so we're gonna start with a little shot
while everybody gets seated chili pepper
liqueur okay so hello everybody and
thank you for coming to our talk we're
gonna be talking about some research
that we did at Argus ozl and I both work
at Argus and it's kind of an interesting
research with some things that looked
revealed but somes that don't and at the
end we're gonna tell you why we did all
that this work was actually done by more
than just the two of us so this is a
this is Razi stay high today and this is
she she was doing the signals
intelligence
Rossi's the radio guy this is an Ikea
clothes hanger
don't ask we'll get to that later it
does play a part in the research and I'm
somewhere in the back running the stuff
yes so TPMS who's familiar with TPMS who
knows what TPMS is okay you did your
homework that's nice
so that's basically a device that
measured the amount of pressure that you
have in your tire there's a number of
reasons you want to do that it affects
your fuel consumption the performance of
the wheel if you have a flat tire you
want to know it can cause an accident
and so on this is actually a device that
is inside the rim okay when you fill the
air it goes through that and it has a
little battery inside and it measures
the air pressure and it tells the car
there is a receiver and ECU inside the
car that knows how much air you got now
we're not the first to look into that
this has been extensively researched
this device is not encrypted many people
looked at that reach the conclusion that
you can spoof it and we're not the first
to do that however almost everybody or
not almost everybody who looked into
that reach the conclusion that while it
is not encrypted and can therefore be
spoofed there is really not enough that
you can do with it so it's most of most
of the time it's harmless you can
possibly cause someone to pull over
right if they think they have a flat
tire they're gonna pull over then maybe
you can steal their
car or rob them that's one thing if you
have a self inflating tire then you can
cause over inflation that could be a
problem but very few vehicles have that
mostly military or maybe some big
agriculture ones and the general
consensus is that this is mostly
harmless and the potential for damage is
really small and when you tell us that
the potential for damage is really small
we're like hmm yes let's see now this
research was inspired of the direction
that we took was inspired by this video
we're getting some
[Music]
all right so this is a great commercial
and it made us you know think what if we
could cause this sort of distraction on
the larger scale because if it's just
one driver not a lot can happen
everybody is agreeing on that but what
happens if you can do it on a larger
scale so here's the plan
when you're dealing with one vehicle
we're flickering yeah party yeah
guys video flickering so more when
you're dealing with one car this is
basically what you have to do you have
to receive the transmission you have to
decipher what's in there analyze it
parse it use radio equipment to do that
then you need to modify the field that
says how much air pressure you have and
as it turns out not just that there's a
few more interesting details there and
then you have to re transmit if you can
do all that then you will have spoofed
and a TPMS message and then you can make
the car think that you're low on air
right but we want to do it at scale to
do it for more than one vehicle at the
same time now this is what you're
looking for this has been researched
before this is what a TPMS message looks
like one of them anyway there are many
types so you can see that you have here
not just the air pressure but a very
important piece of information the ID of
the wheel every single wheel in the car
will have their own ID so you can't just
broadcast a random message you need to
know the particular Real ID in order for
the car to respond to it so that brings
the level of complexity a little bit up
and you also have you know temperature
which you might not care about and other
flex and there's a CRC so once again you
need to know what you're doing you can't
just change values and retransmit that's
not going to work and this is why a
little bit of research is required so
scaling back up we need to position
multiple receivers why because the
signal is not constant the TPMS
transmitter will transmit anywhere
between once every 15 seconds to up to
two minutes depending on the
configuration so if I want to receive
the TPMS transmission
Rossi's car I don't know where to wait
maybe he just transmitted now maybe it's
gonna transmit in 30 seconds maybe in a
minute right so imagine a long stretch
of roads you have to position multiple
receivers at some point one of them will
receive the signal you have to collect
it analyze it and know what you have to
change in many different types and then
you have to aggregate all of them okay B
of all the vehicles because what we want
to do is reach wordsmith them all at the
exact same time this is kind of a
challenge so this is the attack scenario
anybody here from Denmark or Sweden this
is the bridge between Denmark and Sweden
so imagine the traffic coming from that
way to this way you buy the receiver
this is called the RTL SDR you can buy
it for like nine dollars on eBay really
cheap it can only receive but it's good
enough and you position let's say eight
of them over this stretch of road I
don't remember exactly how long it is
think for maybe five kilometres so it
takes more than two minutes to drive
over that so any single vehicle that
enters this stretch of road will
transmit a TPMS signal at some point
during the travel and we will receive
