CAR HACKING VILLAGE - Automotive Evidence Collection – Automotive Driving Aids and Liability
CC Attribution 3.0 Unported:
You are free to use, adapt and copy, distribute and transmit the work or content in adapted or unchanged form for any legal purpose as long as the work is attributed to the author in the manner specified by the author or licensor.
Vlad
The presentation will cover security implications of GPS and positioning attacks. We will discuss real world attacks and incidents. We will touch upon increased reliance on positioning data in accident reconstruction and assistive driving technologies.
 My specialties are primarily SCADA systems, automotive systems, medical device testing. Essentially, I really like embedded systems, anything that impacts modern life as we know it. A lot of times we work with wireless systems and airborne systems. Quick disclaimer, obviously opinions are my own, not my employer's. They're not taking any particular vendors. Even though we try to remove logos, some things are just going to be way too obvious about who things belong to. In some cases, when we actually point out the vendor, they're the vendor who are doing things slightly better than others. So, since we're talking about automotive forensics, this is where the story usually starts. Havreck, possibly some fatalities, perhaps a fire that won extinguish for two or three days. You all see the headlines. There's often a crash and you see a sensationalized story in the newspaper about the particulars of the crash. How fast the vehicle may have been traveling about what the driver may or may not have been doing, what the driver may or may not have been using, such as a cell phone or a DVD player at the time. And I'll point out that the article mentions a black box. I'm sure you've heard all of them about the mention of black box with airplane crashes. Your vehicle also has a black box. When investigators are working a crash or some kind of an incident, their primary source of data is a black box. Since the black box is actually regulated by Congress, there's a law about what the black box stated on the vehicle is supposed to contain and for how long. Other common sources, many of our vehicles now have a GPS. If you have one of your luxury vehicles, you may have a LiDAR. You and your passenger will very likely have a phone which will also be recording data and shoveling it back to Apple or Google, Chinese government, all three. You're typically running a slew of apps including Waze, Google, again, Apple Play, a number of other applications which may be uploading in real time. You may be running an external GPS unit such as one of those Garmin units which constantly puts breadcrum along your route. Again, reliable source of data, mostly. Quick mention on LiDAR, there's two types of LiDAR systems. One that performs real time acquisition and another which simply tries to get a baseline and contains internal database of supposedly all the roads that you're supposed to be able to get. And Shen tries to do a quick pattern matching. Again, most modern phones, unless you have a flip phone, has a built-in GPS, has obviously cellular connections so it's doing GPS trail iteration in order to be E-911 compliant. It's constantly trying to determine its position and point in time. And of course it's using Wi-Fi technology such as Skyhook, again to help narrow down its location. Even if Bluetooth and GPS are off or don't currently have a signal. External GPS units, even US units, in addition to the GPS system, typically have glossiness, Galileo. If you're in APAC, you may also be using BydeU or IR NSS. Typical GPS threats, again, we have jamming, spoofing, and detection. We have RF jamming, which is simply filling up the radio frequency, whether it's L1, L2, or L3 band. Or you can actually have more sophisticated protocol jamming where you're actually trying to speak GPS protocol, but broadcasting inaccurate data may actually cause seg faults on some of the external units or cause them to lock up. As opposed to just not being able to receive a signal on the typical bands. You can have an active degradation attack where the quality of the signal may drop from being able to position yourself within 3 meters or 5 meters to within several hundred meters. That would obviously complicate forensics or any kind of incident investigation. One of the less common attacks is actually enhanced accuracy. It makes the victim think that they actually have a far better idea of where they are than they actually do. You can actually make somebody who has, for example, 500 meter accuracy think that they have 1 meter accuracy, which is fine granular, which is basically this amount of space right here. And may make them act rashly or a dry passer because they think they know exactly where they are or where they're headed. And of course you have location spoofing. Much more sophisticated, more advanced timing attack, requires more hardware, but it has been seen in the wild. Of course you don't really even have to have a sophisticated attack because people will follow their GPS anywhere. It's 2018 and this is a screenshot from an old story, but usually I can find five or six of these every single year. And where the car is says turn left and says about ramp and people will drive right in. Please call the alarm. They determined there is no emergency. We are sorry for any inconvenience. GPS spoofing, as I mentioned. Please call the alarm. They determined there is no emergency. We are sorry for any inconvenience. Fairly sophisticated attack requires a lot of resources. More commonly seen at nation state level, but we have seen it at the sophisticated criminal level. It has been more successful used against ships. First of all, they're isolated there. They're in