35 000
us dollars as a reward so aside from the
car
they also get 35 000 us dollars
which is really good
so i guess this might you know encourage
some other hackers to hack cars as well
so the question now is what if
i am not a car hacker yet what if i'm
still starting what if i want to start
in
hacking cars so no need to worry about
that
i got you bud
uh first of all my favorite book about
car hacking is the car hackers handbook
a guide for the penetration tester by
craig smith
you could also go to the online version
which is for free
but if you want to buy the ebook or the
paperback
um it's on amazon or other
um bookstores that you could actually
buy i got the
back myself and it has a sign from craig
smith
so craig smith is really a good guy and
in fact
i've learned a lot from his book itself
there are also some good car hacking
resources which i want to
reiterate if you want to start your car
hacking journey or your
if you want to prepare for bug bash um
the first one is of course the nano can
which is
you know a five dollar car hacking or
can bus hacking tool that you could
actually
solder or play with uh i actually got
like
a lot of pcbs of them and also
i also got my own which i soldered and
also
mintonette gave me the
his version from a conference and
b sides i forgot the name but i got that
one
and then if you just go to his github
link you can see
the uh some of the sketches and also how
to create
the pcb or replicate the pcb
and then there's also a link from the
carhackingvillage.com
about getting started with car hacking
it's pretty much
like how to get started with
the can utils and you know
some techniques that you could use with
the can utils like ken stuffer
um kanji and also some of the can util
tools
and then of course
another tutorial by ian sabor
on a conference can bus basics with
hands-on fuzzing
the reason why i reiterate this because
ian subor simplified it
and also because um he has a good
hardware to practice with
in that song and
many of you may not know but ian aboard
is one of my mentors for car hacking as
well
and then next up we have a curated list
of awesome resources
books hardware
uh utilities tools people to follow
in the car hacking or automatic
automotive security field and then of
course uh
because car hacking also made an
inspiration to me to start car hacking
to start hacking cars i mean car hacking
village videos
it's in youtube as well so you could
visit that one and of course if you
are in a hacker conference please do
visit
it's car hacking village there are a lot
of hacker conferences right now
that have car hacking villages in fact
even in uh in my
country we started the car hacking
village we started from start
we've got simulators um
some um virtual
virtual boxes for running virtual cans
and also
some instrument clusters and some ecu's
that they could play with
and in other countries as well they
really
beef up their car hacking village in
fact some of the
conferences right now have their own
cars
that they want to show for car hacking
or
for other people to play with um
i myself i got to play like
i think that was like four years ago or
three years ago
with with a car that was presented in
the car hanging village in defcon before
and then there's also a good link
adventures in building a can bus differ
uh from tech maker ua my friends
founders
and uh the guys from techmaker ua they
are also very good
uh car hackers i've seen them how they
hack
i've seen how they got
some good prices and rewards for their
uh hacks that they did on a car hacking
blog bash
and the technique is you know
understanding the can bus and also it's
all about
teamwork and collaboration
[Music]
and then next is um
really how i started back in the day the
first thing that i did
it's really about baby steps and i think
you can also do it as well
first thing that that that i did the
first thing is
of course uh playing with my
infotainment system on my car
and i was able to you know uh
create my own poc and being able to
execute
command injection on the infotainment
system via the
universal serial bus or usb port and
then from the left side
i started with playing with an
instrument cluster which was given to me
by
um internet and then i used nanocan and
other
slcan devices to play with it
also uh the second cluster that i played
with was a master
instrument cluster which i myself and my
friend you know play with
it was really fun so i learned a lot
from that experience
so i know that a lot of guys started
with virtual can
based on the talks that i've seen from
other countries
i would i would really advise to start
playing with an
actual instrument cluster or you know
hook it up with an ecu or play with your
infotainment system but
you must know the risk of it
[Music]
and then of course like i said there are
some simulators that you can play with
uh you've got the uds simulator by craig
smith
you have the icm simulator by craig
smith
and also you've got um
there are actually hardwares that you
could buy for
an ecu simulator which you can see from
the left side of the screen or the
picture
that you can see when it has um
protocol and then you can see that the
mileage is off
so this is actually a sample ecu
simulator that i bought from taiwan
and i bought it from tmd it's
not really much of that you can play
with but it's a good thing to start with
so but if you want cheaper one i would
really advise
instrument cluster which costs like
twenty dollars
thirty dollars or forty dollars and if
you want to have
your own ecu kit it just costs like a
hundred dollars or a hundred and twenty
dollars
in ebay there are a lot of things that
you could buy on ebay in fact i've been
collecting
collecting some vintage computers as
well from ebay
uh uds server is one of my favorites as
well it allows you to
understand if you try to fuss the ecu
so craig smith did a good one on this
and also the instrument cluster
simulator
these are uh these tools are our
utilities are available in github for
free so
you know you might want to check it out
so like i said uh my main inspiration
really is
the car hacking village and um
when i first went to defcon which was my
first defcon was actually defcon 24.