that okay maybe one maybe more than one
but it's going to happen and then you
buy this device the yardstick one is
transmitting device as well so this is a
little bit more expensive what was it
like a hundred dollars hundred thirty
something like that and you put the
transmitting device here this is a
tunnel okay now imagine that when all
the vehicle come here a bunch of
vehicles traveling at 120 kilometres an
hour and then 30 of them get this little
and the light goes on you make 30 cars
do that I don't know three drivers will
take their eyes off the road one of
those might be you know starting and
because they're not looking at the road
that's all it takes and in the tunnel
it's gonna be a big problem now I know
I'm the bad guy now but this is where
the white hat I didn't get a white hat I
got a black hat this year so status
report
we succeeded but there was a lot of
failure on the way okay we didn't it
didn't just all go very smoothly and why
because Rossi and I decided that even
though this was already researched you
could find pretty much 90% of what we
wanted to do already done we haven't
done that yet so we wanted to create for
ourselves a learning experience and this
is very important for you guys if you
just copy from you know other people's
work you missed all the stages of
learning and and experiencing and
experimenting which is very important so
we knew that we're going to reinvent the
wheel we're going to do things that
other people had already done and the
meaning of that is that it's gonna cost
us time this will take a lot longer than
it could have taken if we just taken
other people's work and done it but
that's the the route that we chose
because we wanted to learn something
that we hadn't done before and Rossi
will tell you about what we've learned
yeah so I'm gonna tell you a little
about all the stuff that we did know
about the mistakes we did but also about
the good stuff that we did as well so
the first thing was to take a vehicle
and start exploring it and then when we
decided to start the research in Barr
said well no problem I have a TPMS
system in my car we can just explore my
car and then we went out we went down to
the underground garage we're in bars car
is located and we took an SDR and indeed
we started recording and then the first
signal we found is this signal now this
makes a lot of sense right I mean there
are four tires in a vehicle and there
are four transmissions here although
there are transmissions in several
frequencies but back then we thought we
thought oh maybe those are artifacts
coming from the fact that we misuse the
SDR or because there is some kind of
retransmission mechanism that we are not
aware of that aware of I remind here
that we didn't want to physically touch
the car we want to be able to explore
the car remotely so we started a
we started researching this signal but
then after a few minutes you found
another signal and this signal also
makes sense and not only it makes sense
because we have four transmissions we
also have something that looks like an
invoking transmission right and then at
this point we started to be a little
confused and sometimes these
transmissions where we sometimes we've
seen them sometimes they were gone and
we didn't exactly know what you do now
I'm not sure if you are able to
understand from the spectrum but these
signals are pretty strong and not only
strong we were actually sitting next to
the car and trying to do this recording
this is my car yeah this is Baska so
after seeing multiple signals and after
we we since we were really confused at
at some point we wanted to take we said
okay let's take the vehicle out let's
start driving around and see what we can
find and then it become even more
strange because when we got out there
were no signals at all so Inbar said
okay enough with this enough with this
nonsense I want to take a shortcut I'll
go to the shop I'll take that the sensor
out we'll take a photo of its of the
label on it then we can look it up
online for for the specs and then we can
find out what the hell is going on here
only thing is in bar car doesn't have
okay so imagine our surprise here okay
never mind
we recovered pretty quickly and one of
our colleagues gave us his car loan does
his car so we can research it and then
we said okay so let's let's again let's
take that shortcut let's take the the
new vehicle to the shop take the tire
pressure sensor out and research it and
this is how the label looks like and in
fact that was that was pretty smart move
from for three reasons first of all now
we know there is a tyre sensor in the
car right
but the second reason was that because
of that we were able to actually record
the signal in an isolated environment
instead of recording it in a in an
undergrad parking lot which was
obviously stacked with other signals or
somewhere outside we just took the
sensor into the shop and it was quite
isolated so we we were pretty sure that
we only record that signal it didn't
help us isolating the signal down the
down the road but the third reason was
that since we we only recorded one wheel
we also had recordings of one ID and as
Inbar explained we wanted to extract the
ID so down the path when we wanted to
try and identify where the ID is located
in the signal that helped us a lot
so after we got the label and we got the
FCC ID we looked in online and obviously
that made things much easier for us and
we also managed to actually get the
specifications of the signal of the
signal as well as finding out all kinds
of of new information we we weren't
aware of so for example here you can
hardly see but we found out that there
is a distinction between how the vehicle
