hey i'm eric gerschmann
and i'm going to be talking about
defeating the chevy stabilitrak for
track time fun
this is a bit about me it's some of my
contact info
uh you can find me at eric gerschmann on
twitter eric at ericgerschmann.com on my
email
and hexis on discord
so i've started out in it as a systems
administrator
and uh i quickly made my way into
infosec
during that time i was hacking most of
the most of
my career on the side or either for work
and i've been a pentester for the last
five years
i learned how to wrench in college how
to work on cars in college because
i just couldn't afford to get my oil
change i had to do my oil changes myself
and that quickly led to changing my
breaks
and then finally at one point i got a 93
miata
and i edit i i changed my clutch on the
miata
and that was the the largest work uh car
project that i've ever done
this photo here is from the car hacking
village
from def con 24 in 2016.
it was the first time i went to the car
hacking village
i came up to uh this car setup that
was designed so that people could
interact with it and find sensors i
looked inside and everyone had picked
over
the interior got into all the sensors
and uh
so i decided to look under the bumper
and was quickly stopped by the car
hacking village uh
staff because they didn't want me to
start removing body panels to get to
sensors they just wanted
so us to really look at the interior uh
it
i feel like i've come a really long way
since then i just wanted to say that i'm
excited about
contributing back to the car hacking
village after
uh experiencing it over the past uh
several defcons
a quick disclaimer the electronic
stability control which is what
uh stabilo track is each manufacturer
uses their own
trademark name for their electronic
stability control
uh reduces the likelihood of crashes by
up to 43 percent
according to the iahs so disable
stability track and other safety systems
in your car
at your own risk
now going into the reason why the
the starting of the title for this talk
is safety third
uh that being said safety can't really
be
ranked safety third is the idea that um
it should be jarring uh most of the time
we hear safety first
but uh safety really is a mindset
and it's it's up to us you can't always
have safety first there has to be a
balance with risk
so for electronic stability control it's
commonly disabled from motorsport events
in classes
even if it does save lives because
in the end you're responsible for your
own
acceptable risk level
you might be asking like why would you
disable elect esc
and these other safety systems if they
work so well on the road
and the best summary i could find was
from
the team o'neill rally school in new
hampshire uh
in their video the best card
modification they say
that the easiest and best performance
modification you can do is to disable
traction control abs and stability
control
because those systems are
designed for the stream they'll work
different when you're on the track
and they'll prevent you from really
learning and becoming a better race car
driver
now the flip side of that is even when
racing it it really is a case-by-case
basis
uh it depends on what car you're driving
so
for uh for a car like a like a tesla
model y
um the stability control on that car
is supposed to be amazing i've never
driven one
but it's supposed to be spot on with the
balancing performance
and being able to keep traction and keep
you safe
so there's a lot of cars out there
performance cars like corvettes
the toyota subra where the traction
control and the stability control
systems
are tuned for the performance of those
cars and
also the likelihood of you crashing if
you turn those systems off
increases a lot when compared to slower
cars
with team o'neill they're racing and
teaching on
sometimes base ford fiestas that when
you lose traction
or you slip the wheels you're not
getting in as much trouble as if you
were in a much faster car
and uh that's really represented by this
article from road and track about
turning off stability control
they say the the author says that the
fact is that you can get them
most cars to within two or three seconds
of their best lap time with all these
systems turned on
now um getting past just the safety
aspects of this
and my um and the disclaimers
you might be asking why am i trying to
race and why
uh why am i getting what started this
talk
and it really is that i want to share my
love of cars and racing with
my son if uh if i really just wanted to
race for myself
i would buy another 90s miata that has
none of these safety features
and uh and add safety features like a
rollover bar
and proper seats um
but really i want to share this with my
son and
i was really inspired by jalopnik's
will it baby line of like articles where
they
test different cars and come up with
can you transport your little ones in it
and still have fun
and so i test drove a large number of
different cars
and from the fiat 500 to the pacific si
a lot of cars that they recommended
unfortunately the miata didn't make a
cut
but i did end up on a what i thought as
like a
compromise between hot hatches when i
did the test drives i
i realized that i either wanted a
a fast manual transmission car or a car
that
had a single speed and didn't have the
lag of an automatic transmission
and i came upon the sparky v
while researching electric cars and
coming across this car and driver
article
about the 2014 2013-2014 compliance cars
and they were super impressed by the
spark it was the quickest
car that they had which is still close
slow when you look at like hot hatch
uh other hot hatches like the fiat 500
it was getting 0 to 60 in in mid 7 mid
to i7's but uh
i decided to give this car a try and um
when i uh
when i started driving it more and more
i realized that the traction control was
going to be a huge
issue so um that's that's the reason
that um that's really the motivation
behind this talk
