hello everyone um
my name is nick ashworth i am a graduate
student here at the university of tulsa
in tulsa oklahoma uh and i am presenting
today
my research on tracking and identifying
people
and vehicles via the passive keyless
entry system
uh yeah it's gonna be a thing
um so before we begin uh a couple quick
like explanation
the vulnerabilities in the attacks that
i've done
uh i've tested on seven vehicles so far
uh
ranging from a 2013 ford explorer all
the way up to a 2020 lexus
uh everything that you see in this
presentation
today so all of the
waterfall graph images all of the image
captures
all of the description of the like
individual message formats
and even the demo at the end will
involve
this wonderful 2014 toyota prius
that as you can tell by the snow on the
ground in the current 90 degree weather
outside
this is a very recent image
and if you also didn't notice with the
target uh
trash bag over the front door handle we
take great care of this car
honestly it's perfectly fine and happy
here i promise me and the other graduate
students don't do anything harmful to it
at all
but okay getting into the meat of this
stuff uh passive keyless entry
for those of you who aren't familiar
there's two ways that you can use your
key fob
to get into your vehicle the first and
most common way that everyone knows
active keyless entry this is where
i push a button the key fob generates
a message the car receives that message
if everything is correct it unlocks the
relatively newer way and manure in this
case i mean
starting from 20 from 2003 on
is a technique called passive keyless
entry
like its name implies in a passive
keyless entry system
you just happen to have you just have to
have your key fob on you
and whenever you either touch the door
handle to enter the car
or push the start button on the vehicle
to begin to uh turn the engine on
the vehicle will generate a message that
forces the key fob to respond
and it is then able to tell whether or
not the key fob is present
and whether or not that key fob is the
key fob that has been paired to the
vehicle without you
the driver doing anything this has
gotten very very popular
over 90 of the vehicles sold in the us
uh
in 2020 had uh pass a keyless entry
it's really useful from a consumer
standpoint for a lot of reasons
because the vehicle was able to check to
see if the key fob is nearby
the vehicle can automatically alert you
if you're about to leave your keys in
the car because it can check to see
if the keys are present inside before
you go to lock the door or whenever you
press the door lock button
it also is easier on the person because
it's one less thing to carry for doing
groceries
yada yada yada the classic game of
convenience for security
um and so it's something that's here to
stay
excuse me the basics of uh passive
helicopter being broken down into three
protocols
that handle all the heavy lifting of
this of this whole system
the first is the pairing protocol this
is the protocol that is used
to match your key fob with your car
this is a very vendor specific protocol
i'll be honest i wasn't able to get that
much info on it
but the basics of it are as a part of pk
as a part of the pke system there is a
unique id for your car
and there is a unique id for your key
fob and doing the pairing protocol
those two ids are exchanged between the
vehicles so that your car now knows this
key fob id
me is the key fob that it's supposed to
listen to and your key fob now knows
that car id
is the car id it's supposed to listen to
pretty straightforward
the second one and one of the more
interesting ones is a thing called the
zero battery protocol
i suppose i should also clarify because
all these documentations are proprietary
i don't
know the actual formal name of these
protocols these are just what i call
them for convenience
feel free to use or reject those names
at your own at your own discretion
the zero battery protocol is the pro is
the emergency protocol used when the
battery inside the key fob dies
uh so if your key fob dies you can use
the backup key that's inside most of
these spots
to get into the to get into the car but
because the car
uses a push to start system in the in
the whenever it's enabled with pke
there's nowhere to use this to actually
turn the ignition on and so instead
what happens is the car transmits a very
very long
like 150 millisecond long message that
powers up and energizes the encryption
ship
inside the key fob and allows it to
operate and send a quick message that
yes i'm here and yes i'm i'm your fob
even
when the battery is not present and or
dead
uh we'll get into a little bit more of
how it does that and why
he does it at the specific frequency
later the other one
and the main thing that we'll be
focusing on and the main thing that uh
the main protocol that you actually use
when you're using your car
is a protocol called the four-way
handshake protocol
this is the protocol that is used every
time you touch a door handle
every time you use the push start system
every time you try to do the trunk
and 99 of the time this is the protocol
you will use whenever interacting with
your car
um this protocol is interesting
because unlike the zero battery protocol
where the car
is powering up the key fob by enabling
it transmit