and well i was just amazed
but this picture is actually from defcon
25 or 26
i think i took the picture myself
and there are actually some good bench
test bench that you can play with setups
that you can play with
so it's it's it's really fun that if you
visit the car hacking village
and then um my advice if you really want
to start
you know playing with the cannabis
network or
the other protocols of the car
i would suggest to embed invest or
acquire some tools required for
interacting with can
so here are some of the samples that i
have
i have a value can i have the canvas
differ by attack maker
i have nano can and
a p1 from
machina p1 so there are actually other
tools that i have in my box so i have my
own box
which contains some of the tools i used
for
playing with my car
so there's also some
open source tools that you could uh
start playing with so if you go to car
hacking tools by jay gamblin
um it's on github if you just clone it
there are
some tools that you could use with it's
a collection of scripts to help jump
start car research and hacking
and all the scripts are designed to run
on ubuntu
debian and kali and then
from the right side of the screen you
can actually see some of the tools that
are
in there
and then uh from what i usually see
from car hacking bug bashers
these are the common enterprise tools on
the block that they use so we have the
vehicle spy
and canoe right i don't want to promote
the product but you know
for we these are also good enterprise
tools and
i've seen a lot of guys using them as
well
then um like i said
car hacking bug bashes are not just for
car hackers
it's also for hardware hackers iot
hackers
and if you're good in network fan test
you could also bring some of the tools
that you used for
penetration testing and
i would like to reiterate that you need
to
prepare yourself and bring some of your
hardware hacking tools
or network hacking tools or pentas tools
in fact you can see from the box there
that i have a pineapple
i also have the hackaraf
alpha and also some canbus hacking tools
and zigbee device and also
some you know getting it getting with
hardware hacking to interact with the
uart
and some other hardware
uh you know instances that you can play
with
these are the sample ratings or common
classification
from bankroll.com vrt or the
vulnerability rating taxonomy um i'm one
of the guys who contributed to this one
which is actually open source
this actually serves as a guide
and for car hackers about the priority
of the vulnerabilities that you can
submit
to a car hacking blog bash or a contest
and so as you can see the first
uh the first one that you can see there
is the p2 leakage
and or the pii linkage i mean i'm sorry
about p2
and it's under p1 which is a critical
vulnerability
and then if you have key fob cloning if
you could
clone the key fob on the fro from the rf
hub
we consider that one as a p1 and
if we could execute
command injection from the infotainment
the radio
head unit and then you are able to
uh go to the can bus
you you do a can bus pivot or pivot
so that we consider that one as a p2
and if there is no can bus pivot just
command injection
it's pretty much like p3 and there are
also some
can injections that you could refer to
take for example
the battery management system the
steering control
uh the pyrotechnical device development
tool the headlights the sensors
uh it's pretty much like p3 if you could
interact with it
we used to have this as p1 but
um we did some classification we
reorganized it
with a classification together with our
partner and we decided
it would be a p3 based on the tara or
you know
threat assessment that we have but
what remains is of course if you could
um you know do key fob cloning
ota firmware manipulation that's p2
do a code execution or a can injection
from the rf hub that's considered as p2
so if you need to go to
background.com vrt you are free to do so
it's free open source in fact any car
hackers could also contribute to the
github
so that they can suggest some of the
attacks that
can be done from the car
next up is wait what's this
classification
so i want to simplify it the reason why
we have those classification is because
we want to assess
the attacks that are done of course
we we used to have
an incomplete task of prioritizing
car hacking bugs or automotive security
bugs
but right now with the improvement for
the vrt for automotive security bugs
we've classified it based on
the impact of the bug the exploitability
of the bug
the proof of concept that the hacker
presented
the proximity of the attack and also the
cia triad
no not the mafia but it's the
confidentiality
integrity and availability so we also
consider that one take for example the
pii leakage so
um of course the more ranking of
the confidentiality for that because
those are
personable identified identifiable
information
and this there are other things that we
classify
and it's part of our threat assessment
