Dear viewer, these subtitles were generated by a machine via the service Trint and therefore are (very) buggy. If you are capable, please help us to create good quality subtitles: https://c3subtitles.de/talk/92 Thanks!
So, hi, welcome.
We are running a few minutes late
because, as you might have seen, we've
got a rather complicated setup
here in front.
So I'm really intrigued
about what are we going to see
now?
So this is Felix.
Felix is going to talk about computers
and cars.
Please give him a round of
one plus and
have fun.
Hey. Yeah. I'm Felix Tomeka AM.
Today's talk will be about
scripting your car.
So I did some other
hacking work before I worked on gaming
consoles, and the number
one goal for me was always to run my own
code on anything.
So I guess that should include cars.
I guess it's a valid question to ask why
would you want to do anything like that?
So I love hacking
and I love programing and I love
programing in Python, and
I don't really love cars.
I mean, they are a reasonable
way of transportation, but
I don't really love them.
I mean, I use them and I used them
way too often, actually, and I figured
out that I'm spending so much time in
a car that it would be stupid to not try
to combine hacking and programing
with cars.
And although I read this on
the internet that the next tempting
new target is your car, so
well, let's hack the car.
And I guess you all heard this, and
I guess it's true.
If you can't open it, you don't own it.
And I'm not a common canning.
If I opened the car and take
it apart, I'm pretty sure there will be
some screws left when I put it back
together and I
don't want that.
I want the car just to work, and
I don't know much about car engines.
So what's better than
work on a car engine, at least for me?
Well, it's adding python to your car,
so.
I need to be very clear on this, so
there's no misunderstanding.
So this is a python in your
car.
You don't want that.
So don't do this, this is dangerous.
Don't do this.
So this is Python in your car?
Yeah. Don't mix it up.
So this is what we actually want and this
is what this talk is about.
Python in your car.
So to add Python to my
car, I'm the entry point I choose was
the Bluetooth kit.
And that sounds boring.
I agree. So why would tagging the
Bluetooth kit would be interesting at
all? So if you look at this from a
hacker's perspective, it's a little
bit more clear because it shows up in the
car dashboard menu.
So it has the interaction to the rest
of the car, leads to the steering wheel
buttons and the dashboard menu,
and it supports internet.
And we all know, like internet enabled
cars are the future.
So sounds great
as it can play audio because
while it's Bluetooth kid, it's meant to
connect your car to your
phone, to your car's speakers
and microphones.
And the most important thing if the thing
breaks while hiking on it, I can still
drive. The car is not broken and I can
probably replace the Bluetooth kit.
So the blood of Kate is my entrance
vector to adding Python to a car.
So we have to look at where
the blood of kids is in a car.
So logically speaking.
So most cars you can actually get
schematics.
Let's unreleased schematics.
It's more like a wiring diagram.
It's more like a wall.
What the what they use to fix your car.
But it has most of the wiring.
And it can be
interesting to read that because you can
see how the different busses are
connected to each other and it
saves you from a whole lot of reverse
engineering. If you can just download
these diagrams and for example, for the
Volkswagen Group, cars like Audi's
seats that go down on
those, they have a website called Alwin
or Avin or whatever, and where you
can actually download the official
documents for a small fee so it costs
like five euro, and then you can
use one hour to just download
all the PDFs.
And if we if you
do that, there's no need to pirate those
or to get anything from
some of the weird locations.
You can just download those officially.
And if we look at this while not a modern
car, so I was told that modern cars try
to not use can anymore, and they have all
these pensare, ethernet and whatever.
I don't know about this, but the car that
I have, which is
from a few years ago, it basically
and most cars from the,
let's say, the last 10 years or so are
probably based on this.
They have multiple canvases.
So most of you probably heard what a
canvas is. It's some
bus system that's used in automotive
or that's mostly used
in automotive stuff and industrial stuff
because it's very reliable.
We will talk a little bit more about this
later. And
there are multiple canvases in the car,
so one can mostly stick to follow the
powertrain stuff that like there's the
the engine control unit that controls the
engine.
This is what like chip tuners change
to improve the car
by really flashing the firmware.
Then there's all the critical sensors,
like radar sensors for
four different types of
driving assistance.
There's like the brake control system,
the ESP, the ABAC sensors,
so that factory usually runs
at a high speed.
And then there's another canvas that
has that controls like doors and
the steering wheel stuff
and like climate and
air conditioning.
And it's called convenience can or
can for if he can.
Is some German Tums all over the place
for some reason, and it runs at a lower
speed? And then there's a third canvas
that is the infotainment can.
That's where the navigation system,
the radio, they talk to each other, the
audio amps everything.
That's not so critical.
And this is also where the phone kid
is. So it's on the on the same
basis, the the radio and so on.
All of these busses are basically
firewall, you could say to each other.
So there's the thing called Ken Gateway,
and it connects to all
the Ken busses, and it
has some rules of what messages to
forward to what bus and you can actually
send messages to to request
certain messages to be available on some
other bus.
So it's not a firewall in a security
sense, it's more to like
protect the power train can from bad
stuff happening on the radio or
something.