the four-way handshake protocol uses
the battery inside the keypad the same
battery that's used for your active
keyless entry system
this means that the messages that it
generates
are relatively high power at least
compared to pretty much everything else
that your car is transmitting
such as like uh tpms or some of those
other systems
and so you have a really long range with
this
um if you do the free space loss
calculations you're talking up to 90
meters
of range if you're looking at like a
real world scenario you're going to cut
that in half and do anywhere from 30 to
40 meters
of range but either way all of a sudden
you can
identify this over rf from really far
away
uh the other key thing to know and will
become very important
is that the passive keyless entry system
on your vehicle side
transmits at 134 kilohertz now your key
fob itself will transmit at anywhere
from 315
megahertz 434 megahertz some of them
will even go up to 900 900 megahertz
um and those are all relatively high
frequencies
134 kilohertz is incredibly low
frequency for those of you who aren't
familiar with rf
and it causes a problem in this space
which is honestly the biggest challenge
in all live research
that i like to refer to as the 134
kilohertz
problem so nrf
um and i will just really admit i am an
idiot with an sdr
so take all this great stuff but then
the basics of doing radio frequency
analysis when you are designing
an antenna to work at a given frequency
you design that antenna to basically be
um either on the half wavelength or the
quarter wavelength
of the of the of the wavelength you're
trying to track
so you want it to be an even multiple of
either that half wavelength or that
quarter wavelength
now for 99 of the signals you and i
interact with every day
that is not a big deal um wi-fi is at
2.4 gigahertz or 5 gigahertz depending
on
um what freq which channel you're
listening on uh the new five gigahertz
signal that your cell phones are gonna
use go all the way to 60 gigahertz
very very high frequency which means
very very small wavelengths on the
verge of like you know anywhere from
meters to centimeters
and thus you know an antenna even for a
relatively
low frequency signal like ais which
ships used for identification
that operates at 162 uh megahertz
your antenna length is still you know
something you you or i could easily
carry
134 kilohertz though is a really low
frequency
uh to give you an idea of how low the
wavelength of this signal
is over 2000 meters which means the half
wavelength
is a thousand meters and the quarter
wavelength 500 meters
having an antenna that's 500 meters long
is a bit of a
problem unless you're somebody like the
government
or you just have a ton of property
uh it it's like absurdly huge
for this space now what's cool is
because this frequency is so low you can
do a lot of things with it
um this frequency travels
forever and has very little free space
loss because of how low it is
for example the picture on the right
the little candy stripe towers that is
a time keeping system in colorado that
the actual antenna is a thin cable that
runs across
all those poles and it radiates a signal
down into into the earth that bounces
off the earth and then kind of glides
along the ground across the entire us
and if you ever had any one of those old
radio controlled atomic clocks from like
the 90s or early 2000s
this was the frequency it was listening
to
no matter where in the us you were
that is like stupidly cool range
um the counter to that is you need
really really big antennas
um and in addition to that you need a
lot of hoops to jump through if you're
trying to talk
on this frequency as a civilian the fcc
only recently um and by recently i mean
like 2017
allowed uh amateur radio to begin
operating near this frequency
technically the amateur radio band is
136 kilohertz
13634 is close enough to not matter
for our conversation
because of that a lot of your
traditional
sdrs like your hack rf1s your rtl sdrs
um even your blade rfs
don't operate at this low frequency most
of them cap out at anywhere from like
one megahertz
to 75 megahertz for example if you're
using an ssdr
uh the only one that really will go this
low natively without using
up converter is the lime sdr made by
lime micro systems
and again that's a relatively new sdr
that came out in around 2017
at the same time finding antennas that
will operate
in in this frequency range that you can
just commercially buy is also
a bit of a nightmare uh while there are
a lot of hand groups that listen in at
this frequency
and so you can find receive only
antennas fairly fairly easily
finding a transmit cable uh yeah sorry
finding a transmit capable antenna
is a bit of a nightmare uh and that's
kind of because the fcc again
uh gets to be everybody's best friend
because as a part of being authorized to
transmit in this band
if you are one of the ham radio groups
that actually can talk on these
frequencies
you don't get a normal license your
license is geo-locked
to a specific antenna that you will be
using to transmit
and you must give the fcc the exact
the exact gps coordinates of that
antenna
having some mobile antenna that you can
move around
completely breaks all those rules and so
most people haven't designed one
uh i did eventually find one and