and rumination analysis or tera
so p1 is critical
and p4 is low
and if it's p5 it's pretty much not
rewardable or out of scope for
a car hacking block bash
here are some some common checklist or
common bugs or common issues
the reason why i put this one on
on the slide is you know to give some
information about
some of the common checklists or hacks
uh the car hackers do first before
anything else
um one of the things that they do
usually
is to send messages from the dirty side
to the clean side
and most of the these are ready to ecu
resets
uh airbag deployment via the obd2 for
example
uh infotainment radio control controls
etc or radio
head units so if they can send messages
from the dirty side to the clean side
that's something that they usually look
for because
they just don't know maybe they will get
rewarded and
in fact um two years ago for this kind
of hacks
uh the rewards are pretty much like 25
000 us dollars just for this um
you never know uh you also
get to find these kind of attacks but
the problem is in a car hacking bug bash
these are the most common ones that are
found
that means that um it should be the
first reporter who should be rewarded
so the chances are if you are not fast
enough
to do this uh someone could get
uh could beat you and your budge
will just get duplicated right so it's
pretty much like
um always create a better plc
and then submit it right away
okay so you need to submit it right away
with a good poc
next is injecting disallowed messages in
the can bus so
these are also some of the common things
that they do
so they inject the salad messages which
can or which can cause a denial service
or
interact with some of the uh components
or
attack services of a car
and then um of course th this one uh
uh so far uh i've seen like
two submissions on this or four
submissions
and previews uh car hacking bug bashes
but these are actually known hacks and
i've seen
uh some friends at from china
who've actually submitted this one as
cvs for
other cars and then in fact bmw
has some cvs related to this one and if
um it's found by
someone from i forgot i'm sorry i forgot
but it's a known company as well but
format string vulnerabilities to the
infotainment radiohead units
uh via bluetooth wi-fi or radio
these are some of the common bugs so and
also
are very easy to replicate and also very
easy
to conduct so or you know uses a proof
of concept so if you
take for example name your cell phone or
your wi-fi
to point
point zero zero or uh percentage
x percentage x percentage x and then if
you
let your car connect to it and it costs
the of service so that's a sample of a
format string
vulnerability or attack
and then we have no authentication at
services for telematics infotainment
infotainment radiohead units so
it could be that if you connect your car
to the internet or to your router or to
your isp
and then if you try to you know do a
recon
and use nmap to scan for the services
some of the most common things that you
could discover
are no authentication when you do a
telnet
to one of the services like for example
on port
uh 23 which is of course a telnet and
then there are also some ports wherein
if you just use
netcat uh you are taken to a shell right
away so
those are some of the common uh common
things that are found and
if you're not fast enough your bug will
get duplicated
next is denial of service on the canvas
network using can bus floods
the fire hose attacks so there are if
you could
somehow cause a denial of service um
it's also rewardable but in some car
hacking bug bashes or contests
it could be uh out of scope so you need
to read the scope for that one
uh replay relay and roll jump attacks on
the kifa
in most car hacking bunk bashes they are
considered as p5
but you never know maybe uh in some
contests they are considered as p4 or p3
so you know maybe you might want to try
your luck but
be sure to read the program brief if
they are out of scope
and then i'll say firmware manipulation
it's also one of the common bugs that
are submitted
um key fob cloning source code
source code dump not just the ecu but
of course some of the hardware for the
infotainment system the radiohead unit
and other
um hardwares that are in there
especially for example the security
security gateway which are considered to
be firewalls
you know for the cars
then um bluetooth stack buffer overflow
which leads to remote code execution
i mean to code execution so
uh tencent security keenlab have a lot
of proof of concepts on
on this from their blog so if if you
want to
visit their blog they have actual
good proof of context uh proof of
concept about
buffer overflows related to the
infotainment system
and other system as well
and then code execution via the usb
drive the sd card sd drive etc
so these are some of the common
checklist or
bugs next up of course this is a sample
tip if you can send any of these frames
from the dirty side