um moving on to esc itself
esc is a system that detects when
vehicle steering is going in an
unintended direction when the vehicle is
going the wrong way
compared to the direction that the
driver wants to take it
and it compensates that
understeer or oversteer by using single
wheel braking in the abs system
the esc components most electronic
stability control
systems include a electronic stability
control module
in this case the chevy calls that the
electronic brake control module
um sensors for the throttle the pedal a
sensor for each wheel to detect wheel
slip
um the angel like anti-lock brake system
modulator which would
is able to break each of the four wheels
and then a number of other sensors
including the twerk angle sensor
yaw rate and steering angle
to sum this up the you can think of the
electronic stability control as an
add-on on top of abs
and it takes the
sensors and the components are required
for abs
and it adds a yaw sensor and a steering
wheel angle sensor to detect
the um the intended direction and the
direction the car is going now
knowing those components um one of the
first steps i took
was trying to pull the fuses team o'meal
has a lot of good
videos on
how to disable the different safety
systems
and they recommend pulling the fuses
first so i went through my owner's
manual and i found that there were four
different fuses
there was an abs pump fuse a valve fuse
an
oil feeding fuse and a fuse for the
computer itself the ebcm fuse
out of all these i had the best results
with the valve fuse
um the pump and oil fuse didn't come up
with any results
other than a check engine light and the
evcm
fuse cut half the power to the epcm
where the traction control system still
seemed to be enabled
but uh the throttle was still
being cut even though
even though it wasn't doing the same
braking as before
so i pulled the abs valve fuse and i
immediately got a message
for service to build track so that means
that the stability track
system is disabled and that worked out
great i was able to
drive with uh i was able to produce
understeer i was able to
do skid um the car wasn't being
cut off on power and it worked pretty
well the brakes didn't seem
like they were up to up to the previous
performance with stability track enabled
um but it worked well for the first
ignition
switch when i turned the car off and
turned it back on
i got a service brake assist message
and the power uh brakes on the car
actually
cut off uh so on that next ignition
cycle
i had no power brakes it may break in
really hard so i quickly put the fuse
back in
and uh this turned out to be not a
tenable solution because
it messes with the power brakes even and
i would have to pull
pull and put the fuse back in for each
ignition cycle
and also it seemed to disable the
electronic brake distribution that
controls the brake bias
and that's the the braking that the car
does uh the percentage of braking that
it that it does between the front and
rear wheels
so i moved on from there and i decided
to go after the rest of the attack
service
starting with the yaw sensor i uh
i know i just bought the car but i
quickly pulled the interior
i pulled the seats out i pulled the
carpet out i started
searching everywhere in the car for the
off sensor and i couldn't find it
uh at the same time i was checking
chilton diy and all data that had
service manuals for this newer car
a relatively newer car and the only
thing that the chilter manual said was
that the yaw sensor would take an hour
to be replaced
it didn't say where the yaw sensor was
it said how to calibrate it
but didn't say where it was in the car i
checked on forums
i uh i learned a little bit more about
the yaw sensor and how it works
that should be in the center of mass and
i still couldn't find it
inside the car i even talked to the
local parts dealer
and they said that it just doesn't exist
the yaw sensor part doesn't exist
so it must be included in another
component
or they may have a simulator and that
could be why it's cutting in
so much for people who drive the sparky
v
um so i had to move on from there
and i moved to the steering sensor if i
could maybe unplug the steering sensor i
might be able to disable
just the stability track and not the abs
um the ebcm when i looked up
for the steering angle sensor um
when i tried to get to it i couldn't get
to it without pulling the steering wheel
and that involved when i looked into
the uh the specifics on it 150
steering wheel puller from chevy and uh
i also at that point tried to go after
the ebcm
and the unfortunately the ebecm is not
accessible um unless you go
through the radiator and take the
radiator out
in the electric spark they
mounted the edcm under the
car battery and behind the
radiator so it's really hard to get to
from there i was inspired um by an
article by rapid7 on building car
hacking development workbench
uh to try to put together a workbench
for a gas
sparky b because there were no sparky
bees at the local pole parts
near my house uh finally i found a spark
pb a gas rbv
made it out to the junkyard and
immediately found the yaw sensor that
was super frustrating i was excited but
it was uh it was right under where
the noisemaker is the pedestrian
noisemaker is
on the electric version of the car and i
was
able to pull it out of the junkyard car
in like five minutes
the uh abs module was super easy to pull
um for the jump for the gas
part because it was right where you
would expect the brake modules to be
easily accessible from the hood so i
pulled the abs module
which included the edcm and i
pulled the yaw sensor and i tried
pulling the rest of the
wiring harness but i quickly went over
my
estimated effort on pulling this and it
ended up having to cut the wiring
harness
because of the time limit i i wasn't
able to create a full harness but i was
able to pull the ebcm
module which is on the lower half of
this picture here and hook it up to a