uh i have on the github page that
explains this attack
kind of little kind of a little bit of
running out of it and it's called the uh
you loop
loop antenna uh this is the antenna that
i use to get all of my captures and i'll
be using for the attack demo
it's what's known as a small magnetic
loop antenna
which basically means it is a loop of
wire
in this case i've looped it around twice
you can kind of see that
and what that does is a bunch of demon
magic
that lets you bypass not having to be
a quarter wavelength or half wavelength
of the signal you're trying to receive
or transmit
now the downside of that demon magic
that allows it to happen
is the system doesn't work very well as
a transmit antenna
while those big giant poles the size of
small houses
uh will let you transmit across the
continental us
and if you're in a military system fun
fact this is
a similar frequency to what the navy
uses to talk to submarines
at the bottom of the ocean again this
thing
there is no free space loss you can talk
for miles and miles
it's really crazy a little guy like this
will not get you that range
um and even if you go to a larger
like uh meter meter
uh long loop and add on an up converter
everything else
you're still only getting like 20
30 meters of transmission range with it
uh in theory if you were to design your
own antenna for this space
you would probably have better luck
my background is not antenna design i
so i don't really know how to do that if
you do please feel free to get in
contact i would love to talk
and learn more because i think there's a
lot of cool things that you can do
even with the limits that we have which
we'll go over
soon so with that uh side discretion of
the wonderful world of rf
out of the way let's get into how the
four-way handshake
actually works so before we handshake
as its name kind of implies consists of
four messages
a wake-up message uh an acknowledgement
message a challenge message and a
response
your basically how this works is
whenever you go to we'll say touch the
door handle
so i am trying to enter the car i touch
the door handle
there is a capacitive sensor in that
driver's side door handle that alerts
the vehicle that someone is
trying to enter that then causes the
vehicle to generate a wake-up message
a wake-up message as its name kind of
implies tells the key fob to wake up
it is a static message this means that
the data inside the message is always
the same in the case of
the 2014 toyota prius that we'll be
using as our demo for today
that wake up message is f-f-e-a-b-a
if i remember correctly and it will be
that way
for every 2014 toyota prius you run
across
or every uh i believe it's generation
three
is the vehicle model our is the vehicle
family of the 2014 model toyota
precision
so in theory every one of that vehicle
model
will use will generate this wake up
message um
and that will become useful to know
later on we're going to get one of the
texts
the key fob if it is within range to
receive this wake up message
will respond with an acknowledgement
message at whatever frequency it
transmits on
in our case for today that is 315
megahertz
so the acknowledgement message is also a
static message
that basically just tells the vehicle
that yes there is a key fob in range
that match or that is a toyota prius
keep up
now you might be wondering why both of
these messages
are static after all it seems kind of
useless to have them there
well the advantage of having two static
messages to start this out
is a static message is both very easy to
generate
and very power efficient because you're
not dynamically doing any calculations
or
changing anything on the fly you can
transmit this
signal without draining your battery
that much
and because the car is sitting there and
using its car battery and because your
key fob
is sitting here using your little tiny
coin cell battery that's in here
battery drains kind of a big deal on on
the engineering side and so that's why
they decided to make this first half
static
to reduce that battery consumption now
once your car knows that there's a key
fob nearby
that could possibly be its key fob it
generates the challenge
message uh the challenge message is a
much longer message so for comparison
the wake up message on most of the
vehicles i tested was around five
milliseconds
in like total transmission time the
challenge message
is about 50 milliseconds it's a big boy
uh that challenge message contains your
car id
a challenge seed which the
key fob will use to solve to validate
that it is the key pop it claims to be
and a simple little crc to just kind of
do data validation
so what happens is then after that
challenge has been transmitted
your key fob will receive that challenge
message
we'll look at the car id first and see
if that car id
matches its key fob id if it does great
it further decodes the message
if it not it throws it away and it
laughs and doesn't care
um it will then take that challenge seed
from the uh from the challenge message
and attempt to solve it
and it's a pretty simple cipher like
okay we're saying
it's encrypted but this isn't like an
aes
kind of game this is like the challenge
word is is a
the password is apple the challenge is b
the password is banana um again
battery is a huge issue doing a ton of
calculations and computations takes a
