So Brent that’s a sexy title but umm I know what you are thinking, I don't have a 17 car
garage. So what are you doing for me? Alright soo where is my newbs at? I'm a newb where is
all my newbs? Got any newbs in here, thank you for your honesty uh uh yeah this is gonna help
you get going into the fun stuff so the painful stuff you don't have to worry about until later
alright. So I'm hep I'm trying to help out the newbs. Do I have any professionals in here, any
tuners anyone get asked to drop um a performance engine into a mini van for one of their
customers, there you go he knows the pain. Im tryna help you get at home at night so your wife
and kids can see your smiling face. And then also just for the average consumer right. Alright
who remembers the Volkswagen scandal? Dieselgate anyone remember that? yeah. This is
going to help you actually like grab data for your car and not have to spend a lot of time
learning how to look at that data it will just -computer will be like boop- here you go. You
are going to say ii don't really think my car is doing what they sold me you know like I was
suppose to get a clean diesel engine and now its doesnt look very clean. So this is what.
this is what this code is for ok! you know the I got it the 17 cars no one is got 17 cars you
are doing back to back to back but um thats what im talking about alright. And uh oh all the
benefit oh and this too. It doesn't just do cars ok. Ill get into it a little bit later but
umm industrial control systems. Anything where the computer is setting a fixed packet like to
another computer and there is no metadata this this code is probably going to help you do
your job or whatever you wanna do, whatever you wanna hack, whatever you wanna play with ok.
So this not just cars. Alright so disclaimer. Active Duty Military, uh this views are my
own do not reflect Department of Defense, United States Army, The United States Air force or
really anyone else other than me so if I say something stupid its on me its not on America
alright. Alright so this is going to be an oversimplification and again I'm
a newb so please do not nuke me after this but let's just categorize all the nets under
two flavors alright. We got vanilla flavor first the general use network and your goal here
is I want something flexible alright this is the internet for example I just wanna be able to
add or remove hosts, I wanna be able to add or remove links, I won't have to worry about really
what the net is doing I just wanna get onto it, I wanna talk to another endpoint. But you
sacrifice something that nets guarantees. You have no guarantees your message is going
to get there. You have no guarantee when it's going to get there. So I might have to resend
or I might have to let them know hey this is my IP, what's your IP and there is a bunch of
metadata that is going along with this to make sure that the message actually gets there and
it gets there in a reasonable manner, gets there all in one piece so if you got a bunch of
metadata at this general use network then you have the exact opposite end of the spectrum
where I don't want to be flexible, I want guarantees. When I press my brake in my car
I want that brake to work alright I dont wanna have a resend of me pressing my brake I
wanna just work I want it to work on time so I need a guarantee that is going to get
there and a guarantee that is going to get there at a particular time to a control
network but I'm willing to lose the flexibility on the back end right so your car you are not
gonna add an extra wheel to your car well maybe who who is going to ask an extra wheel to their
car maybe some psycho in here I dont know? But uuuu you are not so much worry about that you
want that guarantee of timeliness and delivery guarantee umm and this code is
focus specifically on control networks. um what you lose though is if you wanna look a
the general use network you've got all that juicy megadata that you can be like uhhh alright
i've got this tag, that tag. you've probably don't even need to look at the actual payload
itself. You could just look at just the metadata but you don't have any of that on the control
network. On the car its just bits. Here is 64 bits, here is another 64 bits there is no
there's not a lot of metadata there. So a lot of people have already done a lot of work way
smarter than me to help you play with general these general use networks what I'm going to you
know Fred Stone is going to call a general use network. Voip the inner web, smart phones,
internet of things um and just in addition to academia you know you got wireshark, you've got
snork. You've got all this things that will plug into open source or widely used things.
You've got a bunch of academics with 20 pound brains cracking this problem uh in particular
this last four guys, I think you can get this on the defcon media server if you want and nerd out
and check out some of this um this last 4 guys I thought did pretty good work with the
general use network you know the automated reverse engineer but I wanna play with cars or I wanna
play with medical devices or I wanna play with planes or a train or something else. There
is nothing really there to help you until now. Alright! So umm lets see what we can do. I just
wanna get a bunch of raw data of my control network I wanna click a button then boom it spits out
some useful actionable information and maybe it might be off by a bit or 2 but its
going to get me 90% of the way there alright I just want the magic to happen and that's what
this code is going to do the code on the Github repo and ill talk a little bit more about
that in a second. Umm but Brentwhat are you doing on the slide? Like what is all this?