the middle of an ocean. There's no street signs. There's no Wi-Fi or other assistive technology. And they tend to be a more attractive target. It's possible to obviously divert the ship into unsafe shipping channels, divert the ship towards an underwater obstruction when the ship capped and actually things that they're sailing through a clear channel. GPS jamming is dirt cheap. As little as $12 in some cases from the dongles that we've seen. From the informal testing that we've done, something like that can actually affect three to four cars around the vehicle that's actually using it. So these are sold to prevent employee tracking. So if an employer issues you a vehicle, for example, and they want to know where you are, an employee who may want to fuck off during lunch will plug one of these in and their employer is not going to be able to track them, except it will also affect the number of vehicles around them. And then we have some significantly more advanced packages. Some like that will impact several city blocks quite a bit further. We have a thing in radio, height makes might. So for example, you would take this up in a helicopter with you or to 52nd floor. You're going to have a much better footprint. And sadly it's not a nation state level attack. It's around $2,000, which again for sophisticated attackers, pocket change. There's very few solutions in the market for detecting GPS jamming or especially GPS spoofing. We're not going to get too deep in this demo. Before we move on further, quick definition of where this positioning. It's not simply location. It's a, you want to know your location at a given point in time. Simply saying your home is not enough, we need to know that your home is between certain hours. And you want to know change location over time. You want to know when you got to the location and when you left that location. Otherwise the location data is essentially worthless for investigation. So the so-called vehicle black box, it's actually, well, it's usually not black. It's actually called an event data recorder. The Congress has mandated every vehicle produced since 2014, have one. It typically has five to 20 seconds loop of data recorded continuously written. And once the body impact center, one of the other crash detection or crash prevention systems detects an event, it's going to start saving the data. And if everything works correctly, it's going to prevent eProm from being overwritten, which actually doesn't work too well. So there's 15 data points which have to be written by law. Most systems today use around 30 data points. Some of the most common ones are obviously velocity, which is how we know the vehicle is doing 120 miles an hour. Throttle position. If you've seen some of the headlines about the gas pedal or the brake pedal being stuck, that's how you determine if the driver was lying or if the driver confused the gas and brake pedal. If they were going full throttle or actually trying to brake. Seat belt use, very useful in post-mortem, if the driver didn't survive or in litigation with the manufacturer. Steering. We can determine whether or not somebody, you know, is going to spur towards the crowd or away from the crowd and if the vehicle is skidded. And of course, airbag deployment. So as much as I hate to mention Tesla, actually Tesla gives us a really good data point whether or not somebody's hands burn the wheel. Again, essential for investigation because we want to know if the human was driving or if the driving assistant was driving. It's not an autopilot, it's a driving assistant. Eye focus. There is an internal camera which can actually determine if you're looking straight ahead or if you're looking down on your phone or messing around with the DVD player. And if the vehicle is equipped with LiDAR, it actually is able to save LiDAR data. For some reason I can't get the slide to, oh, okay, it is playing. Cool. So this is actually what a crash looks like from the standpoint of a Tesla. This was a crash in a parking lot and this was actually the vehicle driver's fault. They confused the gas and the brake pedal and they hit the townhouse. So a pretty useful investigation combined with other data. For those of you who know a little bit about forensics, everything, even if there is no standard for how something should be done, you have to use scientific methodology, meaning the steps should be recorded, they should be repeatable. You need to be able to measure the error rates and prove what the error rates are. And you need to try to align them with some sort of industry standard that already exists, whether in automotive investigation or in computer forensics. There's three main ways to interrogate the so-called black box or the event data recorder. One is roughly a $12,000 toolkit. One is directly over OBD2 port, which is not supported by every manufacturer. And the other way is to actually crack the device open and connect directly to the eProm. Tools, as I mentioned, they are public. You can buy them. All you have to do is send a $12,000 check. They also take credit cards. They refuse to send me every sample. The nerve. Some especially US vehicles do support communication over CAN bus. So if you actually know the commands, you can download data from the event data recorder over the OBD2. The communications are encrypted. Again, on certain forms, you can get your hands on the keys, but it's a little bit problematic. This method, the biggest issue, of course, is that it induces data changes. Meaning as you're reading the data, you're actually introducing error data. If the black box failed to record data from one of the sensors, which is very common, it's actually going to write error data. So the crash is a pretty violent event. And right now, when you're