And there's also
most of you probably heard of the OBD two
connector, which is usually in the
driver's seat next to the
driver's seat or something where you can
download diagnostic information about
your car. It's not directly
connected to any can mass, but it
connects to the Ken Gateway and then you
can talk to Ken Gateway and then
record some messages to the rest.
But either way, so we are on the
infotainment canvas, connected
physically in the car. So this is my car
excuse. The dark place I'm
the Bluetooth key is below the passenger
seat, so you can just open that up and
remove it.
And that's how it looks like.
No screws to open, no screws to lose.
And that's the module itself.
I mean, of course, it usually does not
come with the warranty white sticker
removed. But
so that's how the blue Typekit looks
like. It's made by a company called
Neuville, which is the German company.
Again, I'm
never I've never heard of that company,
but I looked it up and it was actually
Nokia's automotive group and
they split up in 2008.
So we expect to see some Nokia
technology in there.
Maybe
if we open it up.
We see this.
So you can see that there's
a 3G modem
in it or basically a phone,
right? And there's the car
interface at the bottom.
And if we look on the other side, we
see this, which looks more interesting.
So this is not the phone. Does this stop
the car interface?
And first of all, we see is some
some microcontroller from Freescale,
and it's as 12x some
automotive stuff and some SRM for it.
And it's about
the can bus interface and so on.
There's a six hour Bluetooth module,
which we wouldn't expect because it's a
bunch of kit.
And then there's the Freescale.
I am 31 and it has
some some $b dram and big NAND
flash.
And that made me curious because if we
look up the AMCs 41, it's
a pretty big CPU.
So it has an arm 11
at 700 megahertz and it
has like all kinds of interfaces
like USB and it supports
VIDEO.
They don't use that, but it's a pretty
interesting chip.
And which was, I think, used in some
phones back then, like
some smartphones.
And the interesting point is that I'm
so free. States have two operating
systems of supporting Linux and Windows
CE. So let's hope.
Let's hope it's Linux and not Windows CE,
but it's usually not programed bare to
the metal or any real time OS.
So although it's pretty
high powered and I wondered why is
it so? Why do you need so much power to
do Bluetooth like
the Bluetooth phone
bridging to your car?
If we look at the features, the force,
the devices called HD four and
it supports one interesting feature
that I didn't expect.
But again, I don't know much about cars.
It does not only support
the handsfree profile, which is basically
taking the audio data from the car and
sending it over Bluetooth to the phone
and side.
It also supports that remote SIM access
profile, which means that there's a full
phone in the Bluetooth kit
and but it doesn't have a SIM card.
It uses the SIM card from the phone,
so most modern phones
don't support this.
Unfortunately, like especially
iPhones, don't support it.
We're not. One doesn't support it.
Android sometimes supports it, but
on the Nokia feature phones
that are so great, they also want this,
and it basically turns
the phone into a smart card reader.
The Bluetooth smart card are nothing
more, and the big advantage of this is
that you can use the car's antenna
and you save battery
life on the phone. And so on
and the
day before also allows someone to take
a laptop and use Bluetooth to connect
to the internet over dial-up
networking.
It uses that it's done like
gives you a P.P.P session
over 3G, and
it also the speech recognition and speeds
send so you can do voice dialing
with that and you can control it via
voice, and it
can do music streaming rights
to the A2DP.
So like an iPod, can also do
this to play on the
on the car's speakers with that.
So this is like what they announced,
the features they announced.
And if we look at these features from the
hacker perspective, the remote
SIM access profile means that all the SIM
traffic is basically software controlled
because it's bridge to Bluetooth.
And like, it's not just a wire
or something that connects this to
the phone's SIM card to something else,
but it actually goes into the CPU and the
CPU will send the request of a Bluetooth
and so on.
So is the same for the
dial-up networking feature.
It means that the software control over
the P.P.S.
so that the Bluetooth kit
could actually build up their own
internet connection, which may be
interesting. And also, the voice control
explains why they have such a beefy CPU
because to do decent voice recognition,
you need it quite a lot of CPU power,
and that's why they have two 700
megahertz CPU in there, mainly to do
voice control.
And then, of course, the the handsfree
profile, which it still supports the next
to RCF is that
you can play audio and receive audio
and yeah,
to to to the car.
So let's take
a deeper look at this.
The thing is in your car, so the obvious
thing is, yeah, let's just get a laptop
in your car and let's go.
It should be easy.
If you never tried that, it sounds like
that if you do what it's called
because you hack at night and the night
is cold and you're in the car.
And there's this really bad
trade off, so you can either choose to
leave the engine running or to not
leave running so you either have a dead
battery or you are that the next morning.
So it's a really
bad trade off.
Also, environmental wise, it's probably a
bad idea to leave the engine running.
And the next thing is when you when you
try random stuff to the thing and you may
shortcut something you don't want to
break the car.
And if it looks something like that,
you're doing it wrong.
And I don't want to do it wrong.
So I what I
did was I went to eBay and I bought
a Bluetooth kit, another
one, so I could use that on my desk.
So what I actually got was not the HD
four, but the HD five, which is
the more modern version from this year.
