How's everybody doing.
All right, just in Defcon style we got this quick video
to show you.
So pay good attention.
(Music) Yeah, what do you think?
(Applause) Awesome.
All right, so our first speakers up today are Charlie and Chris.
Adventures in Automotive Network controlling.
Let's give them a big Defcon welcome.
(Applause) CHRIS VALASEK: Thanks for coming out!
Thanks for getting up early or staying up late, however it
is for you guys.
CHARLIE MILLER: I was disappointed we didn't boo
the general off the stage in Black Hat.
But I've even more disappointed there's this many people awake at 10:00.
Shame on all of you.
CHRIS VALASEK: So, you know, as he said before I'm Chris.
He's Charlie.
I don't know some people may know me for Windows heap crap.
I think people know Charlie for computers of some sort.
CHARLIE MILLER: I do computers.
CHRIS VALASEK: He does computers and so can you.
So we're going to talk about the cars we have today.
We're going to talk about the ECUs in those cars and then we're going give
you a brief kind of overview of CAN.
Most people are familiar with it.
But we'll give you our $0.02.
Charlie's going to go over some standards and protocols
then we'll go into the cool shit which is CAN message injection.
This is how we're actually doing physical
control of the car, stuff like that.
And from there we can talk about firmware reprogramming
of these ECUs and that's how you would get what are referred
to in the business as persistence to be on the car forever.
CHARLIE MILLER: So if you need any work
on cars we're mechanics now.
All you got to do is get on the internet and you can order
the stuff.
CHRIS VALASEK: And walk right into the garage and start working
on them.
If you have a Toyota or Ford that you want Charlie
to fix, we'll bring our laptops over and tune it up for you.
CHARLIE MILLER: Everyone says how hard it is to get a job
but just order the stuff.
CHRIS VALASEK: Job creators right here.
CHARLIE MILLER: Let's talk about, like, what's been done
before and why we decide to build on that.
So in 2010/2011 a couple of papers came out by a group
of researchers from university of Washington and the University
of California San Diego.
And they did, like, awesome work.
Like, I read their paper.
It was incredible and immediately I was like how can I expand on this?
I was like well I can't.
Right.
They did everything.
They looked at remote attacks.
They looked at, you know, the attack service, vulnerabilities.
They wrote remote exploits.
They controlled things through the CAN.
They did the whole thing.
Super impressive work.
But one thing they didn't do was they didn't tell anyone
about any details.
So there's this video where they you can see this big black dot.
So it's, like, the guy walks in and unlocks the car and drives off.
When I first saw it I was like shit they just stole someone's car
for real and they don't want the cops to bust them that's why
they covered it up.
But turns out they covered it up because they didn't want anyone
to know what car they worked on.
Then if you look in their paper you see things
like this where instead of giving you the actual data packets they use to, like,
control the car, they, like, they avoid giving all the bytes
out to you.
CHRIS VALASEK: It is a great paper
with no real data information in it.
CHARLIE MILLER: Right.
So they said I can remotely attack your car, control aspects of your car,
but you can't do that.
Right?
So that was, like that made us want to say, we want everyone to be able
to do this, right.
I wanted to share what we know how to do.
It took us, like, ten months to do this.
So we don't want everyone to go through ten months of pain
like we did.
We want people to go through two months of pain.
CHRIS VALASEK: Hopefully instead of the first few months flopping
around knowing what you to do you will be able to get a cool,
cut it open and reading and writing stuff on your car within a few hours.
CHARLIE MILLER: So if I wanted to actually attack you in your car,
which I don't want do, you would have to do two things.
A remote attack which the university guys already showed.
They showed remote attacks through the blue tooth interface
of a car then a pretty cool one where you stick
a CD into the radio and get code running that way.
The second part is doing something to the car itself.
Our research was focused on the second part.
We've written exploits our whole life and they're boring but the cool thing
is making cars drive around.
What we wanted to do is to use new vehicles
they never said what vehicle they used.
But everyone thinks it is a GM.
So some guy who is up here who I have no idea who it
is and he would have no right answer as to what the answer
is says it's Chevy Malibu.
He's right.
So we chose different cars.