sitting down, you're exposed to one G force. During an impact, your vehicle can experience as much as 26 Gs of force, meaning a lot of electronics, even hardened electronics, will fail. So it's not then common to not receive data from sensors for the last few seconds. Again, crashes are non-sensitaneous events. It's an elastic collision. It can actually last three to five seconds as all your crumple zones meet their final position. This third method is the actually preferred method if you only have access to a $12,000 tool and you don't want to cause data spoilation. Looks a little overwhelming. All you have to do is find your event data recorder, crack it open, find the eProm chip, connect the clips, connect the bus pirate, and start dumping data. And hopefully not find anything in the meantime, and hopefully videotape everything or preserve data to essentially prove to court if it comes to that what the data was at the time of collection. I actually have a device with you if you want to practice later in a car hacking village. This is an event data recorder that was pulled from an American vehicle. Don't look at the label. This vehicle was involved in a crash, but the airbags did not deploy. So some of the interesting things with this, privacy concerns. Many states do not have laws about how or when the data can be pulled from your event data recorder. Even though you own the vehicle, you essentially don't always have a say in whether or not the data can or should be pulled from your vehicle. You've seen the data pulled in divorce cases, which is absolutely idiotic because I mentioned they can save up to 20 seconds. But some attorneys know that they record vehicle position and they get a court order to pull data from a car. And it gets them absolutely nothing useful, but the judge grants them the warrant. This data is not remotely accessible. There should be a star next to that. The one exception is Tesla. The other exception is that the data is stored remotely offsite. We've actually been able to prove that some super outbacks also store some data offsite. The luxury models that are fitted with 4G modem will upload and sync data opportunistically. So 12 states do have court rulings about search warrant being required by the vehicle. That means that 38 states currently do not. The data is considered the property of the vehicle owner. However, after a crash, if your vehicle was towed, you essentially lose control of the vehicle. The tow truck driver can consent on your behalf or the police investigator can go out to the garage where your vehicle is stored and start pulling off data because there are no hard laws about that. So we mentioned... Even in case there were no warrant required? Even in case there weren't warrant required, the police can still go and pull the data and after the fact, see the act in good faith. So unless you have a law in standby that will go and issue an emergency injunction, you are so well because the data is already being pulled off your vehicle and the judge will just rule the police act in good faith. I mentioned civil lawsuits. You have the case of people being hurt in an accident and the dispute is whether over or not... the accelerator was pressed down or whether or not the brake was deployed. And again, whether or not the person caused the crash by looking down at their phone or whether their automotive driving assistance action caused the crash. Right now, there are several interesting cases in the courts, both in the United States and China about liability in the case of the driving assistant and being the primary cause of the crash. As I mentioned, two primary methods of access. We have the diagnostic port, which for those of you that don't know is this OVD-2 port that all of your vehicles have unless you have a vehicle prior to 1992 and 1996. And you have the airbag module, also known as the body impact module. Sometimes they're combined together into one single unit. If they are combined together, it looks a little bit like that. Now, typically found under the driver seat or in between the driver and passenger seat. It's bolted in pretty well because again, you need to be able to feel the impact of the vehicle, feel acceleration, deceleration. It has a number of sensors on board and encryption module, which is supposed to encrypt the communication between the CAN bus and the eProm chip. And a completely unprotected eProm chip with no tamper detection and no tamper protection. So, direct access over OVD-2 is pretty straightforward. Now we get to the part of don't try this at home. I'm supposed to tell you that there's a liability because this module can trigger your airbag. In a vehicle with multiple airbags, it actually can kill you because an airbag deploying does produce enough force to fracture your skull. It does have built-in protection, meaning if there's an electrostatic discharge, it's going to err on the side of caution and deploy the airbags. As I mentioned, the airbag module is often integrated with the black box. This particular one isn't, but this is actually more of an exception to the role. The states that currently have regulations about who can have access to data and when. As I mentioned, the other 35 states are undetermined right now because there's insufficient court rulings or no court rulings. No cases have come up to the federal level as of yet. We are monitoring the case in China. That's due in court, we believe, in October. So that's going to be really interesting. So some interesting takeaways. The eProm chip on board, once you crack the case open, as I mentioned does not have tamper detection or tamper protection. The chip cannot know when it was last accessed or if the data was written properly by the car sensors or if I opened the chip, opened