thank you
and thanks for coming to my talk from
ctf to cve
and uh going to talk about this uh team
we call charity case
and a little bit about how i
accidentally hacked a telematics app
with a little bit of knowledge you too
might find a vulnerability
who am i i'm just some guy named will i
i lead a team we call ourselves charity
case
i'm a ham operator and you're going to
know when you meet a ham operator
because i guarantee within five minutes
of meeting them they're going to tell
you their ham operator
it's it's kind of like an unwritten rule
uh so my call signs kilomike six echo
uniform victor
i am wearing a radio throughout defcon
so if you want to reach out and hit me
up
i'll be on two meter call line frequency
you can call my call sign
i'm also a ctf team lead for a few
different years
at def con's car hacking village in 2016
i won a little drone with the help of
one other person
in 2018 a group of people that i
literally met at defcon
we all grouped up and uh we won an atv
2019 i want a tesla model three and
that's a picture of it right there
if uh if you were here you'll know that
this car was beat up and by the time we
left it had no hood
um and that car
also got drawn all over it's been great
we've had a lot of fun with it we've
donated and done a bunch of stuff for
charity because of that car
29 2020 we won also a trip to 2021 def
con which we are doing in 2022 because
of uh the hybrid nature and
ohio folks not being able to come out
this year
i'm also a car hacker at least i like to
claim i'm one
i've got a couple cves you can check out
cve
2017 6052 and two oh one seven
six oh five four both are for the
telematics system we're going to be
discussing today
from a uh we're gonna refer to them as a
oem for the rest of this talk they did
ask that i
i don't name their actual name
there's also icsa1711503 which this is a
fun one for bar tricks and other stuff
when people say something unique uh
or if someone says are you on a list
because you're a hacker and i have to
respond i'm pretty
sure i'm on a list but not because i'm a
hacker but because
there's a homeland security article that
references one of my hacks
i used to be a cartooner and i say used
to be because i work infosec full-time
but for a brief part of my life i worked
full-time tuning cars my office was
a car usually a corvette a cadillac
cts-v
a camaro one of those guys something
with an ls powered motor
and i made him go really fast i worked
on a six
second car um i was the main log review
guy for that car and i did boost stuff
and then i had a bunch of other records
i did all by myself such as on the
camaro and the trailblazer ss
and currently i know i say i'm retired
from tuning but i still
work on uh the world's fastest kia
stinger and we're running 11s in that
right now
verified at the strip one of the
one of the neat things about that car is
it's being tuned in one of the more
hacked
methods i personally hack everything in
my life like everything is a hack
i always like seeing the how do i make
something do what it's not supposed to
do in a weird way
and when we tune that kia that's exactly
what we do we're using piggybacks
and we're lying to the sensors and
shifting voltages
to make the car think it's doing one
thing when in reality it's doing another
um really fun stuff the cartooning is
what really gave me
my first understanding of how can bus
worked in obd
and what systems did inside the car i'm
also really big in the self-driving
stuff
uh i drive a tesla not the one you see
in this picture but
a different tesla um i
love fsd though i think elon's a little
bit too aggressive with some of his
stuff
uh level five isn't going to be here any
time soon
i also worked on kama ai projects so the
first one i did is i was an alpha tester
on the key stinger stuff
which meant i had to build a harness
with just wires and a soldering iron
and i had to reverse
the can bus messages to figure out
certain things like steering
angle degrees and things like that and
we learned things for example the
steering angles are different on an
all-wheel drive versus a rear wheel
drive
so the first time i loaded the software
the car felt like it was drunk
where the other person's settings worked
perfectly fine for him
we figured out what that was with some
can bus knowledge and uh we're able to
fix that
i'm currently working on um my wife's
explorer st
she would love to have comma ai because
she loved it in the
kia so we're we're going down that path
right now
seeing what we can do there there's uh
some issues we ran into but
apparently a guy has a hack and when i
hear a guy has a hack i'm always on
board
um i also did something else that's uh
kind of unique
apparently i i didn't i considered a
python script that just scored things
and learned off of things but
uh if you read the pattern they call it
machine learning
um i i worked on a patent for detecting
bots inside of games based on certain
components
um if you want to read more about it
it's called system and method for bot
detection
it was while i worked at the place that
was why i wasn't at defcon
2017 and that's a very important
interlude to
me being autistic and never remembering
which way i'm doing something
uh i am on the spectrum um i would have
been
i used to be classified as aspergers but
in dsmb