lot of battery power
so things are kind of this this isn't
your normal your normal kind of game
but it's also operating in a space where
it's not really expected to get that
many hits
um and so when your key fob generates
that response
your car will look at the key fob id to
validate that it is correct it will look
at the actual response message to
validate that is correct
and then it lets you in and these all
four of these messages happen in the
time span of you touching the door
handle and pulling it open
or pushing the start button and waiting
for the engine to actually start
so it's relatively quick quick
happenings
um it's fairly straightforward it works
the way you think it should because
honestly it's not that badly engineered
of a system it's actually pretty good
and useful
uh there is one key point uh that will
become very important very very soon
on the four-way handshake and that is
there's actually a couple different
implementations of the four-way
handshake
and not all of them are four-way because
again
cars why why do we have standards who
needs that
no one wants to make life easy or nice
um
in the traditional implementation this
is what we have shown on the screen
and this is what a majority of the cars
that i've tested
have used and based on like reading the
literature of some of the other reports
of people doing
more traditional exploits on fifa on uh
the pke system such as doing really
style attacks
this is the kind of system they run into
too so i'm fairly certain
this is kind of the the main
more universal of the two but it is
important to know that there is an
alternative
implementation of this that consists
only of the challenge and response
messages
of the vehicles that i tested two of
them the 2018 buick encore and the 2020
ford expedition
uh both used the alternative this
alternative implementation
of the four-way handshake now there's
a lot of reasons why you would use the
alternative implementation
uh especially on newer vehicles where
the key fob will respond
back rather in like rather instead of
like a very simple
am on off keying or like a simple little
fs case
fsk transmission maybe they're using
z-wave or bluetooth
or zigbee um up at like the 900
megahertz span
well those data links already have a way
built into them to determine
how close a transmitter is to a receiver
and so the wake up and acknowledgement
messages can be kind of supplanted
by that built-in capability there's also
the general case of maybe you just used
a really large
um or not really large but like really
high capacity coin cell battery
and so therefore you're not quite as
worried as it running out of charge
both of those are completely viable both
of these systems work
um we do have attacks for both of them
and i'll explain those later on
but it is important to know uh that you
will sometimes see a difference
especially if you're doing
this research on your own and you're
sitting there
and you're getting your captures and
you're wondering why you're only seeing
two
instead of four messages this is why it
just means the vehicle you're testing
uses an alternative message
or alternative four-way handshake set up
and so
the message from the vehicle was just
the challenge message and the
response from the key fob is the
response
so now let's get into the fun stuff
how do we actually hack and attack this
system and what can we do
with the key fob that we care about so
before we get too deep into it let's
talk about radar
um most people are familiar with
traditional radar
where you have a big giant antenna dish
and it transmits this crazy weird
frequency thing
at really high power and it hits an
airplane
and it reflects off the skin of the
airplane and then based off those
reflections the dish receives it
and does a bunch of calculations and
math and says oh there's somebody at
that altitude in that angle
and they're possibly moving at this
speed as i track them
that's traditional radar uh that's the
radar that the military uses
for like everything because they're the
military gay
um but it's not the only form of radar
that exists
one of the forms of radar that's
especially more common on the civilian
side
is a type of radar called cooperative
radar
now in cooperative radar you have the
same kind of equipment but everything's
just slightly different
so for example rather than my radar
generating a weird signal and watching
the reflections
it generates what's called an
interrogation which is a simple message
that can be surmised as shouting out
into the into the darkness
is anybody out there um
and the aircraft that is receiving this
interrogation
rather than just letting it reflect off
of its skin and using the backscatter
and all that other crazy physics to
figure out where it is
receives the message decodes it and
sends a message back that says
yes i am here uh if you're familiar with
aviation
this is iff uh iff or adsb are both
wonderful examples of a cooperative
radar system that works
if you're not familiar with aviation
you're actually also probably still
familiar with cooperative radar
just in the form of the pool game marco
polo um
so for those of you who never played it
or who haven't had kids who played it or
whatever or
are scared of the water uh marco polo is
a very popular