the body prior and wrote air and data to the chip just before the investigators got their hands on it. No tamper detection. For example, the black box in steering your vehicle could be modified. There's no way to externally determine it because there's not even a very simple seal over it. As you can see, there's not even a gold foil seal over it. So I can literally just unplug this and plug this in somebody's vehicle. No protection at all on a board or chip level. There is one manufacturer that sells hardware locks that cover your OBD2 port but it's a plastic part that covers up a plastic part so it's essentially protected by goodwill. Sorry, this is a very compressed version of a one hour long presentation that just kind of shunned down to 25 minutes plus a fire alarm. But if anybody has any questions, you can take them now or also you're welcome to play with this after the talk and try pulling data off of it. Any questions? Obviously available to answer questions over email or right outside this room and I'm not going to hold up the next speaker. Can I ask a question? Oh yeah, go ahead. Can you talk about commercial vehicles a little bit? Do you have a second? Oh yeah, absolutely. So commercial vehicles such as 18-wheelers also have these sensors. The lock covered not just personal vehicles so trucks do have them as well. They actually typically have more loggers because there's a separate one for the cargo compartment and a separate one for the actual rig. Modern trucks also collect a lot more data. It'll be interesting to see what the Tesla truck is but some of the... But a lot of truckers now use dash cams which again would make great evidence. Truckers are very annoyed with cars cutting them off because they're big and slow and they do really annoying things like follow the speed limit. But I have not had a chance to steal a black box from a truck but my understanding is that they work exactly the same way, simply because of the regulations. They didn't distinguish between buses, trucks or passenger vehicles. The legislation only covers the United States but because the US is such a major consumer, the vehicles that are made to serve the US market are also very similar vehicles to what's made for other countries so the black box is still in there. We know that the vehicles that crash, for example, Saudi Arabia, have the same black boxes because again, you see the same headlines with the same data being pulled up. And again, as I mentioned, there's integration for the airbag deployment. Yes? Are they putting anything like ultra caps on the board so that if you lose vehicle power during the crash, it will keep clogging? Good question. Yes, one of the screenshots I had, you can actually see a good size capacitor on it. I'm trying to find the screenshot in a hurry. So yes, there is a large capacitor. From what we've seen, it will give you about 12 seconds of data. The collision data that I've had access to had lasted for maybe five seconds. At least the important stuff. Thank you. Welcome. All right, thank you folks for coming.
 My specialties are primarily SCADA systems, automotive systems, medical device testing.  Essentially, I really like embedded systems, anything that impacts modern life as we know it.  A lot of times we work with wireless systems and airborne systems.  Quick disclaimer, obviously opinions are my own, not my employer's.  They're not taking any particular vendors.  Even though we try to remove logos, some things are just going to be way too obvious about who things belong to.  In some cases, when we actually point out the vendor, they're the vendor who are doing things slightly better than others.  So, since we're talking about automotive forensics, this is where the story usually starts.  Havreck, possibly some fatalities, perhaps a fire that won extinguish for two or three days.  You all see the headlines.  There's often a crash and you see a sensationalized story in the newspaper about the particulars of the crash.  How fast the vehicle may have been traveling about what the driver may or may not have been doing,  what the driver may or may not have been using, such as a cell phone or a DVD player at the time.  And I'll point out that the article mentions a black box.  I'm sure you've heard all of them about the mention of black box with airplane crashes.  Your vehicle also has a black box.  When investigators are working a crash or some kind of an incident, their primary source of data is a black box.  Since the black box is actually regulated by Congress, there's a law about what the black box stated on the vehicle is supposed to contain and for how long.  Other common sources, many of our vehicles now have a GPS.  If you have one of your luxury vehicles, you may have a LiDAR.  You and your passenger will very likely have a phone which will also be recording data and shoveling it back to Apple or Google, Chinese government, all three.  You're typically running a slew of apps including Waze, Google, again, Apple Play, a number of other applications which may be uploading in real time.  You may be running an external GPS unit such as one of those Garmin units which constantly puts breadcrum along your route.  Again, reliable source of data, mostly.  Quick mention on LiDAR, there's two types of LiDAR systems.  One that performs real time acquisition and another which simply tries to get a baseline and contains internal database of supposedly all the roads that you're supposed to be able to get.  And Shen tries to do a quick pattern matching.  Again, most modern phones, unless you have a flip phone, has a built-in GPS, has obviously cellular connections so it's doing GPS trail iteration in order to be E-911 compliant.  It's constantly trying to determine its position and point in time.  