dsmv it's now autism spectrum disorder
and because i'm a high functioning
person and have the savantness
i like to speak for those who can't
because i understand
what the sensory overload is and how it
feels
and you know what it does to you so if
you want to help out
if you take a take a picture of that qr
code right there
you get the opportunity to donate via
gofundme and it goes directly to autism
speaks
i'm not taking anything from this i'm
doing it 100 for charity
so we got a word of warning there's a
reason i wasn't at defcon in 2017
and that's because i found a cve um and
and that may not sound like it makes
sense but
here's what happened for me uh and why i
have this word of warning
i spoke to my work i told him what i was
working on i told him i thought i found
a vulnerability that could be a cve
and this is before i ever tried to
engage uh the oem
um my work was super supportive my my
boss and my boss's boss were like
yeah awesome fine good bug you know uh
there was like you know congratulations
and things were great
they had one requirement and i stuck to
the requirement which was
they did not want me to speak to the
media and i did not
at all unfortunately when you do a bug
find a bug like this and it's
so widely seen and it has such a wide
effect to things that people don't
normally
like think about or things that are easy
to make uh
sensational um it's gonna get picked up
by the news
my event was picked up by
most of the major news articles pc world
tom's hardware it was super neat to see
my name on those sites because these
were all sites i've read for a long time
when that happened the executives at the
work were not happy
at all um very unhappy to be honest
and they took actions against me because
of this
one of the actions was a verbal dressing
down which i didn't enjoy
uh the next was
they prevented me from going to defcon
and told me if i did go
it would be bad for my career um they
were
sure even though i told them that i
wasn't going to they were sure i was
going to give a big
talk at defcon and whatever and i i
didn't even have
like i hadn't even read the talk at this
point so they were just worried about
nothing
because of all this when i got invited
onto gma good morning america
i was not able to accept because i had
agreed not to talk to the media
even though they hadn't kept their side
of the deal i was keeping my side the
deal
so make sure if you're gonna do this
make sure your employee's okay with it
get in writing
you know i can't stress this enough
before
giving your talk make sure the vendor's
okay with it
unless you don't care and you want to
burn bridges i personally don't want to
burn bridges i still have a great
relation
with my vendor i still talk to them on a
regular basis i'm going to be meeting
them for dinner
actually here during defcon i believe
the only reason their name isn't in
there in here is because they asked me
not to
and i kept to that and that way we have
a great relationship if i decide to do
any more research on their cars in the
future
only hack your own cars and items
there's a caveat to this you're a defcon
you're in the car hacking village
there's all kinds of things around here
to hack that you have permission to hack
do that and responsibly disclose
so this isn't the don't try this at home
warning this
is the cover your butt warning get in
writing
make sure your vendor's okay and hack
your own things
it's it's inevitable when i tell
somebody i run a car hacking team for
charity they're like look at me crazy
like cars can be hacked and they like
point to some 90s car
and you know i look at it and go yeah
cars can be hacked modern cars are
basically uh
alexa with wheels they're iot devices
they've got
networks some of them are interconnected
to the internet i mean they're they're
every bit as a hackable device
as your laptop some in some ways more
the next question is always why would
you hack a car what's the point
and this one's my favorite because to
make it faster was always my response
back in the day because that's what i
did
when i was hacking on cars i was pulling
the roms out and modifying the ignition
tables and fuel tables
and optimizing them for the parts to get
optimal performance
you can also do things like enable
hidden features
on dodges for example you can enable
srt pages on cars that are not srts
you can add features let's say you got a
bmw they call
coding you could do something like add
a radar cruise system
and then you just code the ecu for it
and it works
pretty neat stuff and last but not least
is
i like to hack things for the fun of it
i enjoy the chase
so i'm going to talk about the attack
surface because i mentioned that
attacking cars
is uh actually easier than a laptop
because the attack surface is
insane and some of them they never
really thought about security on
so let's start with the obd port the
obd2 port
is where you can do data logging you can
check codes
depending on the manufacturer and setup
you can flash modules
you can send can bus messages it depends
on the layout of the car every
manufacturer has a slightly different
setup
um you know you'll have to look into
your specific manufacturer
you can tap into the can bus at
different points in the car for comma ai
we tapped into the can bus at the camera
that was up by the mirror