We also chose cars that have more, like, electronic features than
the cars they use.
Such as stuff that had to do with steering.
That was, like, something new.
But the main thing that's different that is we want to share all the data
and hard work we did so everyone can do the same thing.
Car research is cool.
CHRIS VALASEK: I'm sure more people than us want to do this stuff.
So we'll try to help everyone out.
CHARLIE MILLER: The first thing I learned, we're software guys.
We don't know that much about hardware, cars.
CHRIS VALASEK: I know Windows.
That's about it.
CHARLIE MILLER: I was like a car is just like a big iPhone right?
I'll be good.
This is going to be no problem.
Turns out it's not.
In the old days when I wanted to do research I would just download
software and start looking at it.
That's super easy.
Turns out, like, starting car hacking not so easy.
We had to buy a car.
Turns out this is really hard.
Especially when you are, like, okay I want a 2010 Toyota Prius
with intelligent park assist.
And they're like okay what car.
CHRIS VALASEK: Don't care.
CHARLIE MILLER: What about if it's scratched up.
I don't care.
Mileage don't care.
I don't care what color.
I don't care where it's at.
Anywhere in the country.
I need to find this car and want to buy it from you.
CHRIS VALASEK: They would say what do you want to spend.
We would say give me the car.
CHARLIE MILLER: Just get us a car.
CHRIS VALASEK: I am sure our backers have enough money
to afford this car.
CHARLIE MILLER: Absolutely.
We're like Iron Man.
We have our own corporation and we're independently wealthy.
So we got the cars.
The first thing that comes up when they pull up it's, like, can it park itself?
They're like yes.
I'll buy it.
So getting the cars was hard.
Then we're use to working like this.
CHRIS VALASEK: Usual work day right there.
CHARLIE MILLER: This is called working from home.
Turns out in car research you have to, like, be out in your car.
And it's, like, 20 degrees out and, you know, you can't turn the car
on because you fucked up the ECUs and stuff.
So I'm sitting out there at 20 degrees
with all the clothes I own on.
CHRIS VALASEK: Looking like the Unabomber by the way.
CHARLIE MILLER: Yes a little bit.
And my computer's about to freeze up.
It's much harder to do car research.
This is, like, normally when you are ready to start,
like, attaching your de bugger CHRIS VALASEK: That's how you work when
you come to Vegas.
CHARLIE MILLER: This is regular software research.
It's easy.
Hardware research sucks.
You are constantly cutting up your hands and stuff.
It is a total pain.
When it comes time to do assembling, I can handle idle pro all day.
But then disassemble a car.
This is hard.
CHRIS VALASEK: The steps with 388 easy steps you can have
the dash off.
I was like fuck this give me a crowbar.
CHARLIE MILLER: So we disassemble cars
but don't reassemble cars.
CHRIS VALASEK: When it comes down to debug I'm use to bust out GDB.
I just cut 17 wires and one of them is a problem.
I should have stopped at 16.
And I don't remember which ones they were.
Then when you are writing your exploit or code, your payload, there's a bug.
Bug when you are writing your payload for your car you call the flatbed
and they come and pick up your car and take it
to the dealer then you explain to the dealer why your dash is tore
out and why your computers are hanging from wires in your car.
I said don't worry about the inside of the car.
You are going to get this car and freak out.
Don't freak out just call me.
When they couldn't fix the car because imagine that
they had never seen this problem before.
Seriously they had too get like corporate Toyota on the line.
They were like we've never seen this.
I'm like I am sure of that.
So then they call Chris and they're
like Toyota says that we should put everything back together.
Chris is like don't do that.
Just make it run.
CHRIS VALASEK: I was like I have 500 parts
in my garage you are not getting them.
Just fix it.
CHARLIE MILLER: Finally, when your application finally crashes
that's a good thing.
People are happy.
When you crash in your car research it
is a totally different story.
The short story of this is I have this feature that I'll show you
guys later how you can make the brakes not work in your car.
When you are I was pulling in my driveway
with this feature engaged and I was, like, oh no it's too late.
(Laughter).
And there was my real car on this side of the driveway
and my house on this side.
