- I would say probably it would be in
the connected-car space.
It's such a labyrinthine area penetration testing
any penetration tester, any senior penetration tester
you ask them, hey, can you do
this connected-car penetration test?
Can you go hack this TCU? I've never done it before
but it's all the same.
No, actually it really isn't, and I'll probably
get trolled for saying this but I don't care.
(laughing)
It really is a labyrinthine, very focused
specialized area of penetration testing.
You're dealing with different things,
you're dealing with different platforms,
you're dealing with different connectivity,
you're dealing with the CAN bus,
you're dealing with all these things
that you don't come across against an Apache
or IIS web server. It's just very different.
The challenge that I ran in was doing a penetration test
against a head unit and that's
the infotainment system of the car.
And really the challenge was okay
we're facing same vulnerabilities
you would have faced in something running Android OS, right.
So different head units
will run different operating systems.
You have TCUs that may run Nvidia Linux,
you have some head units that be may be running Android.
It really just depends on the OEM.
The challenge was really I know how to breach
a web server and pivot around within
the Active Directory Network and collect tokens
or whatever and Kerberos - getting domain admin, right,
in the AD environment.
How do you pivot around on a car?
(laughing)
- Yeah, that's a good question.
- That was the most challenging section
in my book was, okay, we're following
the penetration testing execution standard here.
I've done all the other steps.
Now I'm on the post-exploitation chapter.
How the hell do you write on
a post-exploitation step of a car?
It really is, it's understanding the fact that
when you're pivoting around in a connected car
you still have connected components.
That head unit still needs to communicate with other things.
It still needs to talk to other ECUs,
whether it's the steering column that's connected
to the CAN bus which the head unit is connected to,
it's understanding that the in-vehicle network
is very much like an intranet. While it may not talk TCP/IP
at least today, by the way a lot of fleets are moving
to Ethernet, but while a lot of it is CAN today,
it's still networked components. There still network TCUs.
- Okay, so let's jump right into that.
To start at the beginning,
what have you found some of the most common attack vectors
are that hackers are hacking into connected cars,
either that you've done or that you've seen
done out there. What are
the scariest possible vulnerabilities
that you see right now in connected cars?
- Yeah, so I would say the answer to that is connectivity.
So right now whether it's autonomous vehicles,
connected cars with autopilot,
they need connectivity.
Manufacturers, automobile makers
who are communicating over what's called OTA
or over-the-air updates with the connected car,
so they need to be able to communicate with that back-end
and that is typically always GSM.
So the attack vectors, the attack surface
that mobile devices, that mobile phones
have over GSM apply to a car, right?
So the things that you're facing with your mobile phones
such as rogue base stations are the things that
you faced with the connected car,
and I think they're the scariest thing that
I would say is really just knowing that you're driving down
the street with you and your family in the car
and somebody that's possibly targeting that car
has a rogue base station set up. The telematics control unit
within your car is going to connect to a cell tower
with the strongest signal.
Now if you've got a rogue BTS projecting a stronger signal
then a legitimate base station your car is gonna connect
to that rogue base station.
And it's very cheap and very simple
to set up a rogue BTS these days.
So, I think that would probably be the scariest for me
just knowing that if you're driving a car
with you and your family in it and a vulnerability
could potentially lead to loss of life
or safety concerns with you and your family,
it's way different than the ramifications
of a compromised web server and having your website
defaced or even ransomware encrypt data
that's not backed up.
For me, from a connected-car perspective
it's a way different playing field when you're talking about
the potential for loss of life.