on the oem car
usb ports now i'm going to pick on mazda
or mazda was genius
so either mazda did this on purpose or
they just sloppy
but you could basically put some scripts
on a thumb drive and plug it into some
of the mazda
telematics units and you could get root
access and do things like load android
auto
so if they did it on purpose thumbs up
to you mazda if you did it on an
accident
improve your security team removing the
ecu this is what i spent
years doing full-time uh flashing the
calibrations
um there you know not just performance
things can be done you can make them
faster but you could also do security
implications
for example you've got a new shiny car
that has a transponder based key
and you have an ecu that expects that
transponder base key what if you just
turn all those features off and make it
so it'll start with any key
that's a thing you can do some
manufacturers have been really sloppy
and left
root logins just laying there on serial
ports just plug in support to some ports
on a motherboard
voila here's one of my favorites charlie
miller's attack on jeeps is super neat
that was an attack that took place over
the internet
because of an issue in the uconnect
systems uh i
encourage you to check out everything on
that attack because
it sounded like sci-fi the first time i
heard it
but the infosec side of me was like nah
dude that's totally possible all you'd
have to do is read the first system then
write some pale you know
i was tearing it apart in my head how
they could have done it uh
super fun great read and then today's
less fancy but still fun uh considering
i found this by accident
is the attack on a telematics app
how did i get into car hacking well
it's defcon 2016. i'm walking around in
the villages i
typically hung out like the lock picking
village and the tamper village
previously
because those were always neat to me and
this year i noticed something new the
car hacking village
so i come in the car hacking village i'm
a
car tuner by hobby i'm an infosec
engineer by trade
and uh after doing a couple questions
once you got a certain amount of points
you got a copy of the car hacker's
handbook
uh during that defcon and so i had a
copy of the car hackers handbook
but still which events do i have i knew
from previous stuff that you need a team
um and i've never competed at a level
like this you know i've only done ctfs
for fun at this point and
you know i've i've done them at the
office you know when we would hire a
company to do it
but i had never done anything really
hardcore yet
still i don't have a team so i started
hacking away and
there's there's super nice people that
were encouraging me and when i would get
stuck would you know give me hints or
sometimes tell me like go check this
chapter in the book and things like that
and it really kept me engaged but i
still
was by myself and i noticed another
gentleman who
had similar tools to me laying out you
know i noticed the patrick's cable
and some things like that and i'm like
this guy's a tuner
well i can talk tuner um so
normally autistic will that doesn't know
how to talk to anybody has the
opportunity to now talk to
people because it's about a topic that
i'm obsessed with cars
i started talking to this gentleman yep
he's a tuner he's a
cso for a company um he's he's
definitely in it so we decide to name
ourselves acid fingers and we just start
plugging away for fun
and uh little did we realize until the
last day that we were like in third
place
and we had the opportunity to stay in
third place we actually were in
second at one point and we were close to
first and we you know we just didn't
make it but either way
there was great people there we had a
great time and we still
won our first third place win which was
the encouragement to
continue doing this so if you
are trying to learn more about car
hacking check out this book i encourage
you to buy it on the no starch press
but there are there is a free copy
available on his site i believe
so why do we do it for charity um
really the truth is have you ever tried
to cut
an atv into five equal pieces
you don't get a functional anything at
the end uh and
this is what happened to us in 2018. we
won the atv with this team that we built
on the fly at def con we were not for
charity that year well i was but
other people were doing whatever they
wanted um and we
decided to go at it we we won
but we lost the title we took second
place that year we got the atv
we lost the title and that meant we had
to sell the atv really cheap
uh i told myself never again i'm not
doing this this is frustrating
so in 2019 we decided to go at it way
more intentional
we decided to build a team with the
right skills
that we thought we needed to compete at
a serious level
we also made an agreement with the team
that someone on the team would buy the
car
and that would give us the money to
donate to various charities
we ended up donating over nine thousand
dollars just to this school
which is why you see this picture here
we saved art
they were going to cancel art programs
at this local elementary and it does
happen to be
my uh my daughter's elementary but they
were going to kill art for the whole
school
and we figured what it's a local
area let's go at it let's do it so we
found out how much to save art
and we made a donation of nine thousand