All I had was a tunnel into my garage and no brakes.
So I was like I tried whatever I could.
I panicked.
I just rammed into the back of my garage.
CHRIS VALASEK: Charlie called me he's like I wrecked.
I was, like, that's awesome.
We did it.
CHARLIE MILLER: Chris was not supportive.
CHRIS VALASEK: I didn't care about his wellbeing.
CHARLIE MILLER: So I crashed the wall.
Here is more photos of my lawn mower.
Totally destroyed.
You can see the back of my garage.
It's no longer flat anymore.
The food is all splintered.
The first ever cyber victim in the physical world.
CHRIS VALASEK: When it goes on Wikipedia you can say we were
the first people to cause harm to an object
through automobile research.
CHARLIE MILLER: Yep.
That poor, poor thing.
Let's talk about the cars we actually got.
This isn't like breaking research since no one talks about this.
So we decided to get the hardest possible cars
to hack it seems.
But really what we did was we just said we ordered what's
the cheapest car that has auto part.
2010 Ford escape.
It has advanced features such as cruise control, back up camera.
But what we cared about is park assist.
So here is a video of real park assist in action.
This is not hacking.
This is a feature from the car.
You are driving along it tells you, like, put it in reverse.
You put it in reverse.
Then you back up and then it steers for you.
So it doesn't make the car move.
But it will steer for you.
You see the wheel move.
Is there sound anyone?
Can you make sound.
CHRIS VALASEK: We had to try to figure out what type
of Kodak we were dealing with which we did
by downloading every single RMC for codex whose holy shit.
CHARLIE MILLER: I don't remember grapping or saying that.
CHRIS VALASEK: Likewise.
CHARLIE MILLER: So maybe sound from the video and not
the next room would be awesome.
So this thing it was like this is really cool.
The car parks itself.
That means there's a computer in the car that can make
the steering wheel move.
CHRIS VALASEK: I had a 2010 Toyota Prius and this was, like,
your super luxury end Toyota Prius.
Had radar cruise control.
So if you are going down the highway and a car in front
of you was going slower it would slow down for you.
Which meant the brakes are going to slow you down.
We thought.
Has lane keep assist.
Where you can set it if you are going off the road it sees the lines and
will correct the car for you.
CHARLIE MILLER: This is the car of the future.
CHRIS VALASEK: This is.
CHARLIE MILLER: When Chris was driving to South Bend for testing
he says I was kicked back.
CHRIS VALASEK: I was tweeting the whole time.
If you are going to wreck it beeps.
If it starts beeping I know I have to get off Twitter for a second.
Had a pre collision system which again was really neat.
Even if you had your foot on the acceleration pedal it would pre
tighten the seatbelt and apply the brakes if it thought you were going
to wreck.
Again, it also had intelligent park assist.
Which is what we really wanted?
I think one of our main goals was have
the car steer itself without anything, you know, that is doing it
with a computer.
We didn't even know if it would be possible.
So wanted to make sure there was
a computer doing steering for you.
So ECUs or electronic control units.
These control almost every aspect of your modern automobile.
That is especially true for the Prius.
Almost all of the Prius was controlled by computers, right.
And these computers take input from sensors.
Sensors tell you things like how fast you are going.
And then they control actuators.
Things that say clamp the brakes or put fuel into the engine,
things like that.
They're located kind of everywhere within the car.
In the Prius most were in the dash.
The ABS ones actually built into the main brake cylinders.
So you can't just yank it out U.
Have to take the whole car apart.
So they're everywhere.
And I think one of the question we got was oh yeah it's
some kind of Linux on all these things.
It's not.
It's just custom code on arbitrary hardware and there's no,
like, general thing you can do.
They're not running services.
It is a computer that does stuff.
CHARLIE MILLER: And you might know there's a computer
in my car because there's a screen.
Well there that is computer.
But there's, like, 30 other computers.
CHRIS VALASEK: And they're all interacting and it's hard
to figure it out.
The ECUs were connected by a CAN bus.
All these computers are on the same bus.
It's broadcast in nature.
So every CU that is on the same bus can hear
and see every other ECU.
This is good because you can see all the traffic.