And of course it's using Wi-Fi technology such as Skyhook, again to help narrow down its location.  Even if Bluetooth and GPS are off or don't currently have a signal.  External GPS units, even US units, in addition to the GPS system, typically have glossiness, Galileo.  If you're in APAC, you may also be using BydeU or IR NSS.  Typical GPS threats, again, we have jamming, spoofing, and detection.  We have RF jamming, which is simply filling up the radio frequency, whether it's L1, L2, or L3 band.  Or you can actually have more sophisticated protocol jamming where you're actually trying to speak GPS protocol, but broadcasting inaccurate data may actually cause seg faults on some of the external units or cause them to lock up.  As opposed to just not being able to receive a signal on the typical bands.  You can have an active degradation attack where the quality of the signal may drop from being able to position yourself within 3 meters or 5 meters to within several hundred meters.  That would obviously complicate forensics or any kind of incident investigation.  One of the less common attacks is actually enhanced accuracy.  It makes the victim think that they actually have a far better idea of where they are than they actually do.  You can actually make somebody who has, for example, 500 meter accuracy think that they have 1 meter accuracy, which is fine granular, which is basically this amount of space right here.  And may make them act rashly or a dry passer because they think they know exactly where they are or where they're headed.  And of course you have location spoofing. Much more sophisticated, more advanced timing attack, requires more hardware, but it has been seen in the wild.  Of course you don't really even have to have a sophisticated attack because people will follow their GPS anywhere.  It's 2018 and this is a screenshot from an old story, but usually I can find five or six of these every single year.  And where the car is says turn left and says about ramp and people will drive right in.  Please call the alarm. They determined there is no emergency. We are sorry for any inconvenience.  GPS spoofing, as I mentioned. Please call the alarm. They determined there is no emergency. We are sorry for any inconvenience.  Fairly sophisticated attack requires a lot of resources. More commonly seen at nation state level, but we have seen it at the sophisticated criminal level.  It has been more successful used against ships. First of all, they're isolated there. They're in the middle of an ocean.  There's no street signs. There's no Wi-Fi or other assistive technology. And they tend to be a more attractive target.  It's possible to obviously divert the ship into unsafe shipping channels, divert the ship towards an underwater obstruction when the ship capped and actually things that they're sailing through a clear channel.  GPS jamming is dirt cheap. As little as $12 in some cases from the dongles that we've seen.  From the informal testing that we've done, something like that can actually affect three to four cars around the vehicle that's actually using it.  So these are sold to prevent employee tracking. So if an employer issues you a vehicle, for example, and they want to know where you are, an employee who may want to fuck off during lunch will plug one of these in and their employer is not going to be able to track them, except it will also affect the number of vehicles around them.  And then we have some significantly more advanced packages. Some like that will impact several city blocks quite a bit further. We have a thing in radio, height makes might.  So for example, you would take this up in a helicopter with you or to 52nd floor. You're going to have a much better footprint.  And sadly it's not a nation state level attack. It's around $2,000, which again for sophisticated attackers, pocket change.  There's very few solutions in the market for detecting GPS jamming or especially GPS spoofing. We're not going to get too deep in this demo.  Before we move on further, quick definition of where this positioning. It's not simply location. It's a, you want to know your location at a given point in time.  Simply saying your home is not enough, we need to know that your home is between certain hours. And you want to know change location over time.  You want to know when you got to the location and when you left that location. Otherwise the location data is essentially worthless for investigation.  So the so-called vehicle black box, it's actually, well, it's usually not black. It's actually called an event data recorder.  The Congress has mandated every vehicle produced since 2014, have one. It typically has five to 20 seconds loop of data recorded continuously written.  And once the body impact center, one of the other crash detection or crash prevention systems detects an event, it's going to start saving the data.  And if everything works correctly, it's going to prevent eProm from being overwritten, which actually doesn't work too well.  So there's 15 data points which have to be written by law. Most systems today use around 30 data points.  Some of the most common ones are obviously velocity, which is how we know the vehicle is doing 120 miles an hour.  Throttle position. If you've seen some of the headlines about the gas pedal or the brake pedal being stuck,  that's how you determine if the driver was lying or if the driver confused the gas and brake pedal.  If they were going full throttle or actually trying to brake.  Seat belt use, very useful in post-mortem, if the driver didn't survive or in litigation with the manufacturer.  Steering. We can determine whether or not somebody, you know, is going to spur towards the crowd or away from the crowd and if the vehicle is skidded.  