behaves where it is in in parking and
between when it is in Drive so again
this helped us understand more and
obviously after that it was quite easy
to find a signal so you could see those
four transmissions and this is the
baseband view of of the signal then we
could extract all the information and
indeed from the documentation online and
for from what we saw on the vehicle we
could extract the the following
information this is not different from
previous reaches researches it's only
something that was unique to our sensors
and helped us down the path with the
with the analysis so in that at that
point we were able to quickly
that quickly build a receiver now at
that point we still didn't have all the
information so we couldn't build the
entire receiving chain right so what we
did here we did just a basic we use the
basic receiver we use some energy based
detection of the signal then we
separated the signals that we use the
transmissions as we received two
different files then we did all the rest
of the chain extracting the bits and
determining whether it is it is a TPMS
transmission or something else manually
and at that point we got a lot of a lot
of a lot of recordings and at that point
we used the fact that we have a lot of
recordings to do some statistical
analysis now the statistical analysis
means that I have a lot of packets so I
can do I can try and find out all kinds
of patterns in the signal and sometimes
we use just common sense stuff that help
us and sometimes we use something that
is more complicated so the most basic
one and in Bart did it like a minute
after we got all the all the recordings
it just replaced the ones and zeros in
dots in lines right and it looks maybe
dumb or maybe funny but when you look at
it closely you can really see different
patterns so it really helped us guessing
where the ID is located where other
information that we estimate is static
is located and where there is no static
information so for example CRC right
because yours is also it's not
deterministic something a little clever
that we did is we use the fact that this
signal uses Manchester encoding anybody
knows Manchester encoding here okay not
a lot so one of the main characteristic
of Manchester encoding is that there are
some patterns that are legit in some
patterns then are not so 0 1 1 0 1 1 0 0
are valid packets but for example 0 0 0
or
1-1 or longer repetitions are not valid
that this helped us both realizing word
packet ends and also finding out whether
this packet is corrupted or not and so
on in others in other things we stood on
the shoulders of giants we didn't try to
actually reinvent the wheel but we did
use some some previous work and we build
upon it so for example to find the tire
ID so we used previous research that had
some scripts that did some packet some
statistical analysis and we build our
own script for example to find the tire
the tire ID so what we did here is that
we knew or we guessed that the tire ID
is 32 bytes to 32 bits sorry and then we
took a sliding window and we looked on
every 32 by 32 bits window inside the
transmission and then we asked ourselves
how many unique values they are through
the all the transmissions through all
the recordings that we had and finally
we found out one window that only had
four unique values and that gave us a
guess where the idea is because
obviously they are in the vehicle only
for valid IDs for four tires and another
thing was finding these CRC parameters
so again here we use something that
already exists we use the brute force
ERC library that is available on github
and perhaps it doesn't say much a lot of
you but this actually is the information
that we needed in order to be able to
rebuild the packet with the right CRC
values okay with that information we
were able to make to extend the
receiving chain and actually start
parsing
packets from the air right so this is
exactly what we did and we we build
something that automatically as you can
see automatically detects
missions and then in a few after a few
seconds or few milliseconds it displays
the the received transmission and you
can see it looks quite nice here right
it parses quite nicely and the reason
for that is because I did that in my lab
back on my lab bench when you go but
when you when we went out and we started
receiving transmission or over-the-air
now it doesn't look quite nicely right
so we have a lot of packets here that
are corrupted and we have a lot of stuff
here that longer or signals that are not
related at all to TPMS sensors and so on
another by the way another funny thing
is that you don't hear me you can see me
speaking in the video and you can hear
an audio this is for the plain reason I
forgot to turn the microphone so okay
moving on so we wanted to make sure that
we are actually able to receive signals
from all the vehicles as Inbar explained
we wanted to take a highway or somewhere
with a lot of vehicles and receive all
those transmissions now we we took a so
we thought about a highway so a typical
highway has six lines every Lane is like
about five meters and we wanted so we
wanted to make sure that we can receive
from approximately thirty meters and
then we did some theoretical
calculations and we found out that
theoretically we could receive from
hundreds of meters so we were lazy we
said okay so artists offices are
watching just over I alone Road on
Israel which is one of the busiest
highways that that we have so we said
okay let's be lazy let's sit in the
office let's take an antenna and here's
where the the cold rack took took a
major major place in our research and
which we can just kill the antenna
towards the highway and then we can