childhood pool game where one player who
is
it uh covers their eyes and has to shout
marco
uh and he the that players in the pool
uh shouts out marco every so often to
try to figure out where
everyone else is um the
other players in the pool uh are able to
move around
and every time the player that is it
shouts marco
they have to shout polo so because the
player that is it has their
has their eyes covered uh they have to
use the sound of everyone's response to
figure out where they are and try to
navigate towards them and tag them
this is cooperative radar um this is the
basics of it
this is also why i decided to name my
toolkit
uh marco after the pull after the pool
game
um also because marco polo with an sdr
looks really really funny
but it is what it is um so
that's what we're going to use to keep
up for in these attacks
is we're going to basically turn this
into a cooperative radar system
where uh i or you or
really who any anyone who downloads the
toolkit will use an sdr to generate a
series of interrogations
that will then force the key fob to
respond
like it was a transponder uh either an
aircraft
or a kid shouting polo if you're playing
the pool game
we have two attacks that we'll go over
that i have that work with this
the first is what's called a zero
knowledge identification attack
so in this attack we are targeting the
wake up and acknowledgement messages of
the four-way handshake
and how this works is the attacker just
basically has to generate a bunch of
wake-up messages
very very quickly and the key fob will
then respond
with its acknowledgement now this sounds
simple
and spoiler it is but what you can do
with this attack is actually really
really cool
so remember how i said earlier that both
of these messages are static
and thus they don't change for
any of the vehicles of that given make
model generation
well that means that you could attack a
vehicle and identify
it or identify the driver if the person
is walking around outside their vehicle
without having to know what the key fob
is ahead of time
because if you are here and you have a
library
of a lot of car samples we'll say
like a couple hundred you can generate
every one of those wake up messages
and just run through that list and
whenever you finally get a response from
the key fob
congratulations you now know that the
key fob is a make x
model y generation z whatever
um that's a really cool feature in this
where you don't have to have any not any
specific knowledge of the vehicle you're
trying to attack ahead of time
which is why we call this a zero
knowledge identification attack
i'm able to identify the vehicle on the
fly as it pops up or as i care about it
now as cool as this technique is
it has a couple flaws
first off the acknowledgement message is
also
a static message which means if i have
say
two toyota priuses right beside each
other the same make model generation
i'll know that there are two because for
every wake-up message i transmit i'll
get
two acknowledgement responses but i
won't be able to know
which one is which so say for example
uh we are driving down we are driving
down the road and i have my friend bob
driving because i'm going to be sitting
on the laptop
and we are following two uh we'll stick
with toyota priuses just for the example
one of them is red one of them is blue
i'm sitting here i'm generating my
interrogation i have my antenna running
i'm seeing the acknowledgements
everything's great i can validate that
yes
these are both generation three toyota
priuses because they're responding to
that wake-up message
all of a sudden one of the toyota
priuses turns left
and the other turns right now
i have no way of knowing using this
technique
which one went which way because all i
know is that there are two toyota
priuses based off the acknowledgement
message
i can't tell you which one is the red
one and which one is the blue one
and thus even if i um so
these loop antennas are slightly
directional so even if i spin it and are
like okay
one is to the left one is to the right
i'll still know where they are
but i'm not able to identify them at a
granular level
of which prius is which one
it would be a flat guess um
you so that's kind of the the cost
of this setup is you can
identify everything on the fly but
you're limited on your granularity of
how much you can look at
you're also limited of being only being
able to identify stuff based off how big
the library is
and then as if it wasn't bad enough for
our poor little zero knowledge
identification attack
there's a third thing he has to he has
to deal with
remember how i said earlier that there
were two implementations of the four-way
handshake
well if you happen to be one of the
lucky users that uses an alternative
version of the four-way handshake and
thus
does not have a wake-up message or an
acknowledgement message as a part of
your activation process
congratulations this attack won't affect
you at all
uh so what this ends up meaning is that
while it is true
90 plus percent of the vehicles on the
road use passive keyless entry
and while it's true this kind of zero
information attack will work on a
passive keyless entry system
uh you're not going to be hitting 90
plus percent of the vehicles on the road
my best guess is you're looking at
something around 50