This is like an eye chart right we call this in the military this is an eye chart like why
are you doing this to us? Like I did not deserve this why? Alright so the cool thing is
when you get on the Github don't be overwhelmed you only have to worry about the preprocessing
everything is loosely coupled so you can literally take a different protocol I've already
done this by the way. You can take a different protocol not change any of the rest of the
code the other 90% and it will automatically reverse engineer that different protocol for you
that's why I was saying it's not just cars right. If you can sniff some data off a medical
device and it fits the assumption that every time some little widget on the medical
device is talking to another widget and it always sends 2 bytes or 64 bits or something
like that every single time. This code is probably going to work for you ok? When I do a
demo a little bit later im actually gonna do 3 different flavors of demo ok. Cause we got
-we got set up so I couldn't bring my own laptop. So I'm going to do 3 different flavors
of demo make sure everyone is fully satisfied with this presentation. Umm the demo is
gonna be doing this first 2 steps alright. Just to show you how quick it can be and it's
going to be a real time thing if you wanna put this on like arm chip or some sock or something
like that you could totally do that and i'll be efficient enough really efficient actually
um and then also how do actually slice and dice that bad boy. Um Im going to specifically show
you some slides and like walk you thru the mentality of this this step of slicing and dicing
the data so you can get out the actual information. Um and then there is going to be a bunch of
um more on the Github again don't be overwhelmed you just need to worry about the first
part. Alright so let's walk through the logic not the code but the actual logic of um how
do I slice and dice? So what do I mean by that? Lets say my data is a sentence- this a sentence
exclamation mark.- I've got 4 words and 1 exclamation point so I can slice and dice that guy
alright this is called Lexical Analysis to math nerds and stuff like that and then each little
piece of that is a token and that process is tokenization so I wanna tokenize my data. I
wanna figure out where the boundaries are the logical boundaries and then I wanna pull
out each logically distinct piece that the original equipment manufacturer program
into that chip to transmit over the wire. I can't just take the big chunk all at once, its
nonsense ,and there is this other process there is Lexical Analysis and then there is
Semantic Analysis saying let's assume i've been successful at slicing and dicing correctly now
I want to understand this one piece. What is this? What am I looking at? I want the computer
to help me figure that out right? if I earlier chart when I show you where they all look
exactly the same I want that kind of information and the computer can figure that out for
me and it does now. So lets copy and paste over to 64 bit payloads lets just assume that
widget A on the car is talking to widget B like the break is talking to uh like a body
control module or something, its sending 64 bits, 64 bits over and over again so many times
maybe its synchronized maybe it's not but its just sending it over and over again. The exact
same format the exact same payload length im watching this happen over time and im
recording it you could just take all that 64 bits and you could plot it or do whatever you want
and it's probably gonna be nonsense or you could do the slice and dice operation this
Lexical Analysis and say alright let's grab bits 0 to 6 and just look at those and interpret
those as a distinct piece of information and I’m going to take bit 7 to something else.
I'm gonna keep slicing and dicing. Just like I did with the sentence find the individual
words and then when I extract that this is an actual example from a real car by the way. Um
you know if I look at bit 16 to 32 I get the vehicle speed and then if I look at bit 32 to 39
another copy of the vehicle speed. Actually this isn't the vehicle speed this is the RPM
per wheel and as you can imagine there is 4 of these signals and there is a little bit of
metadata at the front. So that's one example of what these process what the output of these
would look like ok. So how do I actually do the slicing and dicing? How do I do this
automatically? How do I teach the computer to do it? Alright lets say im looking at the
observations so ive got this example I'm looking at bit payloads ok everyone following
me? and then at my first observation 0111000000 and then some time goes by I see the the
microcontroller send another 10 bit message 1000 so on so forth so what you are seeing is from
top to bottom time kind of elapsing as im watching observations then from left to
right im watching the bits ok. So the way that you can get a very good educated guess on how
do I properly slice and dice? this bad boys is look for the least significant most
significant bit no matter what they are doing unless they are encrypting it or they
deliberately write some shenanigans to reverse the bits and then put them back together
again. You are gonna have a least significant bit and a most significant bit what happens is.
If I take a copy of these observations and I shift it by 1 observation ok and I Ex-Or Tose
2 copies what you get is how many times is the bit changing between 0 and 1? How frequently
is it transitioning ok? And then if I take the sum of each column now resulting Ex-Or then I get a
very good indication of where is my least and most significant bits embedded within these
larger payload alright? As you can see 1 2 4 7 and there is a break and there is a locally
logical piece of information 1 3 7 um in this case you know the right hand 3 bits was counting
from 1 to 7 or something like that and when you plot it, it becomes even more obvious
especially to us as humans right. You can see a very definite slope there is a little
hill and then it stops and there is another hill like oh ok the OEM probably has 2 pieces of
information and then these payloads that its sending now I can make a pretty good educated
guess. Alright so how does that process actually work so those of you familiar with like a hill
climbing algorithm or like a machine learning folks in here you probably have heard of that
before um you do exactly that like im going to start at the bottom of the hill or the top of
the hill and just keep going until I find that the least significant bit that is
transitioning a whole bunch of times and then all of the sudden there will be these sharp drop
of. That's probably the most significant bit to another piece of information embedded in that
payload so im just going to cut it -pish- right there im just going to take however many bits
that is and then I'm gonna put that to the side bit number 1 I'm going to start over again,
bit number 2 you know, bit position 15 here we go 16 17 18 I got you. And then we are going
up to bit 32 and we are going to -Pish- make another cut bit number 2 theresust those bits im
gonna look at those later and what happens is when you see that again these is the real
world example from a car, I didn't give any heuristics or anything to to the algorithm it
really is just that simple and easy to teach in many times not always but often times is that
qui- easy to teach a computer just grab these bits and um slice and dice it that way now
i've got the information but Brentyou said? Once I slice and dice how do I know what kind of
information that is Alright, that a true point. Um It would loo- the- one of the folks in
this auditorium right now listen to the full speech it will literally take me 2 and 1/2
hours to explain this last part. I don't say that to like show of or anything just a matter of
fact, I dont wanna put people to sleep. Just go on the Github after this if you are interested
if you got that hookin you know? and check it out um we've got a document there you know, it's
very well documented if you want to know more about how to actually identify like these is
that type information versus that type thats Semantic Analysis but i'll just give you
one example right, cause I'm going to show you a bunch of examples as part of these demo.