receive everything and we are in the air
condition and we are happy we can just
hit and hack out
in hack cars but unfortunately this did
not work right because for some reason
we were not able to to receive those
signals probably because of the of other
interruptions because there was a lot of
metal outside of the building you can
see that the the windows themselves are
made of aluminium and eventually we had
no choice so inbar had to get get to the
side of the highway and do the
measurement there but once we did that
we were able to actually receive those
signals next was proofing the signal
okay and that was also a challenge so at
the beginning we we we said okay let's
do a very very simple replay attack
right because we want to divide the we
wanted to reduce the risk and we say
probably we can if we can receive and
record a low low pressure signal and
then replay it after we after we inflate
the tires back then probably we will
have a low tire a lot higher alarm and
we used for that purpose we used the
heck RF so that is able to both receive
and transmit those signals the problem
was that it didn't work
so for some reason when we recorded a
signal try to replay it in the vehicle
it just didn't work later on we found
out that we cut probably because there
is there is a difference between whether
the car is standing and in the move that
probably was the reason why we weren't
able to do the replay correctly however
the problem with that method was you
cannot debug it right you just record a
signal you send it again it either works
or not right so we said okay let's try
to do something maybe a little a little
more complicated but by the way that
will allow us to actually debug the
entire process so we through the heck RF
to the side and we took the yardstick
one just
one to those who don't know it's
actually a radio that can be controlled
by a pretty simple Python interface and
again we we said okay let's work on the
bench before we get down to the vehicle
let's make sure that everything is
working on a bench then we'll get to the
vehicle and indeed it worked and you can
see here the tire pressure it's in psi
and I'm not sure if you are if you know
but there is no 101 psi in a vehicle
that very problematic and obviously this
is because we were able to spoof the
tire pressure okay moving on so we were
pretty happy right because that was one
of the main risks that that we had we
wanted to be able to transmit to a
vehicle and spoof the signal so we went
down and we said okay let's try to
experience experiment with the
transmitter let's try to find out how
far we can transmit the this poofed the
spoof signal and you can see in bar here
we went down to the to the underground
parking lot and we used again the coat
rack with the directional antenna and
you have the setup here and again you
know when you reinvent the wheel you
find out all kinds of crazy stuff for
example the code did not run on in bars
computer for some reason kept running on
the computer it's a Python command you
sent the yardstick one yeah the computer
plays no part in this and in bar and I
have basically the same laptop right I
mean he has a MacBook I have a little or
maybe a little older male book MacBook
but for some reason you just did not
work so eventually we had to use my
laptop and bar was pretty frustrated and
we didn't find out the reason yet but
hopefully we do that in the future so
after all these failure descriptions and
after all that stuff let's show you what
really happened just before I play the
video I'm sorry we couldn't actually
take a video of the take a good the
focus of the details however when there
is a a low tire pressure the screen here
will turn
read so pay attention okay ready
start now
okay awesome it's working so at that
point we were able to receive TPMS
sensor TPMS sensor transmissions from
the highway we were able to successfully
spoof a vehicle from over 30 meters so
that parking lot was pretty pretty is
pretty why a large and we tried several
scenarios I tried we tried taking the
vehicles from the sides and so on
everything worked pretty great and we
succeeded in stripping a receive TPMS
transmission rebuild it with our own
tire pressure value and then we transmit
it so currently we're working on the
backend setup so is in bar explained
before we want you really scaled it up
so for that purpose we need to be able
to take those transmissions those
receive transmissions rebuild the packet
send it to all those transmissions on
the on the bridge and then send it back
again so we're now working on that
because we are going to use a very
simple VPN setup this will and this will
help us scale up the entire setup pretty
quickly and this indeed already worked
already working and we're just
finalizing that cell okay what's next so
we have a few challenges here the first
one is to be able to handle multiple
transmission methods multiple
mutilations
this one was based on in frequency
modulated signal however we know that
there are some sensors that use
amplitude Bay amplitude based
modulations and so on so we need to take
care of that obviously we need to find
out how other sensors work and how they
are built and to be able to pass them
correctly
and to be able to synchronize everything
so as in bar cell we need to be able to
receive everything aggregate everything
and then transmit everything on the same
time so this is another challenge that
we still facing so is responsible
security researchers I told you I didn't
get my white hat but I actually have it
you cannot disclose a problem or tell
the world something is wrong without
offering ways to solve it right because
otherwise you just gave the bad guys