um again i've only unfortunately been
able to test seven vehicles for this
partly because of covid and then like
you know
going over to random people to mess with
their car wasn't really kosher with code
restrictions and then
all the rental car companies sold all
their cars so you couldn't just
go to a lot and hop from one to the
other aisle to aisle
uh so again if you have a vehicle you
wanna help out on this please let me
know i'd love to i'd love to talk to you
um but while the
zero knowledge guy is kind of hit or
miss of having a lot of really cool
functionality
and not requiring a setup he's not able
to hit that many people
the alternative is what i call a
targeted tracking attack
so in this attack we are targeting the
challenge and response messages
which means does not matter whether
you're using alternative passive keyless
entry
or you're using or sorry alternative
four-way handshake or traditional
four-way handshake
this attack will work on you so this is
the attack that will track everyone
and everything everywhere which is great
right fantastic well again their
great power comes great responsibility
and in this case great
responsibility comes with a slight cost
unlike the previous attack where we
didn't need to know anything about the
target ahead of time
we could just basically point an antenna
at them and keep trying
things until they responded and be like
yep that's who they are
this attack requires knowledge of the
vehicle before you're able to spoof it
to be specific recall that the challenge
message contains
the car's unique id that is used by the
k-pop
validate that it's its vehicle
because we are pretending to be the car
uh we have to use that id
but that means we have to solve for it
now there are two ways
one can get this information an easy way
and a hard way the hard way is to
reverse engineer the algorithm
of the specific vehicle that you're
trying to that you're trying to
spoof there have been previous papers
that have done this in some form or
another
mainly looking at the cryptographic chip
used
by the key fob which is the digital
signature transponder
people figured out that a lot of these
ids are based
off of the serial number of the car
but you still have an issue of every
different vehicle is going to have a
slightly different implementation
and so you're going to have to do a lot
of math the easier option
and the option i use doing my research
is you just have to capture
a single message
all you need is a single challenge
message and you are good
this is because the challenge message is
what we like to call deterministic
a deterministic algorithm means that if
i pass you
a value or a key your answer will always
be the exact same it doesn't matter how
often i pass you that same key or
what i passed you beforehand everything
is discrete hence it's deterministic
recall earlier that i said that this
challenge response algorithm is fairly
simple
compared to a lot of the stuff we're
used to in
like the web or an ip based system or
something like that
as a part of this your key fob doesn't
have any way to validate that a
challenge message
actually came from the car that is
claiming
um to be to or that that the person who
claims to be effectively
reason for this is remember all that
challenge message has
is the car id your seed
and your checksum to validate
i can just as easily steal bob's name
tag
pop it on i'm bob now the challenge is
a and you know validate that the message
is correctly
because in in this case of this attack
in particular
i'm only really interested in the key
fob id
i don't care what the response is so i
don't need to pass it some different
challenge every time i can pass it the
exact same challenge
in fact it's easier for me to pass the
exact same challenge because then the
crc value won't change and it's just
going to be the exact same message
every time and all i have to look then
is
uh do i get a response and does that
response
match my uh key fob id that i'm
interested in
so this is the attack that i think is
kind of like the most useful from a
practical standpoint
because while it's true it does require
some previous knowledge
it works on everything
and getting the knowledge needed to
attack it
is pretty simple there are plenty of
attacks on
active keyless entry systems for example
where the attacker is sitting there
and waiting for the victim to press a
button on their keyboard so that they
can capture the rolling code message
into it this is similar but we're not
even have but actually it's similar but
it's even more simple
in that we're not even having to reverse
the message
like there's no encryption code that we
care about on this
we just need to know the formatting and
so by ripping out
a message that works and knowing that
all that data is good and valid
we can then go in at any point that we
want after we have that data
whether it be today tomorrow two years
from now 10 years from now even assuming
the
battery somehow is still working we can
track that key fob
wherever and whenever we want as long as
it's in transmission range
and that's pretty cool i think
um suppose i should also be nice and
mentioned that i drive 2009 toyota yars
that doesn't have a key fob at all
so therefore i'm not affected by this
research
uh for those of you panicking right now
i'm sorry