They basically have one more feature,
which is that they support Wi-Fi sharing.
So they build up their own internet
connection in the Bluetooth kit
and provided the phone can do with the
remote SIM stuff and they share
it over Wi-Fi.
So from from the hacker side,
this means that it builds
up a Wi-Fi access point.
So it has all of that logic.
It builds up its own internet connection
and it sets the router and and
that and it's much more likely that
this is real operating system and not
just some really bare to the metal
or some real time stuff where we can't do
anything.
It also turns out it's a different
hardware platform, so it looks like this
except for the red cables.
I added them so
we can see the Freescale as 12 x
the microcontroller, by the way, they are
replaceable. So if you have the old one,
you can just buy the new one and plug it
in and it just works.
So it made it
a bit more convenient because I know I
had a backup unit that works in
my car and I could check the other one of
them. I'm not
risked making the car, not having a
Bluetooth kit anymore.
So there's again, you have the Freescale,
the microcontroller.
There's a gander at the CSR Bluetooth
chip and there's the Wi-Fi
chip, which is also some Marvell chip.
And the interesting stuff is actually on
the other side.
So there's the there's
the car interface, of course, those
pins, but then there's
a marvelous CPU.
It's called 1895 n
never heard of that before,
but we see that there's quite
a bit of ram again, 128
megabytes of DDR ram.
There is one megabyte of NAND flash,
so it sounds beefy.
There's some power management stuff.
There's the 3G radio front end
and the antenna, and there
are two things that that
were not present originally.
I will talk a lot about that later.
So if we look at a block diagram, it
looks like that we have to Marvell Sibiu
in the middle and we have the
Wi-Fi attached of SDR.
Now we have this use a Bluetooth
chip. I think it's use B.
We have the NAND flash, though the
RAM.
Well, it's basically a block diagram
of any
product that uses this mobile chip,
except for the can stuff.
That's Margret here
with Astrup X and
the whole car interface thing
that this my LC views.
So I Googled it and I wasn't
successful, which is interesting.
I'm looking for
it's nine five five instead of nine five
and gives a few more results, but still
mainly some Chinese sites trying to sell
you those chips.
Marvell is pretty bad and providing
actual information on their website.
I don't know if it's better with an NDA
or not, but I don't have an NDA, so I
don't know.
I would not buy those chips
because I don't know anything
about these chips, but apparently they
did. So it seems to be a P60 five
five. And the communication part that
the CPU, I think, means that like
they have this integrated 3G modem.
So it's a Cortex-A8 at roughly
one gigahertz or even better than the
M31, and they
have the 3G modem implemented on the
same chip, so it's not implemented
on the arm. So there's a separate CPU,
apparently, but it's still in the same
on the same chip and some cheap Android
tablets or not.
So. So see my cheap Android tablets
use that. So.
That's where this tip comes from.
The gold star to boot disk on this
thing, on my desk.
And so the plan that I had
was while in the car, we know 12 miles,
everything is supplied by 12.
Also, I connect to a fault
to the right pins. I hope it boots.
And when it when it's boots, I find that
you erred by just randomly scoping
on some test points and then I hope it's
Linux that boots.
And if it's Linux, I can install Python
and then I'm done.
So let's see how this worked out.
So this is the car interface.
It's some 45 pin connector
that if you look at the schematics that
I've talked about, you can drive the pin
out the most important pins your art
ground and 12th vault and the canvas
pins that we may eventually need later.
And and then all the audio pins and
the rest of that, which
we don't need right now.
So powering a thing up.
So what happens when I apply
to default? And that's what I actually
want to demo. Let's see if that works.
So can you switch me over to V.J.,
please?
Hello.
BGA, please.
It's a bit like explorer kind of zone.
OK, so my my set up
here is happy camera,
punish them.
The. OK.
I don't want to mention that.
So someone is coming up with the cameras.
Anyway, so I wrote something that
so I haven't left power supply here, and
what you can see there is basically the
the current voltage and the current power
consumption, so it can't be switched off
so that if it doesn't work with the
camera, I can just show
this to you. OK, that's great.
Can you come here with the camera?
But this.
It takes 10 or 15 more minutes.
OK, so can you switch back
then please? So this head
up here is I have a lap power supply.
I have the Bluetooth kit and
I have a yeah, it's a Windows PC.
Sorry, that
does show me basically
a remote and face full episode.
So what I do, I said it's a 12
volt, so if I switch it on,
we would expect the thing to boot and
I would expect it to roughly
consume like, let's say, $200 ampere or
something.
So I enabled 12 volt
and it draws like $50 Ampere.
So that's not so much.
And then it goes
out.
Can you switch back, please?
So despite this, nothing happens,
it boots up for a short moment and then
it goes off. And I
mean, if we look at the block diagram
kind of makes sense because the
the power management should control from
that from the microcontroller.
And yes, you have this thing in a car,
you don't want it to drain the battery.
It's still connected to the battery all
the time. The you want to be able to make
Bluetooth phone calls when the engine
is not running, but it cannot like
consume 20 million power at the
whole time. So they have some power
management there.
And it turns out that in this
stage where it draws 60 million amps,
that that's 5X is powered.