It's bad because there's no real addressing.
So you don't know where things are going or where they came
from without physically, like, isolating one of these things.
One of the hardest things is we'd see all this cool traffic and be, like,
I don't know where this came from, right.
While it's good and bad, it's good if you want to say inject
into this network because they don't ask where
messages came from either.
As long as you are on there, you can send messages.
I think this is important to understand because I think a lot
of the first feedback we goat when doing this, we're like they're Jacked
into the car.
They didn't do it remotely.
It doesn't matter if you are Jacked in or do it remotely.
Once you are on the CAN bus you are
on the CAN bus.
If you pop remote access good.
If you have limited physical access good.
If you compromise an ECU or are connected physically it's
all good.
CHARLIE MILLER: The ECUs they basically talk on this network
and send message to each earth and different cars have
different typologies.
So the Ford had two different networks that were sort of isolated.
But some of the ECUs were on both networks and
the Toyota basically had one.
CHRIS VALASEK: Yeah one but another segregated one.
CHARLIE MILLER: If you want to see what an ECU looks like.
This is from the Ford.
The power train control module.
This controls, like, your engine.
The thing to see here is there must be
like 300 wires that run into this.
And each of these wires run to, like, an oxygen sensor in a piston
or I don't know.
Some car thing.
CHRIS VALASEK: Car lingo stuff.
CHARLIE MILLER: They're all important.
If you start cutting them the car doesn't work anymore.
This is just a computer with, like, lots of, you know, wires that run to it.
If you rip it open it looks like this.
So you've got basically one chip and then it's like, you know,
the CPU and lots of other little chips.
That's the inside of what a ECU looks like.
CHRIS VALASEK: The CAN network.
We were interested in CAN specifically.
You know, we are aware there's Lynn and flex ray.
But we want to look at CAN.
We knew both cars would have CAN.
The IDs can really be 11 bits or 29 in length.
The IDs are what the ECUs use since its broadcast
to say which message is for me.
CHARLIE MILLER: Identifiers.
CHRIS VALASEK: Then the data can be zero to eight bytes.
We'll talk more later how you can send more than that.
Generally you see zero bytes and up to eight bytes.
And the CAN identifiers are used as priority fuel right.
So to figure out arbitration on the bus, the lower IDs have precedent
over higher ones.
You know, the highest priority ID on a CAN bus for 11 bit is, you know,
zeros, right.
So, again, broadcast nature they have these IDs.
You can kind of look these IDs up, categorize them.
We spent a lot of time just figuring out what certain IDs were
by spending hours and hours and months in the car.
CHARLIE MILLER: Instead of sitting in front of your computer,
I would drive up and down my street all night and parallel park my car, like,
200 times.
CHRIS VALASEK: People had to think I was, like, a prowler
in the neighborhood.
I would just circumstance them block for four days straight.
With a laptop in my land, cables over my shoulder.
And the lovely Pittsburgh police stopped me once and just saw me
with cables and shit everywhere, like, Bro, I got to X what
the hell are you doing.
I'm, like, I'm hacking cars.
They're that's cool.
Have a good day.
Actually told me I'd tell to you drive safe.
I was, like, yeah I know.
So these are kind of the normal style CAN messages.
You will see the format we used was made
up by Charlie and I to be human readable
and also digestible by our API which we'll talk about.
IDH and IDL are a byte apiece.
Combine them it is a 16 bit well 11 bits ID.
There's one from the Ford escape.
It has eight bytes.
One from the Toyota that has four bytes.
The Toyota really, really liked putting a checksum
as the last byte.
If you look at the Prius traffic the last one's 95.
That's IDH plus IDL plus length plus data which is 33880 then
a one byte checksum.
This happens a lot.
If you don't check that checksum right, messages are ignored by the ECU.
When we're injecting traffic we had to make sure to always fix
the checksum for each message we sent.
The other is diagnostic examples.
You will see here how it's IDHO seven and IDL 60.
A, that's an address.
Each ECU is going to have this diagnostic address.
And this is although the CAN bus is broadcast
in nature you actually identify individual ECUs by this address.
The reply back from the ECU is always going
to be eight greater than one what the ID was before it, right.