but uh with that said uh let's
take a step back and talk about what are
the other ways
to identify vehicles so it's great that
we're doing all this stuff with the key
fob
and like yeah it's cool and okay most of
us just kind of assume that all you
would care about a key fob is spoofing
to steal a car
so this is like new and crazy
but we have other ways to track vehicles
um
we have a lot of ways actually to track
vehicles the most common way that you're
probably familiar with
is a license plate reader camera um
these are camera setups that you can get
for
anywhere from a thousand dollars give or
take or sometimes a little less
they sit on your either your vehicle
or on your property you aim them in a
car and basically they do
like an open cv excuse me they do an
open cv algorithm
to grab the license plate number
look it up in a database and tell you
who it is and because
every car legally legally driven in the
u.s has to have a license plate
this works really well these tend to
have a range of
around 30 meters give or take
um license plates readers can be really
delicate and sensitive to light
to angle because obviously all they care
about is the license plate itself they
don't care about everything else
um and so they can be a little bit but
you're looking at at least
the ones that i saw on amazon they were
reporting ranges of around 30 meters as
their maximum expected range
the other main competition that we're
competing against
is uh tpms to your tire pressure
monitoring system
this is a very simple data link it's in
every one of your tires
mandated since 2008 it's completely
universal
and basically as you're driving along
your tires will periodically broadcast
to your car
what their pressure is um this happens
roughly every 30 seconds when you're
moving at speed
at speed in this case tends to mean any
above either 30 or 35 miles per hour
and so as you're rolling along the roads
your tires are periodically telling your
car what the pressure
is this is useful because it can give
you a heads up that a tire is deflating
um it'll also happen whenever you first
turn your car on so you'll know if your
tires are under inflated need to
reinflate them
and the whole point of it was to stop
people from basically ignoring their
tire pressure and having blowouts on the
side of the road
because of where a tpms sensor is
located at inside the tire itself
um it's actually really hard to get
captures of it uh because depending upon
what side of the road you're standing on
or if you're above the vehicle
or something like that that signal has
to go through the entire car
well cars are kind of big heavy bulky
metal objects
and you know a lot of signals don't
travel through solid metal
that well or even mostly solid metal
um add to that that tpms is
time independent you're only operating
once every 30 seconds so it's kind of
random whenever you get somebody
and these signals because they're being
generated by the tire are very very low
power here you're only looking at a
range of about
10 meters so relatively short
now on the testing that i have done here
at the university
uh which is basically consisted of me
the wonderful toyota prius that you saw
earlier that is in totally drivable
conditions and is not completely stuck
on the parking spot that it is currently
residing in
and will reside into the end of time
i just basically walked around and used
parking uh space lines as a measurement
indicator
so full disclosure this is not a super
scientifically accurate test
because it's me out of the sun carrying
this laptop around
intra and then using google earth to
measure how far away i am from where i
from where i think i'm at uh and that
got me
uh roughly 30 to 40 meters depending
upon the trial run
of range using um the targeted tracking
attack
so basically setting the key fob up
um i was not using this antenna i was
using
a meter i was using the
full size version of the u-loop antenna
which is about a meter
diameter loop also with a
uh with a preamp attached to it to aim
to power up the signal
the reason why i'm not using that gear
for this demo is because i wanted to a
have the antenna on
on screen and so doing something that
was the size of me was just too bulky
and b i general rule of rf whenever
you're transmitting something at power
it's a really bad idea to have them that
close so that's why we're using this
antenna today
but using that range i was able to get
close to a really good
uh really good uh line uh
license plate camera range without
having to see the license plate unlike
the license plate reader
this attack works in any in all
directions because it's rf
and your key fob radiates
omnidirectionally
omnidirectionally just means in all
directions um
so you know this attack also has a
unique feature
in that it works whether you're carrying
your key fob in your car
or whether you have it on your person
like in your purse or your pocket
which is what we all do with our keys
when we're out walking around
so with that said
i have a quick demo that i'm going to do
that will basically just
show you uh the generation of the
challenge message
i have two key fobs here this is the key
fob that is paired to our 2014 toyota
yaris
this is a 2014 200 yards key fob that i
bought
off amazon that is not paired and so