And of course, airbag deployment.  So as much as I hate to mention Tesla, actually Tesla gives us a really good data point whether or not somebody's hands burn the wheel.  Again, essential for investigation because we want to know if the human was driving or if the driving assistant was driving.  It's not an autopilot, it's a driving assistant.  Eye focus. There is an internal camera which can actually determine if you're looking straight ahead or if you're looking down on your phone or messing around with the DVD player.  And if the vehicle is equipped with LiDAR, it actually is able to save LiDAR data.  For some reason I can't get the slide to, oh, okay, it is playing. Cool.  So this is actually what a crash looks like from the standpoint of a Tesla.  This was a crash in a parking lot and this was actually the vehicle driver's fault.  They confused the gas and the brake pedal and they hit the townhouse.  So a pretty useful investigation combined with other data.  For those of you who know a little bit about forensics, everything, even if there is no standard for how something should be done,  you have to use scientific methodology, meaning the steps should be recorded, they should be repeatable.  You need to be able to measure the error rates and prove what the error rates are.  And you need to try to align them with some sort of industry standard that already exists,  whether in automotive investigation or in computer forensics.  There's three main ways to interrogate the so-called black box or the event data recorder.  One is roughly a $12,000 toolkit.  One is directly over OBD2 port, which is not supported by every manufacturer.  And the other way is to actually crack the device open and connect directly to the eProm.  Tools, as I mentioned, they are public.  You can buy them.  All you have to do is send a $12,000 check.  They also take credit cards.  They refuse to send me every sample.  The nerve.  Some especially US vehicles do support communication over CAN bus.  So if you actually know the commands, you can download data from the event data recorder over the OBD2.  The communications are encrypted.  Again, on certain forms, you can get your hands on the keys, but it's a little bit problematic.  This method, the biggest issue, of course, is that it induces data changes.  Meaning as you're reading the data, you're actually introducing error data.  If the black box failed to record data from one of the sensors, which is very common,  it's actually going to write error data.  So the crash is a pretty violent event.  And right now, when you're sitting down, you're exposed to one G force.  During an impact, your vehicle can experience as much as 26 Gs of force,  meaning a lot of electronics, even hardened electronics, will fail.  So it's not then common to not receive data from sensors for the last few seconds.  Again, crashes are non-sensitaneous events.  It's an elastic collision.  It can actually last three to five seconds as all your crumple zones meet their final position.  This third method is the actually preferred method if you only have access to a $12,000 tool  and you don't want to cause data spoilation.  Looks a little overwhelming.  All you have to do is find your event data recorder, crack it open, find the eProm chip,  connect the clips, connect the bus pirate, and start dumping data.  And hopefully not find anything in the meantime, and hopefully videotape everything  or preserve data to essentially prove to court if it comes to that  what the data was at the time of collection.  I actually have a device with you if you want to practice later in a car hacking village.  This is an event data recorder that was pulled from an American vehicle.  Don't look at the label.  This vehicle was involved in a crash, but the airbags did not deploy.  So some of the interesting things with this, privacy concerns.  Many states do not have laws about how or when the data can be pulled from your event data recorder.  Even though you own the vehicle, you essentially don't always have a say in whether or not  the data can or should be pulled from your vehicle.  You've seen the data pulled in divorce cases, which is absolutely idiotic  because I mentioned they can save up to 20 seconds.  But some attorneys know that they record vehicle position and they get a court order to pull data from a car.  And it gets them absolutely nothing useful, but the judge grants them the warrant.  This data is not remotely accessible.  There should be a star next to that.  The one exception is Tesla.  The other exception is that the data is stored remotely offsite.  We've actually been able to prove that some super outbacks also store some data offsite.  The luxury models that are fitted with 4G modem will upload and sync data opportunistically.  So 12 states do have court rulings about search warrant being required by the vehicle.  That means that 38 states currently do not.  The data is considered the property of the vehicle owner.  However, after a crash, if your vehicle was towed, you essentially lose control of the vehicle.  The tow truck driver can consent on your behalf or the police investigator can go out to the garage where your vehicle is stored  and start pulling off data because there are no hard laws about that.  So we mentioned...  Even in case there were no warrant required?  Even in case there weren't warrant required, the police can still go and pull the data  and after the fact, see the act in good faith.  So unless you have a law in standby that will go and issue an emergency injunction,  you are so well because the data is already being pulled off your vehicle  and the judge will just rule the police act in good faith.  I mentioned civil lawsuits.  