But the main CPU is never powered.
So maybe we have to send
Ken message first to enable
that. So this is a three
slide crash course for canvas.
Basically, Can is a Sebas system.
There can be multiple devices connected
to the same bus.
It's a differential signaling.
So what really matters is the voltage
difference between two lines
can each and can also high and low
and some termination.
So this is how it looks like.
So again, it's always the voltage
difference that matters.
So if the voltage difference is small, so
can high and low above.
At 2.5 false, it's a logical
one.
That's just how it is.
And if the voltage difference is big,
like can those driven to low
and can highest return to high, then
then it's a logical zero.
That's how the signaling works and can.
And the interesting part is now that
if the if none of these wires
are driven, like if no device is
talking, they will be at 2.5
fold. So they are pulled to 2.5 volts and
only if the device is actually driving
the bus, it will generate zeros.
And if the no device is driving, it will
be one.
So and
this is used when two devices talk at the
same point. So let's say this is the
second device and it talks at the same
time as the first device or there's
a collision on the bus.
Then it will drive
where previously the bus was driven, so
it will turn the one into a zero.
And it's basically just means that it's
when there are two devices talking at the
same time and one device is driving
one and the other device driving zero
to zero will win.
And that's why call called dominant bit
and the one is called recessive.
So it means that on the can bus
collision is fully defined like, unlike
Ethan, that we you just retry
on a canvas, that there's an arbitration
scheme. And basically.
So the very simplified
version is still every can frame
can be zero to a database,
and it has an 11 identifier,
basically which devices which
it's just an identifier so usually
targets. It shows what kind of data
it is that you're sending, and
if there's a collision, then the one with
the lower identifier will win.
But we don't need to know that really.
There's a lot of other stuff I could see
or see we don't care about because if we
use a can can interface
to talk through the canvas,
we use something that generates all the
stuff. So we need to know here is that
isn't that haven't been identified.
That is what kind of data like the
part number and zero eight bytes
of data.
So the revised plan to make this
work and put on our desk is
we connect to the canvas while the device
is in the car and we capture
all the can traffic and
we go to the desk again and we replay the
can traffic and we hope it boots
and we find the word hope that
it's layouts install Python in on.
So we need a can interface.
Any can interface adapter should work
that's not totally stupid, so I use some
specific one that looks like this.
It's OK.
Cost $800, it's
it uses. Some can control that it does
not support such a high number
of packets.
The packet rate is limited, but for
puppies, it's OK and
you can really use any microcontroller
with Native can support like
even the small ones.
But please don't try to beat bank device
because it's, well,
it's not fun.
So we need to emulate that.
The vehicle has power and
there is something I was back to German.
There's an s contact or
could infants, and there are some German
standard that says that Klemmer Funston,
which is basically Connect 15,
is a contact that's 12 volt
when the car is up, when the engine is
running and zero when the car is
grounded, when the car's not running.
And while today's cars
don't have physical wires anymore, but
they still have the can messages to
basically convert that
into a can message.
So let's try doing this.
So basically
replaying all the traffic, so can you
switch to between?
So here we have our power supply again,
and let's hope this
works. So I wrote a fantasy
tool that
so we first enabled the device again.
We see it drops a little bit of power
and eventually stops drawing a little
bit of power after a few
seconds. And
yeah, great moment.
OK, so this is the set up.
This is the Bluetooth kit.
This is the stupid Windows PC.
It's super old APC that Bailey
worked with whatever.
And this is the the lap power
supply and the rest are
cables.
OK.
Yeah. Duncan just.
So.
Sorry.
Well, I need the screen output, I'm
sorry.
So when I pressed run my
my my stupid python,
I run Python, whatever tool will send
canned messages that emulate the
the the clam often.
So I press run and
it should hopefully work.
Yeah. And we see it draws more power
and it draws what we expect the aid.
So that's good.
So I will switch off
the device that was.
And, yeah,
sorry, can you switch to Dubai again,
please?
Just.
All right, so the device has to a power
now, so it seems to be running.
I can isolate the can message to be
this particular message, so I replayed
just everything the car sent and then I
gradually did a binary search,
basically to isolate
it to this message.
And basically, it's a bit fiats of the
three or the one I don't know which is
actually ace means that claim information
is false.
But so sending this will
make the device moot.
So what's the firmware?
The question is we are still hoping for
Linux, right?
So go.
Next step was to find the uart
and
I could ask them to switch around, but I
would say we have the pictures.
So what we will see on the world, I
just scoped a few test points and
actually found you, and it was pretty
easy. There are only like five test
points and two of them on.
There you are. So what we see is this
it's you boot.
Wow, it's you boot.
Okay, that's cool.
And it's
Linux.
And it's also a busy box, by the way, for
some people. So I wonder
how so?
I saw the sign as is prohibited for GPL
cars without safety, valve and
my car doesn't have a self safety valve.
This is weird. So where's my safe and
sorry? It's just a pun on APD.
So GPL, I didn't see a
GPL in the owner's manual, which I
guess is bad.
And even more importantly, who?
Where can I ask to get the source code?
I want the source code.