ideas and weapons obviously okay the
number one problem here is that the
signal is not encrypted so the trivial
thing to say is let's encrypt a signal
but here's a problem
this is the TPMS it's really small it's
running on a small battery this is not a
real computer so if you have to do
encryption you might need to get into
costs the whole design of this thing
might need to change because the
architecture of or the the
microelectronics inside are not strong
enough to do the encryption and also how
do you synchronize the keys what happens
if you change the tire
so now your car needs to know the Nutri
the new wheel or maybe the new wheel
needs to know the encryption key for the
car so this gets complicated this is not
really a viable option also one thing
you could do to mitigate the problem
right now the vehicle is listening to
the wheel so whenever the wheel is
speaking the vehicle is listening if you
change that and you said okay from now
on I don't care what the wheel is saying
unless I ask it first hey will how much
pressure do you have then he tells me
then that would make the attack
significantly harder because I would
have to listen to the question and then
get into a race condition with the wheel
and answer over the wheel right that's
really a lot more complicated and it
might not even succeed right but
actually the best way to mitigate with
existing hardware is to correlate the
signal with other sensors you already
have in your car for example all modern
vehicles have a sensor that tells them
how fast the wheel is turning
because it's used for skid alert and abs
so when the tire changes significantly
the rotational speed changes as well so
if you get a low tire alert but the
wheel is still turning in the same speed
at the same speed then you know
something is wrong you cannot trust the
pressure and there are other ways to do
that some passive TPMS actually look at
the balance of the car if you have a low
tire pressure then one one side of the
car is a little bit low so you already
have existing sensors and signals that
you can correlate with and know if this
is a fake signal or not but of course
it's hard for us to tell the car
manufacturers how to fix their problems
but the number one problem is us we need
to keep our eyes on the road if we knew
for a fact that whenever a driver got an
alert they would still look at the road
this entire attack wouldn't work okay so
as always it's a like security people
like to say the technology is ok it's
the human right so this is just an
example no that was the research and
here comes the message ok it's doable
yes it's a little bit far-fetched but
imagine if that thing actually works
then people might you know get hurt a
car crash inside the tunnel that's a
serious thing so it's doable and it only
needs to happen once imagine it just
happened and someone is calling one of
the car makers and says I did that I
want 3 bitcoins by tomorrow or it
happens again who knows
maybe they're lying maybe they're not
lying right so it's doable this is not
something to be disregarded as hackers
we know that where there's a will
there's a way if I want to find a way to
make something malicious I will find it
and this is why our starting point was
the fact that everybody else thought
that this was harmless this is sort of a
challenge accepted because when
something is harmless then you already
predict that there are not going to be
any mitigations so if you find a way to
do something the chances of creating
damage are larger because no one was
even prepared
for that right and we changed that
saying a little bit to say where there's
malice malice is bad intention okay word
there's malloced there's a way when the
bad guys decide that they want to attack
something they will invest the time
money effort whatever and find a way to
attack so we should never underestimate
the ability of other people to find
things that we have not found and this
applies to all of us as researchers if
we didn't find the answer it doesn't
mean it's not there if we perform the
pen test it does not mean that we found
everything somebody else could find
something that we did okay so remember
that and as someone that I sometimes
meet over the conference calls of the
sae he said if they also the other way
around if there's a way to do it
someone will be malicious because that's
how the world works okay because of the
incentives the criminals have or just
script kiddies whatever someone will
always be pardon my french the asshole
who wants to ruin the party for
everybody else so never assume that
everybody is a good person and maybe the
most important lesson here is that scale
matters if you look at a single car okay
this behavior is by design low tire
pressure sounds an alert and makes some
notification on the dashboard that's
expected you can't say hey this is wrong
this is expected behavior and the risk
indeed is meaningless the worst that can
happen is maybe you pull over and
discover that you don't actually have a
flat tire
but when you do that it's scale all of a
sudden the threat and risk assessment
change all of a sudden something that
was insignificant before becomes
significant now so when you do threat
analysis and risk assessment you need to
be aware of the fact that maybe what
you're looking at doesn't mean much when
it's one system well what happens if
it's done on many systems at the same
time or sequentially scale matters scale
changes the risk score of this
particular scenario significantly
because we could theoretically cause a
car
failure we come from Israel in Israel
failure is part of the learning process
some cultures in other places around the
world
don't encourage failure in fact some of