and one dollars which was
over nine thousand which was the goal
and
uh saved art and as part of it we let
children draw
all over the tesla kids got an absolute
kick out of this like they
blew their mind they got to draw on a
tesla and it was all going to stay on
there
and it did it's still on there to this
day
2020 we won again uh that that year we
decided
to go ahead and just see if we could
take the toy drive that i've been
running which usually would make
you know a thousand to two thousand
dollars and see how crazy we could get
it if we threw it in
uh our our our about so
when we were all said and done we raised
over seven thousand dollars for
charity we ended up donating tons and
tons of toys
uh there's pictures on my twitter and
you'll see that at the end
um this year we're taking a break we
want to give other people a chance to
to really explore and we wanted to help
out
so if you need help we're helping people
out the ctf in exchange for charity
donations
let's talk about the timeline of cve and
i i gotta quote golden girls here
you know like uh like the old grandma
lady
picture it california 2016. a time
before masks
i'm working at a local company in the
bay
i'm leading a security gaming group
basically we did ctfs for fun
and what that entailed was i would do a
ctf
and then other folks from the company
who were not on the security team would
come
and they would participate and do the
ctf and they would use me
as their knowledge base so when they
needed to do a man in the middle and
they knew that they needed demand a
middle but they didn't know how to use
burp suite
i was that so what i would do is
practice all the ctfs
at home in my spare time so i could
always be up to speed on them
so an upcoming ctf i was going to do
needed me to set up some man in the
middle of an android app which is the
setup for all this and how i discovered
it
i had recently purchased the 2017
plug-in hybrid
sedan with a really advanced telematics
system
and i'm practicing and i discover a flaw
then 2017 i spent a large amount of my
time trying
to talk to the vendor uh initially i ran
into
so much trouble trying to get a hold of
anybody i make a phone call the help
desk
would tell me i was like silly and try
to help me reset my username and
password
i don't know how many times they offered
to reset my password for me
um initially i tried some emails i found
online that didn't go anywhere i went on
linkedin you know
i figured i could find somebody there no
one responded to me on there
what i learned is responsible disclosure
is really hard
really really hard but later you'll find
out
how i solved that once once i did get
the event
the vendor engaged they fixed the
problem in three days they didn't even
tell me they had it fixed i just
actually opened my phone that was an
update for the app and
as soon as i pulled down the app i
noticed that all of that stuff that i'd
previously found was gone
so what's the setup i was talking about
what what led me to finding it so
i was doing man in the middle of an
android app so what i would do is
build a linux virtual machine with a usb
wi-fi adapter in host ap mode which
basically means that my linux box was
acting like an access
point then i would set up some iptables
rules to route
all of the common non-ssl web ports
over to burp suite and i would set burp
suite up and not intercept
and i can't remember what they call it
passive mode or basically you can
blindly receive
do proxying for you and i had it set up
like that
so i'm i'm in the man in the middle here
i'm testing away on the app for the ctf
you know i'm finding little bugs and i'm
looking at burp suite and seeing what it
does
and biology happens you know i'm hungry
and i need caffeine so
close the app i'm working on open up the
application for my oem car
and tell it to start
cool give the car a couple minutes go
outside go to wendy's get me some dinner
i'm back enjoying my dinner and i'm
looking
through the logs i realize what the heck
there's an
http request going to an ip address just
one
just one request like this and every
other request
in burp suite was dns so it stuck out
like a sore
thumb here's the request i see
pretty quickly i was able to look at
this and obviously my oem redacted
was the oem's name
the next thing i noticed was the 3.94
was the same version as the app on my
phone and
at this point i'm like oh i think i
found something strange
at the very least the encryption looked
weak to me
now i'm not a cryptography person to be
100
clear i am horrible cryptography but i
do know
that like there's like the block
stoppers message style there's
different ways you can do it and it
appeared that part of the data above was
definitely being done the same way every
time
which led me to believe that it might be
breakable
so my next steps i've got to figure out
how do i replicate this web request i
need to make it happen
preferably happen at will next i want to
know about this ip address
what is it like where is it who owns it
all that stuff last but not least i want
to understand the app better
and i had previously played with a tool
called jx
and i knew i was going to use that tool
for this
so let's start with replicating the
request this was
giving me a lot of problems i struggled
um
i didn't know why it would happen i knew