bench power supply
after hooking it to the bench though it
didn't power on correctly
the voltage was lower um i found some
pads
i have the evcn module here i found some
pads inside the module i made some
uh wire cut offs to like
access the diagnostic pads but the
um module itself or the uh when i hooked
a multimeter up to it
it came into uh it produced a fraction
of a vault so i knew something was wrong
and that ended up being a dead end
so um that's kind of
where my research stops at this point
if uh i plan on racing in the next month
so i'm gonna try and go after a few
other future attack paths the first one
is that i
i believe that i can decode the traction
control shutoff message
from the physical switch that's in the
center console
um it it hooks into the body control
module which is a separate module that
controls auxiliary functions in the car
and appears to only talk to the edcm
over
can bus so i'm going to attempt to see
if there's
any messages that can further disable
the
tracks to build a track or at least make
it easier to disable
the second option is uh i believe i can
get to the ebcm
through the front driver side wheel well
uh i've used this trick before when
changing
uh oil and when trying to access
components in cars
sometimes the manufacturer says to do it
one way
and uh you're able to go through the
wheel well on
one side or the other to access
something that
uh that would normally take a much
longer amount of time
and then finally i'm going to build
another non-ev stabilitrak bench
in a car that doesn't require a steering
wheel puller i know the chevy cruze
doesn't require that
thankfully my junkyard has about five
chevy cruises
uh so the local junkyard
seems like the best bet for that
and from there i would be able to start
reversing each of the components and
observe them
by hooking up a logic analyzer while the
system is
more functional
um going on the lessons learned uh
while i had the interior out on the
spark i
i thought you know i traced all of the
modules in the interior
and one of them was onstar which i don't
have a subscription for
and i don't need for racing like i'm not
going to be calling on star
anytime soon especially in an electric
car that only gets 80 miles range
um so i decided to pull the onstar
module
and immediately the check engine light
came on i was like okay that that's kind
of expected
and i started driving and um
the first time this happened i made it
onto one of the main roads
uh or closer roads near my house and the
propulsion for the power was cut
uh the uh it came up with this
propulsion powers reduced message and
i was like okay this isn't too bad i
should be able to make it home fine
um i'm still getting like 14 kilowatts
in this screenshot
or in this picture of a power you know
that's still a decent amount of
acceleration
but then while i was driving i hit 20
miles per hour
and it drastically kept power um
it said speed limit set to 20 miles per
hour
on the uh on the message and uh
then uh the
i i floored the um the accelerator
and it only gave me like one or two
kilowatts
of propuls of energy for going to the
motor
that meant that the miles per hour was
only incrementing like
once every two or three seconds so it
was a really scary moment
um but i want to learn from it and my
plan is to
figure out why the onstar system does
this
when you unplug it the only thing i can
think of is
um for immobilizing in the event that
somebody stole the car and tried to
disable onstar by unplugging it because
it's easily accessible
um the other thing i want to see is
could this be triggered by canvas
messages
or by by uh flooding the can bus with
the
the onstar messages
or the lack of a non-start like uh
basically silencing the onstar messages
the other lesson was pretty unfortunate
too
uh and that was bring a scope to the
inspection now the chevy spark
uh ev has a lot of plastic cladding they
tried to hide
kind of that it's an electric vehicle
and uh all this plastic
cladding meant that during when i went
to buy the car
and when i looked in the engine bay i
didn't see any problems
everything seemed fine um but when i
actually pulled the plastic off to try
to get to the ebcm i came across this
nest here
and it's using like insulation from the
car
and a bunch of sticks i discovered the
nest and i was like oh no birds moved in
but then i started looking more through
it and looking at the components of the
car and i found mouse droppings
so i definitely recommend getting it the
like 25
scope from harbor freight or from online
a usb scope
and looking around in the engine bay
when you're going to buy a used car
i haven't seen that recommendation in a
lot of places for when inspecting a used
car but
it would have saved me on this
thankfully it seems that the mice
really didn't like the orange cables the
high voltage cables in the car but it
looks like i'm gonna have to replace
at least one or two ground straps before
i take the car
on a track um
and that's my talk uh thank you car
hacking village
i want to thank um
[Music]
uh thank you for giving me the
opportunity to uh
to speak and i wanted to thank everyone
that helped me with my research my
coworkers
i definitely want to thank my family my
wife especially for
dealing with a car that had like no
interior i still wouldn't put
the carpet back in the car um and i
really appreciate you
[Music]
taking the time to listen to my talk
these are
a bunch of links that um that i want to
include
uh for what i came across
a lot of it is covered throughout the
talk
but i just wanted to also mention the
chilton diy
and all data was really useful and the
easy way for me to get
access to the service data last thing i
wanted to mention is i'm going to be at
defcon
in person and i'll be on the discord
so if you have any questions and you're
not able to ask in the q
a feel free to track me down talk to me
on
discord or dm me on twitter
thanks everyone
you