And I asked this on a mailing
list, and it's complicated.
I'm not a lawyer, but it seems I need
one when I ever want to sell the car
because now I have this thing with the
GPL code in it, and I don't have the
source and I'm sorry, I
I'm a good. So if someone can explain me
where I have to go to get the source
code, that would be great.
Because the thing is, I don't really want
to blame the car dealer for not giving
me the source code because they don't
even know what the source code is or may
not care, and I can understand that.
On the other hand, I have to go
somewhere. So I brought email to
know Vivo and got no response.
But yeah, so I guess I need
some help here and doing the right thing.
Either way, we are us so
we can get further without the source
code. You know, local access means route,
of course, or does it?
So the device runs boots
into Linux. And
yeah, I will show you later, but
I'm basically boot into Linux.
It gives you a login prompt and we don't
know the password.
I eventually got the hash,
so if someone has some spare time,
we didn't succeed and like a few days
of CPU time to get us into a password,
but we could just modify
the flash and
change their BGA flash and laughs.
It's an effort.
Fortunately, Ubud is used in an unsecure
configuration, so you can just hammer
control, see over the Syria part, and you
will eventually get into the Ubud menu.
And yeah, I mean.
So.
The traditional trick that you use,
probably when you wanted to annoy
your friends using Lennox and he didn't
give you the password, just append it
as agent and you get a root shell, right?
And that should work well.
It uses an N.E.R.D.
So it's really equals something,
however doesn't work.
And I mean, the reason is we don't have
the file system layer of that part of the
N.E.R.D. And there is no def console and
they run some unique script.
By default, it doesn't need it.
But however, what we can do is to use Ubu
to just dump memory so we can just dump
the unit already over the serial port.
And then we do some, some unpack
thing and then we have the script
so we can just we
don't need the script because it
basically just finds the the right
through the fast. We can just directly
boot the real route AF-S, which is
a it's actually a memo.
So it's a full distribution
and it has a bash and everything.
So we can just use the trick there.
And that actually works.
And we can just remount the route,
just pass BD to change the password to
something we know and then we have route.
So there were some hardware tricks on the
device, so there is some pain out on the
bottom that looked very suspiciously
like a micro SD thought.
So I added blindly added a micro
SD slot.
And yeah, it works. And if we look at the
INI script, it actually and props for
a root access on the micro SD card
and just puts from there.
So that's even easier.
There's also a SIM slot,
I that it requires apparently telling
the device that there is a SIM slot,
otherwise it won't really use it.
So I see some traffic, but it still
searches for a phone and it doesn't like
use the modem until it sees the phone.
So it seems that you can reconfigure
this. We are some, some diak
in the face of a can to use that.
I don't know. And there's also use b o
type OTG port
that's actually externally accessible
behind some small latch on the package.
So even without opening the case, you can
access that without destroying any
guarantee device.
They use this for firmware upgrades and
diagnostics so you can put some.
So it basically puts the lock files on
on the message if you attach
them as storage, or it will apply a
firmware update upgrade.
However, I don't have a firmware upgrade,
so I I could only see the binaries
doing this the
HD for the slightly older
Bluetooth kit I had with AMCs V1.
It only has a host port
and that is the real key port.
So you need one of these fancy
Android tablet dongles there.
You can buy them for a few bucks
anyway. I would just buy the
Micro Micro, be on the one side
and a
on the other side and a socket on the
other side.
And then you can just put in any
UFB device.
But by default, when it's use be gadget,
it's a serial port, the modem or
something. But you can easily change just
to use beef in that, which makes
it a lot more convenient because
should theoretically, you don't have to.
Once you did that, you can close the
whole package and you can just
attach connected from the outside world.
Hmm. OK, but we still
want to, well, do something useful
with the thing on our desk, so we have to
emulate the car or at least
the steering wheel buttons, the display
and everything that makes it work
and keeps it alive. So the back and
they need the best contacts can
message for some about some more stuff.
And now I was while I was a bit naive,
so I was hoping there was some candy,
some Candyman that would just receive all
the canned messages and would be.
I imagined that it would be a big module
having all kind of D-backs
pew and symbols and everything, but
there was no such thing.
And in fact, when I send a can
message on the bus with my with my
candidate there, I could not see anything
on the Linux side and only
a very special can.
Messages did anything at all.
And it showed that this S12 x
microcontroller that I showed you
abstracts all of this on a very high
level so that
the interface they use between
your dashboard display and the thing
it's called B.A.P at
very simplified. It allows the control
unit like the Blue Typekit to provide
some values, like a string content.
And then it's the the protocol
will make sure that whenever one of these
messages change, it gets synchronized
across devices on the bus.
It basically sends update messages
and sends heartbeat.
And if the device goes that way by
not responding, any to proper error
message will be propagated.
And all that, if a well-defined way
of of providing messages
providing values, I guess
happy means between
a protocol. So again, some German
thing
I don't know why they name so that
the previous version, if that's what's
called data display protocol
and the new version is now a German name
either way. So it was hard to
find anything more technical than
this. This table, which
is about the only thing you'll find them
if you Google phone for this thing
and it's, well, it talks about ozone
layer. So I don't
mind whatever.