them even discouraging but we are
researchers research is about failing
many times people will stand on stage
and show you what they did amazing stuff
best research ever but they don't tell
you how they got there what they tried
that worked what they tried that didn't
work what was their thought process
learning from what other people did is
like doing copy and paste from you know
all the websites with the solutions but
learning somebody's thought process
teaches you a lot more so you need to
teach others as well failure is okay
because I think it was Mark Twain who
said I failed all the way to success
okay and if you haven't watched this
talk ng Albertini a very appreciated
researcher gave a talk two years ago
just about this success and failure in
the info state so look look it up it's
probably on their YouTube and it's
really it's part of the process you have
to accept that and if you fail do not
give up it's part of the process
document it continue researching and
then help others
thank you I think we have time for
questions right
[Applause]
yes we do have time for questions and
heads are proper God mic mics are coming
to you just let's start anywhere
shouldn't the car like automatically
correct itself is that you send that
that you send a message that the tires
are deflated but you know the sensors
send the message that the tires are not
deflated so the car should automatically
correct for the earnest behavior that
you introduced but a single car is a
single case in the case of a single card
nothing is wrong here and as I say this
is expected behavior by design when the
tire pressure goes down then an alert
happens if you discover that the tire
pressure is back up for instance if I
scoop the message and I got the alert
but you continue driving and then 20 or
30 or 60 seconds later the real signal
is transmitted then the alert goes away
it's very simple alert display alert
display the problem is its scale and
until we have a good vehicle to vehicle
infrastructure working then you can't
take that into consideration there's
very little you can do this is expected
behavior did I answer all right anybody
else
yeah we're also gonna look at the back
because it's always the people in the
back that don't know you ask me we have
another microphone for the people in the
back hello thank you for presentation
what carmakers
meeting how how much are matters
mitigated it that that risk
well actually carmakers have some other
concerns besides the security concerns
so one of the things that TPMS sensors
have they require a lot of maintenance
if you want to replace a tire that is
broken you need to there is like a whole
process of scanning the new tire
updating the the software on the ECU in
the vehicle are in order for it to be
able to transmit and receive so
basically they are already looking for
ways to avoid using IDs such as
automatic recognition of the sensors in
the vehicle and also relying on other
sensors in the vehicle in order to
determine whether the the tire is really
in play deflated or not so we assume
that in the future this will be solved
not because of security concerns
thoroughly but also because of a lot of
maintenance concerns as well and of
course we hope that they know the
correlation with other sensors as we
will suggested don't you consider that
the car is over alerting the driver so
one of the things that you hear now on
the SAE meetings is that driver
distraction is beginning to be taken
into consideration both in terms of
security and safety the industry is
mostly interested in safety because you
sell somebody a car they need to get
where they need to get but it's very
unsafe to alerted the driver as I said
this is an expected behavior if you have
a flat tire that has implications you
want to know so if they correlate it
with other sensors it's going to be
better or maybe they come up with a
solution that we didn't think of we
don't pretend to have all
thank you there was somebody else at the
back also we're gonna be outside if you
need to ask us more things hello so I
was wondering where are you over there
okay other sensors but each tire will
actually send its own data
besides the data that you are sending
the fake data so wouldn't it be simpler
to just count the number of occurrences
and don't display any alert if you get
different information from the same tire
actually it's like it's the other way
around actually in this case the the
spoofing transmission was pretty
persistent he took us actually a few
seconds as also like driving the car
accelerating and braking in order for it
to retransmit the correct signal again
so that tire doesn't send its own signal
in the meantime the tire does send its
sensors but because of the way I mean
ventually those tires run on on
batteries right so in order to save
battery life they don't transmit all the
time they transmit sometimes once a
minute and sometimes the only transmit
when you accelerate pretty quickly or if
you brake pretty quickly and and this is
something that we took as a advantage
for the spoofing attack so eventually
what happened here in the video is that
once we sent the spoofed message and the
and the tire the low tire pressure alarm
turned on we took a few good seconds
before the vehicle got an update
transmission from the tires and again
this is for to save battery having said
all that by the way anomaly detection is
one of the ideas but it's easier said
than done it is though
one of the ideas that was someone here
microphone yes so mike is coming to you
yeah keep your hands up so we can see
cool
hey and I don't mean to put you guys
down other celebre have you guys
considered a Barbra Streisand effect and