Um so I just want you to understand what you are seeing. Alright in this case alright you
got the super micro print so if anyone it's got like eagle eyes you could maybe read that
probably can't um but what I did is I just threw this however to map the car it looked at I think
there is probably 120 ids floating around the car all craziness. It grabbed slices
from different payloads all over the car and said hey that little slice looks like that slice
which looks like that slice which looks like that slice and what you get at the end of that
is Oh Hey! um Mr Hacker here is all the things that look here is all the apples, here is all the
oranges. Here is all the bananas um that I found in this car alright I don't know the full
name but I can tell that these things all look similar so you don't have to do that the um
process anymore ok? It will do it for you. And it will by the way this particular sample um I
was actually able to request J1979 diagnostic information is my Prius um I'm conservationist
I guess at least if you ask other people in the military they've got the like dual legged
trucks like the 4 wheels and everything um I ask the guys hey! give me vehicle speed while
im gathering these data and it turns out this exactly vehicle speed for when I was going um
thru this driving sample so um I wont get into the details of like how can I claim accuracy
with this stuff if I don't have any true data but what I found is actually over 90% accurate
most of time across all 17 vehicles we looked at um so it might be off by a bit or 2 and
for those of you that have no you know work with this stuff you know being off by a bit is
kinda of a big deal. But it will definitely get you very very far along the process where you
could get home at night or you can believe that your OEM sold you the features that they
thought they sold you or you could be a newb and show of to your friends. Alright so let's
reverse engineer some stuff so again I’m going to break this deme in sorta 3 different parts
alright. The first part I'm going to walk through its just going to be the slides because I
don't have my own computer here I'm going to show you all 17 cars just sorta of the output of
the semantic analysis slice and dice and the label it says diesel it all look the same and
im gonna prove to you that I i dint tweak it I didn't tune it to any one car. I just gave it
certain settings and then I let it go and every single car got something out. The second demo
im gonna open it up to questions or let people look at it um but honestly it's just like output
thing like this is how long things are taking and the third demo ill hang out either outside
the room or over on the side here with my personal computer i've got it right here with this
code loaded up with some data samples if you just wanna talk about it or you wanna see it
like actually been run in real time more than happy to do that for you ok? So what you are
seeing you are going to see 2 like groups of plots, what each group is gonna be a car and
again the its sliced and diced it did the semantic analysis piece and these all look the
same then it put them all in one grouping for me I didn't do any work and it's like here you go
enjoy ok. So on the left it's going to be vehicle on the right it's going to be another vehicle
and if says cropped to fit it just means it just found a whole bunch of these and I'm tryna
make it so it's not microprint for you all so I i I cut off a couple of the signals that were
on there so that way we can sort of see it. Um so on the right hand side um the just so you
know every single sample here I collected in the same driving scenario so I had people in the
parking lot and then we um we drove down a small little hill and went for about a 3 and 1/2
mile drive and kinda of stop lights and a lot of right turns and things like that and then we
came back to the parking lot and stopped.So you see it kinda goes up and then probably comes to a
stop and goes up probably comes to a stop and then a lot of times for example this one on
the left here vehicle 3 if you've ever worked with CAN networks controller Area
Networks and cars by the times the oms like they put a counter that it sort of keeps track it
sort of like error checking in this case it grab a bunch of counter from vehicle 3 um
probably vehicle speed from vehicle 4 here it'll just go thru these, on the bottom here
of the Github I do have one data sample again from my car, my personal car that you could just
start jamming right away just download it from GitHub, clone the repo um load up that data
file and start hacking. Again you could see like the pattern sort of look very similar again
I had everyone drive very similar. Vehicle 11 it did have a little bit of trouble um I
think its off by 1a t on the second signal. Um Actually yep this is going around the hill,
going around the hill alright 17 cars now that is sort of just proof number 1, proof number 2
I'm gonna load up this video and them um if anyone it's got a question. I think it seems like
a lot of people are real shy so you could just come up here and ask me if you dont wanna talk in
front of the group. ok? And then after that I'm more than happy to show people on my computer.
Thank you very much! [applause from the audience]