i'll show you how
they behave with the challenge message
um
and then we'll also talk about what you
can do to protect yourself
against this attack so
i'm going to stop sharing here
i am going to start sharing
uh and so you should
now see a waterfall graph
so this is sdr sharp this is a open
source
waterfall generator for those you're not
familiar with rf a waterfall graph is
just a representation
of rf power over time you can see it's
normally blue
whenever i go here and push the button
and force the key fob to transmit
you see we have that nice little little
spike
at the frequency it's transmitting it
and you can see how the the color
changes
based off the power level uh that this
that the key fob is transmitting at
so we put those over there uh i'm now
going to go
into uh i have a little vm running
that has all this set up make sure
everything is connected
that is on
um i suppose i should also mention at
this point uh
i have the marco code all online it is
on github it is
publicly available for you and anyone
else who wants to to download and use
this toolkit
um it's at uh z tulsa
pke is the github link it's written in
python and uses canoe radio
for those of you who have never used gnu
radio before congratulations you sweet
summer child
uh for those of you who have yeah it's a
little hit or miss to work but
marco acts as a python script that runs
on top of that
and allows you to dynamically generate
messages
where a gnu radio module that i wrote
converts those into the pke format
and this allows you to do a bunch of
different cars very very easily
in our case we are going to do a demo
configs
and we are going to do a demo message
that all looks good this is going to
transmit a message
once every second and so if i hold it up
here
like this hopefully you should both
be able to see the little red light
flashing every second
and you'll see the waterfall graph going
on now
this gets into a weakness that i forgot
to mention
when discussing the targeted attack so
your key fob contains a a really simple
cryptographic um chipset in it called a
digital signature transponder they're
made by texas instruments
texas instruments is like very paranoid
about letting data about this
chipset out and that chipset is what is
tied to your led
on your key fob for those of you that
have an led on your key fob
um that means that anything that
causes that chipset to activate will
cause the led to light up
so in this case because we're generating
a challenge message
and forcing a response message to
generate
that is that causes the led to light up
by comparison if i were to only generate
the wake up message
and not generate the challenge message
the led would not light up and you would
have no way of knowing that the attack
was
was happening if you were the victim but
again the crux of that is
when i'm only targeting wake up i can't
identify you uniquely
now by comparison
if i go over here and now use
oh shoot hold on sorry i had that
still pointed at it uh the beam pattern
for this guy
is why is that still going on
there we go okay um my apologies for
thinking
the beam powder on this guy is such that
he's not going to be activating which is
why if you see
the led doesn't light up on him uh
so he is not generating signals right
now
we have someone else transmitting don't
know who but
yeah that's the uh targeted attack
um that's the basics of it
so again this guy
will transmit and respond if i don't
have anything nearby him he doesn't
if i put it nearby him he's now
transmitting and talking
and you can see it uh no he's not
now if you are wanting to protect
yourself against this attack it's
actually
super easy uh so fun fact
when you go to turn on your car
your car doesn't actually care um
whether one or all right look up your
car doesn't care
once it started if the key fob is
present or not
this means that you can just basically
turn the car on and put the key fob in
like a really simple copper bag
like the uh thing that they ship
passports in and you're fine
because you're in effectively a faraday
bag the data won't get transmitted out
or get transmitted in the keypad won't
respond and you're safe
but that requires remembering to put a
key fob that you normally just leave in
your pocket or purse and never touch
into a bag and so let's be honest odds
are 99 of people aren't going to do it
um but yeah that is the uh
basics of my research with key fobs in
passive keyless entry systems
uh again this is a kind of really cool
space
because we're using key fobs in a way
that like
most people have kind of ignored uh we
also have the advantage
of being able to go in
and turn these things into a radar
system which
they were totally never designed to be
which i consider like
super cool um so if you want to
download the source code it's on my
github repo
z tulsa pke please feel free to
have download couple tutorials on how to
do captures of your own
unfortunately i don't get great radar
sorry great wi-fi reception in the
parking lot so i apologize for not being
able to show that as a part of this
tutorial it's really really simple i
promise
all you need is just like one or two
sdrs to set up in there to capture your
signals and then to go through the
analysis
um so yeah thank you for watching i hope
you enjoyed
uh and have fun at defcon
bye
you