So it's 0768.
If you saw the academics papers they didn't cut off the front half
of a lot of messages they were using and not so shockingly
they all started with, what, 0007.
There were a lot of stuff they ended up that were diagnostic messages.
CHARLIE MILLER: So there's normal messages and that's basically what
your car normally uses.
The computer talking to each other.
Diagnostic messages you would never see in your car unless in the shop.
CHRIS VALASEK: Mechanics use them to figure out what's wrong
with your car right.
CHARLIE MILLER: So these are used to talk to one particular EC unit
and ask how it's doing.
So different cars will follow different standards.
Our two cars followed the standards sometimes when
they felt like it I guess.
CHRIS VALASEK: They did all their own thing however
they wanted to do.
CHARLIE MILLER: The first standard you need to read if you want
to figure out what the traffic is ISO (inaudible).
This is where you are, like, so you can only send eight bytes
in a message?
That's kind of weak.
Then especially if you want one per checksum.
So it's hard to communicate only seven bytes.
So it is a way to send more than eight bytes at a time
over the eight byte messages.
And the way it works is basically your very first byte
is like a meta metadata for the rest of the data.
Depending if it's a 0, one, two or three like the first four bits tells
you whether it's one frame, whether the first of many,
whether it's other ones, whether it's response and so forth.
So here's what that looks like in ISTP data.
On the top one it's 03 which means it is a single message.
And the data is three bytes in length.
14 FS 00.
The next one you can send a one which means there's
more than eight bytes all together.
And then the length is 082.
Then the data starts.
Then you get a response back of 30 saying okay I know you are
talking ISOTPM.
The next one is two which means this is a follow up.
And one means is the first follow up packet.
CHRIS VALASEK: We explain this much more detail in the paper.
CHARLIE MILLER: The paper is, like, 100 pages.
It's full of information.
So CHRIS VALASEK: If you ever wanted to be
inside Charlie's brain you can read this paper and it's just like that.
CHARLIE MILLER: And it's just as boring.
That's the way that, like, you are going to see data actually
on the network if it's actually ISTP.
It just says how to send lots of data but doesn't say what it looks like.
There's another standard that describes what the data is suppose to look like.
At least in some respects.
The thing is each ECU may or may not implement the things
in that standard.
And when they do, even that is just like sort of the first layer then there
would be more data you would have to understand.
So the standards sort of help you learn
the first three bytes out of 20 bytes.
But after that you are kind of on your own.
CHRIS VALASEK: Also with it being that every ECU doesn't
have these when we did this we looked up the spec and it's
like they're going have read memory by address we'll rip the firmware off.
None of mine has any of that functionality U.
Are like this is going be simple.
All the car is going to follow this.
I'm get the firmware and the car will do whatever.
The car will blowup.
I'll be internet famous and it will be great.
And it's ten months of in your car crying wondering why
your neighbors think you are weird.
CHARLIE MILLER: Couldn't have said it better myself.
So here is an example of some of that ISO interaction.
Here you are trying to establish a diagnostic session
with one of the ECUs.
Here the 02 is the ISO two part.
The ten says diagnostic session control and
the three says extended diagnostic session.
The EC replies back.
It says if it's successful it adds 40 to the number that
is the I forget what they're called the ID.
CHRIS VALASEK: Service number.
CHARLIE MILLER: Oh yeah.
Then repeats the three then sends more data.
This is what it looks like back and forth communications
with these diagnostic packets.
Anything else?
Here's one that is pretty interesting.
In order to talk to the ECUs and make them do things, you need
to authenticate them.
To do that you use this thing called security access.
So security access rolls like this.
So again two bytes of data then 2701.
27 means security access.
01 says I want the first level of access.
There's multiple levels.
Then the response back from the ECU
is these three bytes that are highlighted.
This is a seed.
And the idea is this is just some random number then you
have a secret key and you can do some crypto algorithm with their seed
and key and the end result is three more bytes.
Then you send them back the three bytes that you generated.
And that proves that you had the key so they know to trust you.
Here I send back the three bytes then it says 67 which
is 40 plus 27 which says yes you are now authenticated at level two which
is like the lowest secure level you can be at.