that it would happen at least once per
day
i figured that out over the course of a
week i also figured out
by building my own receiver tool
that if i routed the web request to my
my
python script that took the web request
that i could make it download the file
but
tell it it didn't finish and it would
cause the phone to do it every single
time
so at this point i knew that if the
phone would open and try to upload the
file and fail that it would continue to
try
every single time it got on wi-fi
um i also knew that on occasion i was
able to make it happen
in certain air scenarios but i i could
not reliably make a new one happen like
i will
so in other words i'm stuck like really
frustrated and
time for more caffeine so let's look at
the iep
first we try some google dorking not
much there
dump the go every search engine i can
think of i hit it
um nothing hit it with a browser basic
web request
i looked at the burp suite logs to make
my
responder tool that we wrote in python
i in map it i want to give a word of
caution here please only in map
with the correct settings don't go at it
with dash capital a or anything that
could use
harmful nse scripts still nothing i knew
basically that was a piece of middleware
receiving a thing nothing else
interesting
what do i do
so jadex what is gen x gen x is a java d
compiler
and it does a really good job at most
code i've thrown at it
basically you give it an apk this fits
out some code
won't lie i'm lazy i didn't even
download the tool and figure out the
command lines i used a website and just
uploaded the apk file that i pulled off
pure apk
and pulled it down the code
why is this useful man plain text code
can tell you a whole bunch
what did that what did we find in this
code well the first thing i did was
search for that ip since i knew that was
unique
and that told me everything i needed to
know at that point
logs it's basically a log handling
system so whenever the system has a log
that needs uploaded i learned from the
code that
once per day it will upload the log
when it gets on wi-fi the first time
it will not do it unless it's on wi-fi
i learned what makes the law get written
to
basically logging into the app using the
app
anything you could do in the app makes
it right to the log so if you use the
app the next day the first time it's on
wi-fi it's going to upload it
next i want to know what is this
encryption
pretty awesome right near the code is
the encryption key
and the library name it uses and the
method so literally we know everything
we need to
need at this point to write some java
code to decrypt the log
what's in that decrypted log oh my
at this point is when i'm giddy
because i realize this log that they're
sending to a random ip on the internet
which wasn't random i did learn it was
one of their servers
hosted somewhere random
[Music]
it's sending a username a password your
vin your last location of the card
gps coordinates the address of the owner
of the car
all the features the car has you wanna
know if the car has heated seats no
problem it's here
caller make and model everything you
need
at this point to take over the
telematics app
so i don't even have to like get fancy
and write cool web requests and anything
and send them to a server
i can just launch the app on another
android device
and log in with everything i have here
to verify myself
here's the payload i've obviously
censored certain things
it's not a big deal i don't even have
the car anymore
but as you can see here my address is in
there
it's down the block even more the access
token is here
the client id the client secret
everything you might need to attack this
in
multiple ways but why go difficult when
you can just load the app and literally
log in as the user at that point
now you might think oh you need to be on
wi-fi blah blah blah that makes this
attack not very
useful you would be wrong because
if you go to any of the hyundai dealers
that i looked at locally
and a couple that i had a friend check
in another state
they have all have open wi-fi all the
dealers
that that i looked at would have open
wi-fi and they tell you to use it so
when you do your first registration of
this app
it's going to uh be on open wi-fi
okay that's not that dangerous is it
well it is because
in for fun and profit i made a version
of this in a out of an
access point running on raspberry pi
using fruity wi-fi that basically i used
against myself
that would capture the logs when the
user came by
so if the user were to be if you were to
put this near a dealer or anywhere else
that there might be a user that would do
it malls or if you're
attacking a specific target you could
put it out inside their house
they're just going to end up moseying on
to that wi-fi using karma
now we're talking about a wi-fi
pineapple but i use fruity wi-fi instead
but they're going to use karma and
they're gonna get caught on your
your your attack network here and
they're gonna send their data
so it did have some danger but at least
it was isolated
and had to be targeted
so let's talk about reporting the flaw
this proved more difficult than i really
expected it was so
difficult i was so frustrated the help
desk calls
were really frustrated when i tried to
go karen mode
oh that went even worse i had managers
do call me i was