so take for example the obd2
or the infotainment system if yes
it is considered as a p1
or considered as broken off or secure
gateway
bypass if there is an sgw or secure
gateway
and then these scan frames
um 7df or 7e1
if you could actually do this and then
how do you know if it's successful
this should be the positive reflex from
the frame so you have zero two five one
zero one
and the negative responses starts with
zero times zero three
and um the this actually allows you to
do
ecu hard resets on the car
yep if we could do this on an obd2 port
that's something that we re we reward
and then if you could somehow interact
with
unauthorized scan access i got this
picture from black hat and
if you could actually find some of the
things you know
an authorized can access and then you
interact with it
you may never know what you can discover
as well
this is a sample of a poc for a fire
hose attack
uh we're in a bash strip
you send uh
the arbitration ib00 and the
um zero zero data
so maybe you don't know that you could
also perform can injection or denial of
service
next is one of the tools that i really
like which i
discovered from the car hack car hackers
handbook
if you are sad or if sad with you uh the
the ideas that you found that you could
try
or recon and do a uds
discovery with caring caribou it's open
source and you need python 3
and make sure to install python can for
python 3 so that it will work
uh if you have problems with making it
work
just message me on twitter
of i really like to play with it and you
know
i fix most of some of the people's
problems with it
but it's really good it's one of it's
one of my
favorite tools for uds discovery and in
fact there are some
some of um util
utilities you can do with uh carrying
caribou
it's a car exploration tool
so you can do uh there's also a command
that lets you do an
ecu hard reset on it or interact with
xcp so might want to
clone carrying cardboard right now
and then of course uh
people think that metasploit is
you know nothing that you could play
with for card hacking
but people are wrong about it
if you go to automotive
you use the command search automotive
with metasploit you will find
some eight modules that are written
geared towards car hacking
and of course you need the hardware
bridge server for it
and also the uh
you know you need to
interact with the can to play with it
so there there's the can flood which can
be used you know
to perform uh denial of service on the
can
and then there's a module to probe
different data points in a can packet
get the vehicle information such as the
vin from the target module
uh scan bus for diagnostic modules
and then there there are you may you may
want to consider it
as an auxiliary module that allows you
to
flood the temp gauge on a 2006 malibu
and maybe you don't know
maybe you could also cause a dos if you
try to
work it work on it on some some of the
cars
uh that you can play with and then
there's a master ii instrument cluster
accelerometer
mover which i actually created and then
um this uh the last one is
uh the pdt module which allows you to
check for prep the pyrotechnic devices
the airbags
battery clamps etc and it allows you to
deploy airbags
if it's vulnerable to the simple
algorithm in unlocking the
airbugs through the can so there's a
good paper about it
in fact if you use the info from the
module
you will see the actual pdf file that
contains
the research about it so if you want to
try playing with it
you can fire up your virtual can and
then you know
um use the modules to see for yourself
some of the sample attacks you know
in the can bus network
and here's a sample i used the uh
can can flood and then
just a sample on a weekend zero which is
a virtual can
and when i tried kanda these are
some of the things that i can see from
the dump of the can bus so
you can see that there are a lot of
arbitration ids and then some subsets of
data
or different kinds of data being thrown
in so
that's just a sample and you never know
maybe you could use it
there's also a good hardware hacking
cheat sheet for hardware hackers out
there
it's made by m aaron magish i
saw this one in a sphere and i decided
to
place this one of course credits to him
these are some of the things that you
could play with um if you have some
if there are some hardware that you
could rip off
during the car hacking bug batches which
is actually true
there are some hardware that will be
given to you that you can play with
so you know fire up some of your
hardware hacking tools with it
and then there's a good guide for
example
um there's a link on it
from the mass that weeks which is on a
master infotainment system
uh we play with in getting a shell so
you have the rxdx and the ground where
to place it so
uh this serves that you could actually
play with
some of the infotainment system because
most of them
are have uart on it or
other hardware hacking for referrals
so this is one of the things that i