So it gets slightly more useful when we
look at what what it actually is.
So when you talk about, well, there
were 10 messages, one or more
canned messages construct a bad message.
And that message is basically
there are several up quotes.
One of code can be sent me all the values
you have again, because I just rebooted
another message just like, OK, I
updated this value. Here's the new value
and then one of the upper layers.
It basically just.
And that's something that's implemented
not across the canvas anymore.
It exposes all these values
and the current value to the display
unit.
So I had to reverse this.
It's not that difficult, so weak on
life. We see the canned messages and
it's basically a fancy way of sending
more than eight bytes or messages
with more than eight bytes across the
box by just using multiple canned
messages.
And so I
did some white until four days, and
it looks like this so you can see that
they're all kind of off.
So they're decent SGI ID, which
is the Louverture Stoya great idea
against the German term.
Which basically means the control unit
number and then there are up
codes. So I don't know all the names for
all of these. I could get some of them
by looking at binaries, either, I just
guess.
But we see that, for example, one of
these messages that is synchronized
and cached is the current screen content,
so we can see how it
basically means the phone is booting or
something.
So what we have to do is to
write something that talks this
protocol and shows
me what would be shown on the car
because then we can start adding Python
and do all our stuff without freezing
to death in the car.
So I have a demo for that.
Can you please switch?
So, oh, that's cool.
So.
He the scenario Howard put.
Here's my fancy tool, and there's
the actual camera,
so I powered on.
And here we see it booting,
and it's going to us and bootloaders.
And here is his
new boots and now it's floating Linux.
And just here.
We see the immolated screen.
That's I mean, it's not pixel accurate,
but that's roughly how it looks in the
car and it
takes a whole lot of time
to boot. And it actually boots from an SD
card slightly faster when it boots from
Flash. But I just copied
the whole flash contents to the SD card.
So in case I screw up
anything, then?
It's not so bad.
Yeah, so here we see the Cannes adapter,
which has a USB token,
lots of cables, again different lengths
of wires.
OK, and here we are, so now about it,
and it tries to pair with my
phone. Sorry, the language is German.
I don't know which can message to change,
to change the language to non-German,
but either
way, so I can I can
hopefully about this.
And oh, it actually it now.
So I can press OK and I will be in
the main menu and it's basically
a simulation of the car should actually
work. I don't know why.
Oh, don't. Yeah, I'm stupid.
So you can go to the menu and
you can actually do what you could do in
the in the dashboard of the car and
the buttons they are actually on the
steering wheel.
So, OK, can
you switch back, please?
I think that's old enough for the camera
off and on.
But thank you a lot for the camera.
I think that's important, and if anyone
wants to see this.
Yeah, you can just come here, after all.
Well, look at this
anyway, so I'm going back to
the device and going back to Linux.
We see that dbus is used very
extensively. So
all the X messages, which are this
microcontroller that connects the card,
they are just posted on the device and
there are various other programs
that respond to this.
And. And so we see screen updates,
we see key presses.
We see Bluetooth events.
When I connected the thing, when I start
a phone call, all of that, all of this
communication between the individual
modules work over DBus.
However, we don't see raw canned messages
because they are abstracted away by this
12x. And so we see the the
dupes positions, for example, which is
nice. We see the speed, but
we don't see other stuff that's
on on, on the canvas.
And it may be possible to repair or
to to use
debug thing in their cutbacks
or reprogram it to do that, but by
default, doesn't do it.
So dbus, I try it.
So I'm not good at using graphics, but I
try to build the diagram
of all the communication on the DBUS from
the sender and receiver.
And I came up with this and
there was no way, I think even with
the best parameters to graphics to make
this a readable thing.
However, I assume I
if we zoom in and just look at what we
are interested in, so we see the
the tools providing the high level menus,
for example, just the settings provider,
which owns the Settings menu, there is
the call stack provider,
which does the call management stuff
and Mary stuff like that.
And they send messages to a
thing called generic display, which
handles the menus and handles scrolling
through the menus and so on, and receives
the key presses and then updates the
screen and so on.
But the screen data is actually at this
point, just a bunch of message IDs.
And the next thing is
then next, even
then localizes these based
on the selected language into real text
and converts it to screen data
that the current expects.
So this and it's not yet
the BJP protocol, but it's
it's more similar to that.
So. And then it sends those to the COVAX
rollout, which then sends them over a spy
base to the Astrup X microcontroller,
and that then sends it to the can.
So adding Python actually
at that point is pretty easy if you're
booting from SD card you.
So what I did was just to put a Debian
now root on there with Python
in it, I'm into
the screen from Python is actually not
more than this.
So you basically
you get the session, the devastation.
That's you, you get that AC 12 extruder
and you just send the
binary data that is the screen.
So there's some helloworld in it.
So that's how we can display something on
the screen.
However, there's some problem with it.
So if we look again at the regular data
flow, there's one of these providers
they send to screen and it gets
translated into or
it gets converted into screen data with
selections and it gets localized.
It gets formatted into the
thing. The Astrup extended of a can.