that you mentioned that basically you
offering solutions on mitigation is
important but have you reached out to
any vendors or any entities to basically
say I could probably use this as an
assassination attempt for like officials
or like on a motorcade or something on a
highway over like a 30% success rate in
that to like put it into context where
it could have the most damage or the
most efficiency or have you tried
contacting any vendors that particularly
you make these to say this is how it
could be released officials that say
this is what the worst-case scenario
would be for you guys so I'll answer in
parts as I mentioned before we're on the
one of the conference calls of the SAE
where people from the entire industry
are there we discussed this and
presented our theme
please remember the point of this
research is not the actual scenario of
the TPMS the important thing here is
that when you do risk analysis in threat
assessment or threat analysis and risk
assessment scale matters so now you need
to reconsider the risks and are the risk
score for something that looks riskless
now but might look different if you put
it in a scale actually you were talking
about assassination of seniors they have
their own you know I forgot the word for
that but no no they have it's like three
cars there's nothing yeah motorcade that
there's no one to crash with and I'm
pretty sure their drivers are much
better than any of us so that is not
really a scenario which is true but
they're so human so they're still gonna
have human reactions like an alert yes
but it's it's really far fetched and yes
there is a chance that this will be
performed but that is something that you
can say about pretty much all the
researcher we do all of us who disclose
problems or talk about risks you never
know whether you predict the future or
create the future
right because maybe some of you are
black hats I don't know that's possible
it's always a risk but this is so
far-fetched yet possible that we felt
comfortable to display that talked to
the vendors over the the industry over
other channels and they all agreed that
while this is an acceptable behavior
they need to reconsider threat analysis
at scale thank you about three more
questions alright somebody here
frontline microphone over here or you
could shout and we could repeat the
question yes
the spoofing test that you've done in
the parking lot was done with a
predefined transmitting package or did
you intercept and if you received some
packets from the car and then change it
and send it back so we we did the entire
intercept the entire process of
intercepting rebuilding and transmitting
it was divided into two steps so we
didn't actually make the entire thing
online and indeed it's a it's a
researching process so we still need to
as we said before stealing to take care
of the synchronization so you've sent a
predefined package so it was in the
blind yes it wasn't entirely predefined
we were building the package through the
script where you you chose the pressure
and the packet was being built and sent
the CRC was being calculated the reason
we didn't do what you asked about is
because we were doing our experiments at
a parking lot and as we said before
sometimes the TPMS will transmit every
60 seconds so you can't drive around for
60 seconds waiting for that that's not
part of a research so we recorded the
message at one opportunity and then at
runtime modified it recalculated the CRC
and transmitted it so it's not really
it's a lab setup basically it's the man
in the middle it's you know you can do
you can do
tire process in their parking lot you
just don't have enough for the car to
drive enough time for it for you to
record it because of the frequency of
transmissions and then send it you just
don't have enough enough length that was
an extra like what we did still proved
the research okay thank you
anybody else somebody here with have we
considered the implications on
autonomous driving we haven't yet this
is pretty much the same question of how
to analyze signals that you're getting
from sensors whether you do anomaly
detection whether you correlate them I'm
assuming it's hard to tell that I'm
assuming that car vendors that make
autonomous vehicles that watch this talk
or are part of this discussion that we
have on the conference call will know to
take this into consideration because
this is a particular case of a false
signal but when you start talking
vehicle to vehicle then it's also a
trust problem do I trust
lassies car if they're telling me that
they're breaking right in front of me
and they're not then I start breaking
and then they break so it's it's a trust
problem that the industry is aware of
looking into that last one I think yes
last question
any hands over there front line hi hi I
have a question it's not technical it's
more I don't know an opinion you
mentioned that car manufacturers don't
want to invest more in the ink
encryption part and change the device
but also you said that manufacturers
want to increase the safety what's more
important to them the cost question as I
said this in the context of a single
vehicle is expected behavior okay and
investing now in encrypting the TPMS
doesn't really solve the problem if you
can do it in other ways correlating the
same signal with other senses you
already have can be done in software so
why go and invest money and time and
research into making new hardware the
same solution can be done in software so
it's a mitigation it's just not the best
one or the most suitable or the cheapest
depending on all right okay cool thank
you so much for listening to us if you
have any questions we'll be outside
[Applause]