would like to reiterate
car hacking bug bashes
it's not just about iot hardware radio
and can bus attacks
web and mobile hacking are also
essential kills
uh skills i mean android and ios apps
connected through telemetry or for
interfacing with the infotainment
these are some of the things that you
could hack update servers
firmware updates cloud for example
you need to think how connected is the
car does it have api
endpoints so how do you do that if
you want to try it so you need to do a
recon and
identify attack services that have web
servers and apis
and what you're gonna do with it of
course the os top 10
right because the os top 10 is
everywhere
so maybe there's a web server up or
there's an api that your infotainment or
one of the mobile apps that your car is
connected to
has it connects to a certain api
maybe you could do sql injection on the
update server as well
or maybe there are some things that you
can do with
the update server called command
injection so they are
somehow could be part of the scope
and then web web hacking essential
skills you have
the oas often vulnerabilities burp and
os is a friend
um you need to you know try intercepting
requests
from the mobile app the update servers
and the pki bridge
and i would highly recommend sqlpy burp
extension
it's a good tool for automating your
sql injection attacks in burp and
another thing that you can do is if you
could check if you can manipulate some
vehicle functions with unprotected apis
all right so these are the reasons why
web hacking is essential
another thing is mobile hacking is also
an essential skill
so you have the apps that you can
interface with
you know your vehicle so especially with
the infotainment system or the
entertainment system
so you need to decompile the binaries
the apk or the ipa
and then i would recommend genie motion
for android emulation and
so that it's easier for you to intercept
the request
via burp proxy and then
another thing that you can check with is
to check for possible clear text
database storage
like the sqlite database so if you could
find um information
that's actually one of the bugs we are
looking for
and then yep all was really
applies to this as well because you can
intercept the request
from burp and then adb shell is love
if um there are some android devices
connected to the car especially the
infotainment system so why don't you try
to fire up adb shell
and then always check for hard-coded api
keys when you
have a decompiled binaries for apk or
ipa you never know what you can find
really
so the last one
is to repeat and check how the app
interfaces with the car
and if this is not enough uh
go to the os mobile checklist or
top 10 there are some things that you
can learn for mobile hacking
especially for apps attackers who are
not into mobile hacking
so here's the sample for example
um i'm not sure if you guys remember the
nissan leaf fiasco
but the problem with that is the vein
the vin was used for authorization
purposes and controlling some of the
features take for example the check
climate control
so the whole api is authenticated and
only require the bin
to target a vehicle so the url
domain is redacted but here is a sample
um request a get request that
if you have the complete vienna of the
car you could actually control some of
the features
of the nissan leaf which is a hybrid
which is an electric car and this is a
sample of being able to
do the check climate control and then
you are given with the response
and from this you can see that the whole
api is
unauthenticated uh
if you go to the link below credits to
try hand you can see some of the
things that were done in assessment of
this
so yeah web hacking is an essential
skill
next up what if you're in the event
right now
okay what if you're in the bug bash
right now it's day one
you're scared okay because you don't
know some of the people
but yeah really most of the kayaking bug
batches
they really know the people but um
it's just that maybe some of the people
there are two or three or five people
that are actually new to the car hacking
block bashes
or new to car hacking so but
car hacking is a uh is really a small
world because
um in a car hacking village i think most
of the people that i met there
i have seen in some of the car hacking
bug matches as well or contests
right so the first thing that you need
to do is
you need to read the program brief or
rules in the bug bash
all right take note of the scope of the
program
and then um you need to focus on the
scope and exclusion of the program
take for example these are the common
ones that are out of scope
gps spoofing uh denial service via cat
injection
no i would like to reiterate that please
don't
uh submit out of scope bugs if it's in
the brief
no need to submit about it you could get
penalized for it
so um
the program brief also contains some of
the things that you may want to look for
so it could be that the program reef