And then when I press a button on the
steering wheel, the keys are forwarded
and the menu eventually updates.
And now we're going there with our
with our Helloworld Python script, and
we're just sending it there and
it goes off the canvas and it shows up
in the dashboard.
And then I press the key and it still
goes to the original thing.
And the thing is just confused.
So we have to fix this slightly.
It's actually not a big deal.
So it's some more lines of code
that basically just create
a logical screen and set it as active.
And then suddenly all key presses are
forwarded to this new logical
screen that we created and not any much
of the original menu.
And now we can just hand the key presses
ourself.
And there are no more screen updates
from the original logic.
And so let me try to demo this.
Can you switch back to BGA, please?
So let me try to not screw this up now,
so I will log in
with the.
Password to that, I added with
that you need in this age thing.
I go into my
my debian route.
And
that's a bit smart.
Can you switch back?
Yeah, that's that's to.
So I start the script
that basically overrides the menu,
and it shows my custom menu
over the protocol and
it would work the same way in a car.
I mean, I had a hard time getting car in
here so I can show you in the car, but
I can promise you it actually works if I
put this back in the car.
So I have a menu here where I can
go to the choices and that I can
exit the stool and then it goes back to
the original menu.
Thank you.
So this actually allows us to.
Yeah, right, something that runs in the
car that you can use from
the steering wheel that you can you
shouldn't use it while you're driving by
A..
It has access to the internet.
So if you connect a phone with with
a SIM card that has that has internet
access, it will just up the connection.
You get the GPS data from
from your from your GPS,
so you can. Right?
I don't know bad things and good things.
So the question is many people look
into adding a PC to their car, and
I want to propose this as an alternative,
of course.
So first of all, maybe if you have a car
from the last few years that's from the
Volkswagen Group, you maybe already have
the hardware required to do this.
Or if not, you can easily buy the
hardware from
eBay or something and put it in your car.
And so you have
if it's I paid for this
thing, two hundred, if the
older ones are cheaper.
So it is not super expensive.
And what you get is basically the
automotive program hardware.
So you get all the lifecycle management.
A lot of people at a car seek a car
into their PC so we can see into the car.
And then the
next day, the batteries drained because
somehow this shutdown
script or something, and
that's bad with this thing.
It actually sends a controlled shutdown
message when the Clemmie Funston goes
low and then it gives the thing
a few
a few minutes to shut down.
And if it doesn't shut down, it will cut
the power. And of this is implemented and
it's really hard to do anything harmful
to the car because of because of this
abstraction that happens.
Really, whatever the dark side
does, it will not
disrupt you from driving the car
and it will.
The worst thing that will happen is that
you can't do any phone calls anymore, but
at least that's the idea.
You cannot screw up anything else
if you want to.
You could, of course, send specific
messages to use any diagnostic
features and then reroute messages so
that there is no security at this point.
This is all from a safety perspective, so
you don't want to fire airbags
by doing this.
So can you break your car,
you? I will not say you can.
Definitely not. Otherwise, you will just
bring me brake cars.
Cars are. Yeah, they said.
They are designed for safety and not
yet, at least for security.
Maybe the really modern cars are,
but this is not designed for security, so
there was nothing in it that was terribly
hard to hack or something.
It's just that by default, it doesn't do
anything bad and the especially the
COVAX, if you send too many messages, too
few messages, it will always fail
gracefully. It will send the correct
error messages that it will not do random
bad stuff.
However, if
you theoretically could connect to the
to the power train canvas by
sending the right routing messages
and, well,
it really depends on what you're doing.
So whenever people come up with
attaching to the canvas, they refer to
this post and I want to just translate
this. It's a German post of of
the experience that someone had adding
something to his car.
So basically what that person
said and I just translated it to
doing this. So I don't know if it's true
or not. So he said, so I built an adapter
that would lock various data sources and
stored them on a PDA whenever the car was
moving based on instructions I found
on the internet.
And then one day one on the way from
Frankfurt to cooks have in the instrument
cluster failed and after the instruments
show values again, the engine stopped,
the central locking opened and all the
front abbots and Belfast net engaged.
The car was wrecked since the bypass
twisted due to the belt fasteners, and
somehow the insurance company figured out
that the Abbott control units didn't
register an incident from the
accelerometers, but somehow else
fired.
And then, of course, there were all the
custom cabling in the car behind the
dashboard, so it was a pretty expensive
experiment because the insurance didn't
cover it because they saw that there was
some tampering and the car still had
a significant volume.
I don't think this could happen,
especially when you
do this on the Linux side and there's
12 X, we're not attaching to the
powertrain canvas like this guy was
doing. But be careful.
It's your car.
Yeah, and
it's up to you to avoid diversity or not.
This is always interesting.
The whole thing for bad guys, because
this Bluetooth kid has access to a
microphone. Of course, it has access to
the internet and has access to GPS, so
this is the ideal hardware for tracking
back and a sort.
Physical access to the unit is enough, so
if you can build a firmware update
package, you don't even have to update
the unit. So sure, physical access to the
car is enough.