mistaken they used much harsher words
uh i had managers hang up on me i had
managers tell me to stop wasting their
time
i had one manager threaten me saying
that he would report me if i kept
calling in
i'm like i want to speak to somebody and
i was documenting and i wasn't calling
like back to back i was calling
like monday tuesday wednesday thursday
friday
um what it goes to tell us being the
good guys
really hard
so during 2016's def con i met some
folks from rapid seven
who were at the event and uh
i'm super frustrated i don't know what
else to do i ping my guys at rapid seven
and there they get back really quick
like yeah we know people at that oem
let me uh let me reach out so they
contacted the vendor
three days later after they they got
engaged and and sent
the first example of the payload
decrypted and i sent them their code
and showed them where the flaw was um
they had it patched
and that was super cool i thought that
was neat about a week later they did an
enforced patch which they made all the
old versions stop working
at this point they engage with me one on
one and we talk a little bit back and
forth
and they do some due diligence to
confirm that
it looked like no one else had done what
i had figured out how to do which was
good
um last but not least the vendor
witchery wants to remain
nameless wants me to tell you that they
added a voter disposability disclosure
program
so i'm not quite sure why they wanted to
make sure i include that in the talk
when they don't want their name
but it's in there
oh my god a pop-up during the middle of
a talk sorry i can't be team charity
case if i'm not hawking some charities
right
um and i like dinosaurs and so is my
toddler
this is donate life donate life is an
amazing charity
they uh they help folks who are
on like dialysis get kidneys and help
with the funds or
hearts any organ and soft tissue donate
life
is uh the group that's out there helping
out they're really
a great cause if you can drop some
coin to them do so if you can't you know
tell somebody else to do it
all right after that brief interlude
there how can an oem improve
train your staff i can't stress this
enough when i'm calling
consistently and telling you that i have
a problem that's that's serious
have your staff at least know how to
escalate to infosec if they don't know
how to escalate for infosec because a
guy's calling in and describing you know
very advanced things to them they also
don't know how to
escalate to infosec when they get a
phishing email so
to make this clear this is a thing will
help your whole business
publish your public contacts for your ir
and security team
below you'll see a method that's
commonly accepted please
nothing existed if i could have got a
hold of somebody on the security team
this could have been
solved in three days not almost three
months
participating bug bounty programs i have
personally
led bug bounty programs for places i've
worked and they've
always been beneficial um for us car
hackers that are amateurs out here
having fun
we love to look around and find bug
bounty programs last but not least
participate in the car hacking village
and i'm gonna pick on tesla a little bit
here just because i like picking on
elon's company
and i'm a fan um
don't be tesla in 2018 tesla brought out
a
tesla to look at they also banned me
from touching the tesla when i started
poking it
and trying to make it join my wi-fi and
do things
so if you're going to bring a car in
here understand that people want to poke
it and explore
so be a good vendor there's been great
partners there's lots of great partners
in this
corps that bring cars and even bring
like tesla
ecu's and things to hack on take
advantage of it and if you're an oem
and you want to do it reach out to me i
can get you in contact with people or
reach out to the car hacking village
direct
don't be afraid we don't bite that much
all right thank you so much for coming
to my talk
this picture here was a picture i wish i
could have been there for but
i didn't expect to win in 19 i expected
us to do a good job
but so my plane flight was back i was i
was already on the airplane at this
point
and pictured here as wilson
who is uh we were we were super excited
to have on our team he actually competes
on the rpi
main defcon ctf that year they ended up
not qualifying so we got to steal him
in the back is eason he's super cool he
drives this car around
and it looks not like that the hood's
different now with all the writing on it
instead
because that hood wouldn't stay closed
we had to take it off
uh and the other gentleman here southern
him and i
we met at this def con and he's competed
with me every time since
he's here at the event with me uh we've
become really good friends and we're
even building a 24 hours of lemons car
under the charity case name uh so if you
want to find out about that you can
follow me on twitter
or on youtube most of my stuff on
youtube is about tuning
but it's car related and uh check out
these links
again hawking my donations thanks
everybody for coming
have one last tip if you have a tesla if
no hood
and it's a low battery it only gets 140
miles if you put a cardboard hood on it
you get over 160 miles that's your hack
for the day
have a great day i hope you enjoyed def
con and thanks so much for coming to my
talk
you