You have the case of people being hurt in an accident and the dispute is whether over or not...  the accelerator was pressed down or whether or not the brake was deployed.  And again, whether or not the person caused the crash by looking down at their phone  or whether their automotive driving assistance action caused the crash.  Right now, there are several interesting cases in the courts,  both in the United States and China about liability in the case of the driving assistant  and being the primary cause of the crash.  As I mentioned, two primary methods of access.  We have the diagnostic port, which for those of you that don't know is this OVD-2 port  that all of your vehicles have unless you have a vehicle prior to 1992 and 1996.  And you have the airbag module, also known as the body impact module.  Sometimes they're combined together into one single unit.  If they are combined together, it looks a little bit like that.  Now, typically found under the driver seat or in between the driver and passenger seat.  It's bolted in pretty well because again, you need to be able to feel the impact of the vehicle,  feel acceleration, deceleration.  It has a number of sensors on board and encryption module,  which is supposed to encrypt the communication between the CAN bus and the eProm chip.  And a completely unprotected eProm chip with no tamper detection and no tamper protection.  So, direct access over OVD-2 is pretty straightforward.  Now we get to the part of don't try this at home.  I'm supposed to tell you that there's a liability because this module can trigger your airbag.  In a vehicle with multiple airbags, it actually can kill you  because an airbag deploying does produce enough force to fracture your skull.  It does have built-in protection, meaning if there's an electrostatic discharge,  it's going to err on the side of caution and deploy the airbags.  As I mentioned, the airbag module is often integrated with the black box.  This particular one isn't, but this is actually more of an exception to the role.  The states that currently have regulations about who can have access to data and when.  As I mentioned, the other 35 states are undetermined right now  because there's insufficient court rulings or no court rulings.  No cases have come up to the federal level as of yet.  We are monitoring the case in China.  That's due in court, we believe, in October.  So that's going to be really interesting.  So some interesting takeaways.  The eProm chip on board, once you crack the case open,  as I mentioned does not have tamper detection or tamper protection.  The chip cannot know when it was last accessed  or if the data was written properly by the car sensors  or if I opened the chip, opened the body prior and wrote air and data to the chip  just before the investigators got their hands on it.  No tamper detection.  For example, the black box in steering your vehicle could be modified.  There's no way to externally determine it because there's not even a very simple seal over it.  As you can see, there's not even a gold foil seal over it.  So I can literally just unplug this and plug this in somebody's vehicle.  No protection at all on a board or chip level.  There is one manufacturer that sells hardware locks that cover your OBD2 port  but it's a plastic part that covers up a plastic part  so it's essentially protected by goodwill.  Sorry, this is a very compressed version of a one hour long presentation  that just kind of shunned down to 25 minutes plus a fire alarm.  But if anybody has any questions, you can take them now  or also you're welcome to play with this after the talk  and try pulling data off of it.  Any questions?  Obviously available to answer questions over email or right outside this room  and I'm not going to hold up the next speaker.  Can I ask a question?  Oh yeah, go ahead.  Can you talk about commercial vehicles a little bit?  Do you have a second?  Oh yeah, absolutely.  So commercial vehicles such as 18-wheelers also have these sensors.  The lock covered not just personal vehicles so trucks do have them as well.  They actually typically have more loggers because there's a separate one  for the cargo compartment and a separate one for the actual rig.  Modern trucks also collect a lot more data.  It'll be interesting to see what the Tesla truck is but some of the...  But a lot of truckers now use dash cams which again would make great evidence.  Truckers are very annoyed with cars cutting them off because they're big and slow  and they do really annoying things like follow the speed limit.  But I have not had a chance to steal a black box from a truck  but my understanding is that they work exactly the same way,  simply because of the regulations.  They didn't distinguish between buses, trucks or passenger vehicles.  The legislation only covers the United States but because the US is such a major consumer,  the vehicles that are made to serve the US market are also very similar vehicles  to what's made for other countries so the black box is still in there.  We know that the vehicles that crash, for example, Saudi Arabia,  have the same black boxes because again,  you see the same headlines with the same data being pulled up.  And again, as I mentioned, there's integration for the airbag deployment.  Yes?  Are they putting anything like ultra caps on the board  so that if you lose vehicle power during the crash, it will keep clogging?  Good question. Yes, one of the screenshots I had,  you can actually see a good size capacitor on it.  I'm trying to find the screenshot in a hurry.  So yes, there is a large capacitor.  From what we've seen, it will give you about 12 seconds of data.  The collision data that I've had access to had lasted for maybe five seconds.  At least the important stuff.  Thank you.  Welcome.  All right, thank you folks for coming.