But on the other hand, you could just
deploy dedicated pack that you put
yourself. So I don't know if that's a big
deal or not, but it's definitely hard to
detect because you would really have
to dump the Flash and see if there's
anything changed.
So I don't know if that's something
you would call a real issue
or it's just for the tinfoil hat people,
I don't know. But for us, good guys, it
means we can do, for example, all sorts
of geofencing applications.
When I arrive at home, it switches on my
lights. Yeah, I
couldn't make up any better example, but
maybe you are more creative than I am.
You can do some, I don't know.
So if someone, for example, could read
the traffic fine from Google Maps or
being Maps and modulate them into TMC
so that the GPS takes it out there, that
would be interesting.
I'm sure there are many, many things you
can can do with this.
It's just Python, right?
So that's it.
And that's it.
So eventually I will upload my
code for the simulator, as well
as the Python script that you can
run on the thing to get help.
They are not there yet, but yeah,
that's all. And thanks for
listening.
OK. Thank you again very much, Felix,
we have four minutes left.
So if you have some urgent questions,
just go to the microphone next to
you. We have, I think, 8:00 in the hall,
so there should be one.
So we'll just start with you at the
microphone one over there.
Hello.
Thanks. Also, very interesting talk.
Sorry, just to interrupt you.
If you're already living, just please
stay quiet so we can finish the question
and the session.
That would be very nice.
OK.
There will be an obligation to install
so-called E call modules
in each and every car, which are
supposed to automatically
issue an emergency call when emergency
call when the car has a crash.
Do you know of if two hardware
juiced and that system is somehow similar
to the elements that you have
investigated?
I.
Yeah, sorry.
I actually don't know that hardware.
So it would be interesting to look at
these. I'm pretty sure, or I
would hope that they are not using some
Linux that first has to boot after an
accident or something. So I would
expect him to use something
more closer to the metal album,
something that's like redundant.
This whole thing is not.
The blue chip kit itself is not designed
for safety, so there are no redundancy.
And like if the router fast fails to
mount, it just fails to mount.
I would surely hope that the architecture
of some emergency
recall device would be better,
but I haven't looked at this and
unfortunately my car doesn't have one.
Otherwise I would have opened it.
But yeah, it would be interesting
to see what's inside them.
OK, so we'll just take one quick question
from the internet.
I I will put
two questions together here.
So Steve from ISI on the flux
from IAC ask
Could you ask if this
is a quote? The Linux device
being used to access
to microphones in the car and may be used
for spying if it had malicious firmware?
And how much effort
would it take to
get to sensitive stuff like the steering
servers?
So from
microphone, it's very easy.
So it's actually G Stream are used and
it's the proper regular
Lennox audio interface that you know
it's really easy to get access to the
microphone and upload them
over 3G or something.
So that's really easy getting
access to like
the power train canvas.
I don't know.
So if you could reprogram
the the AC 12 X, it
works for sure. And I know the firmware
update has a method to update that I
don't have to ask for a fix code
because I don't have a firmware upgrade.
So if you
send the right messages, I
do think it works.
However, it will not work by accident.
So it's not that you pulled some wrong
values and it suddenly makes the card
weird. But if you intentionally do
this, I'm pretty sure there's a way it's
just not as easy as getting access to a
microphone.
OK, one one last quick question
just from you over there
you you said you saw
the position data on the unit as
well.
The reason the navigation systems, or
at least the position data is sent via
Ken to this phone
unit. Yeah.
Do you know what it's used for?
I'm good news is that you found
it because I was looking for that or I
didn't have time to really investigate.
I'd only search on the internet and
didn't find any info yet.
So it's a good question.
Why is why it is there?
So I couldn't in that
route, the fact that I have I just
left for the message that is sent on the
device, and there's only the
traffic scenario that generates this
message based on can can messages.
There's no consumer.
So there is, at least
in this version of the software, does
nothing that would take this message.
So I don't know why
it is actually there.
Did did you check it?
If it's really, you know,
it's the repositioned take the real
position. OK.
And so the only thing I could imagine, so
these devices also have something where
you press a button in your car if you're
if you have a technical problem with your
car or something. And in theory,
they could like send that information
over for someone to help you
or something. But currently, that does
not exist in the software.
It's just a software thing, and currently
they are not using that information, at
least not in the form of version I'm
looking at.
The other question would be, as you have
like this help button like calling
the folks back in line or whatever,
and it depends on which country you
bought. So if you bought it somewhere
outside Germany, it'll call that.
Out out of outside of Germany help
line. Is there a chance to reprogram
that?
There's definitely a chance to reprogram
that number.
Did you try? I did not try it, but I
know they're like, there's this tool
wizards that you can use to reconfigure
your car and all the various ways.
And it's not a Volkswagen towards a third
party tool. And I know that's
true, but I didn't find a way to
reprogram
that there should be.
So I haven't tried personally, but I've
seen someone who claimed to have changed
that number there.
Oh, interesting.
Unanimous 77.
The telephone unit and then some.
I don't know the details.
Sorry, but it's a so it's in the prom
that's connected to the AC 12 X, and
the software pulls that number from this
12 X. And then that's
it.
Thanks.
OK, so time's up.
Thank you again very much.