would say that
we want to look for firmer
ota manipulation how you can uh
reverse engineer the firmware so somehow
it also gives you
an overview about what to hack okay it
also contains
take for example we want our
gateway to bypass here are some of the
things that you can do
so those are some of the things that you
can read from the program brief it also
gives you
somehow common attacks that you can do
with a car
and then check on what security bugs are
of interest to the program
so you have the authentication or
firewall bypass
can injection attacks code execution and
again what can messages can you send
from the dirty side
so these are one of the common ones
the program brief also has this kind of
information
so that's why always read the program
brief or the rules
so do you need more um
if you want more information maybe you
could ask the program owners or
the ase assigned maybe you could ask for
dbc files
which are proprietary format that
describes the data over a canvas
known issues and vehicle network
architecture
so in some cases they would provide the
vehicle network architecture
and in some cases as well they could
provide known issues that were submitted
before and maybe you could
somehow create a bypass for it if it's
fixed
maybe create a bypass for it or submit
it again and
check if you can do another technique
related to
it do you have friends in the event
if you're in the event how about team up
or collaborate
one of the things that i notice is some
of the most successful or
bugs were submitted involve
collaboration
right there are um in fact there's
there was a team before they were
composed of
i think more than five people and they
submitted
more bugs right than other
than other um than other players or than
other
teams but you know it's really good
because
it has something to do with
collaboration teaming up
and then you know they got some good
rewards as well that they could
you know just split up so take for
example
uh they got a p1 and they're
only two so pretty much like
what if they got thirty thousand us
dollars as a reward they can split it up
for
fifteen hundreds us dollars right
so it's all about collaboration i've
seen some good collaboration
and if you want if you have tools that
are
um that you don't have maybe you want to
get that guy and collaborate with
right and if you think that there is
something that could be done with
um the radio and you don't have much
information about the radio but you know
a guy that
probably knows more about radio security
then maybe you could
team up with that guy all right i've
seen some
people collaborating even though they
don't know the person
or they just heard of the person or
they've noticed
that person playing or poking something
during the car hacking blog pass
all right don't be shy make friends
so next up is how to write a good report
all right you need to to submit clear
reproduction steps this is a sample
so you need to describe
the vulnerability and you need to
enumerate the replication steps you need
to make sure that it's easy
to understand for the triager or the one
that will be handling
the report so they for example rename
your phone to blah blah blah
connect your pair your phone to the
infotainment via bluetooth
use the navigation buttons to control
the infotainment and it should remain
stuck
with which means you were able to break
the infotainment system
and then um provide another information
i also tried restarting the infotainment
and this
does not resolve the issue it only works
fine
after doing a hard reset blah blah blah
blah
and then make sure to submit a
screenshot or a picture of the bar
right if there is a picture
it's easier to reproduce as well if you
have a video
attach a video all right don't let the
tree edger
left in hanging when you submit a report
all right
make sure you include all the poc steps
easy to understand pictures
and also videos if you could reproduce a
video
right or also provide
candom plugs okay
or logs for the attack
right so for anything else i would like
to give a shout out in credits to
the car hacking village community uh to
justin
um to craig smith who has been my
inspiration
ian zaboor my mentor car [ __ ] whom i
met
in a lot of events also a very cool guy
will corona fronders
the guys from techmaker asrg they have
tons of good resources
asrg singapore my friends as well
uh spectres um i've met this guy
and you know he's a cool dude and he has
a cool team too
and then jamie who is my friend and also
to semprex the founder of rootcon who
are my supporters in
my car hacking village and of course to
the zdanet.com
wherein i rip off one of the articles
for ponto
so shout outs to the to these and
i won't be in this industry or i won't
have this kind of resources
without these guys and the link that you
can see from there
so if you have any questions
let me know i'm in twitter
uh you know i'll be seeing you all
in defcon right
you