DEF_CON_26_CAR_HACKING_VILLAGE_-_Vlad_-_Evidence_Collection_Automotive_Driving_Aids__0_215.png DEF_CON_26_CAR_HACKING_VILLAGE_-_Vlad_-_Evidence_Collection_Automotive_Driving_Aids__216_443.png DEF_CON_26_CAR_HACKING_VILLAGE_-_Vlad_-_Evidence_Collection_Automotive_Driving_Aids__444_1007.png DEF_CON_26_CAR_HACKING_VILLAGE_-_Vlad_-_Evidence_Collection_Automotive_Driving_Aids__1008_1955.png DEF_CON_26_CAR_HACKING_VILLAGE_-_Vlad_-_Evidence_Collection_Automotive_Driving_Aids__1956_4367.png DEF_CON_26_CAR_HACKING_VILLAGE_-_Vlad_-_Evidence_Collection_Automotive_Driving_Aids__4368_6287.png DEF_CON_26_CAR_HACKING_VILLAGE_-_Vlad_-_Evidence_Collection_Automotive_Driving_Aids__6288_7115.png DEF_CON_26_CAR_HACKING_VILLAGE_-_Vlad_-_Evidence_Collection_Automotive_Driving_Aids__7116_11495.png DEF_CON_26_CAR_HACKING_VILLAGE_-_Vlad_-_Evidence_Collection_Automotive_Driving_Aids__11496_11543.png DEF_CON_26_CAR_HACKING_VILLAGE_-_Vlad_-_Evidence_Collection_Automotive_Driving_Aids__11544_12191.png DEF_CON_26_CAR_HACKING_VILLAGE_-_Vlad_-_Evidence_Collection_Automotive_Driving_Aids__12192_13007.png DEF_CON_26_CAR_HACKING_VILLAGE_-_Vlad_-_Evidence_Collection_Automotive_Driving_Aids__13008_15155.png DEF_CON_26_CAR_HACKING_VILLAGE_-_Vlad_-_Evidence_Collection_Automotive_Driving_Aids__15156_15551.png DEF_CON_26_CAR_HACKING_VILLAGE_-_Vlad_-_Evidence_Collection_Automotive_Driving_Aids__15552_16127.png DEF_CON_26_CAR_HACKING_VILLAGE_-_Vlad_-_Evidence_Collection_Automotive_Driving_Aids__16128_16355.png DEF_CON_26_CAR_HACKING_VILLAGE_-_Vlad_-_Evidence_Collection_Automotive_Driving_Aids__16356_20615.png DEF_CON_26_CAR_HACKING_VILLAGE_-_Vlad_-_Evidence_Collection_Automotive_Driving_Aids__20616_20867.png DEF_CON_26_CAR_HACKING_VILLAGE_-_Vlad_-_Evidence_Collection_Automotive_Driving_Aids__20868_24311.png DEF_CON_26_CAR_HACKING_VILLAGE_-_Vlad_-_Evidence_Collection_Automotive_Driving_Aids__24312_24851.png DEF_CON_26_CAR_HACKING_VILLAGE_-_Vlad_-_Evidence_Collection_Automotive_Driving_Aids__24852_29891.png DEF_CON_26_CAR_HACKING_VILLAGE_-_Vlad_-_Evidence_Collection_Automotive_Driving_Aids__29892_30443.png DEF_CON_26_CAR_HACKING_VILLAGE_-_Vlad_-_Evidence_Collection_Automotive_Driving_Aids__30444_32891.png DEF_CON_26_CAR_HACKING_VILLAGE_-_Vlad_-_Evidence_Collection_Automotive_Driving_Aids__32892_34239.png