So anyway that is the part that makes it if you wanted
to do cool things like we sat around a long time trying to figure
out how to get it to do CHRIS VALASEK: We sat
for quite a bit doing that.
CHARLIE MILLER: Luckily you won't have to.
Here's more things that you can do to ECUs with diagnostic sessions.
Input/output control is cool.
You can tell it that suppose that your sensors are reading one thing pretend
your sensor is reading one thing or ask what are your sensors telling
you and stuff like that.
It's 0307 which means, you know, that is the control to be tested.
That's suppose to correspond to some sensor.
You don't know what that is.
It's not part of the standard.
It's just proprietary.
CHRIS VALASEK: Each manufacturer and model can be
different for this stuff.
CHARLIE MILLER: Then there's even more data.
So if you don't know all that the ECU is, like, I don't know what you are
talking about.
CHRIS VALASEK: This is one of the services that's basically do stuff.
CHARLIE MILLER: Right.
Then here's some so PIDs was the thing.
Anyway.
So here's some of the other one that's sound
really cool.
Like routine control is pretty cool.
It's like CHRIS VALASEK: RPC.
CHARLIE MILLER: Yeah on Windows or something.
Then there's other ones like I'll talk about that later
to update the firmware.
Like Chris said there are ones that are, like, read memory by address.
Like sweet.
Just dump the firmware.
But that never works.
CHRIS VALASEK: Yeah that it does on some.
But certainly not ours.
CHARLIE MILLER: You would Google, like, remember my address
and there would be all these guys like tuners trying to rev up their car.
They're like that totally works.
CHRIS VALASEK: Everyone is like oh dude the tuner.
I was like guess what we're not trying to do that we're trying to get
the firmware off.
No one is tuning a Toyota Prius.
(Laughter) It's not like I had an option.
I don't think anyone is on the Ford escape on track day.
CHARLIE MILLER: No one cares to tune their Ford escape.
CHRIS VALASEK: We had hardware tools as well.
Our main thing we used was an ECOM cable.
You can buy these things for 200 bucks.
Unfortunately, they don't have direct ODB ll access so
we had to find the wiring schematic on the website, cut some wires
and put it into an ODB ll shell.
So, basically, we turned this thing into our own personal ODB ll reader
and writer which was great.
Because ECOM provided an API and we augmented it
and wrote all of our stuff that we're going release
where it makes it very, very easy to read, filter, write, store externally,
bring it in from external files and all that kind of stuff.
CHARLIE MILLER: And we were very proud that we could cut those wires.
CHRIS VALASEK: When I cut those wires it worked I was
like hardware hacker.
CHARLIE MILLER: Absolutely.
(Laughter) I had him mail me one once.
CHRIS VALASEK: We met in South Bend for a football game
and I brought him one in a box.
It was happy about it.
I used a CarDAQ plus as well.
It's a J2535 pass through device.
It's kind of a medium between the manufacturer software
and ODB ll port.
This is really cool.
Because when some bad things happened in my car I could clear
the DCT codes.
I could perform some level of maintenance, things like that.
It was really good because I had the Toyota tool, had it hooked up.
You can buy a Y splitter I.
Had our ECOM cat software that we wrote sniffing.
I'd like the tool do stuff then sniff it and analyze
the packet and say this does this and this does this.
Those are just the ODB ll shells with a bunch of pins.
If you are going do this buy 20.
They end up breaking from time to time.
So get a bunch of them.
This brings us to the software that we had.
The first thing the cool that we wrote is a thing called ECOM cat.
You can probably guess why we named it that.
CHARLIE MILLER: Because we like cats.
CHRIS VALASEK: Because I'm allergic to cats.
It was our Swiss Army knife.
This is a thing that we kind of started writing I was writing some
on a plane.
So when you read the code, our string parser for this
is actually a state machine.
Because I was, like, I couldn't look I didn't have internet
and couldn't look up any of the documents.
It was like I know how to write a state machine I'll just do it that way.
But this can read and write to the CAN bus.
It can store, you know, output from the CAN bus into a file.
It can read from that file and write out the CAN bus.
It can do levels of flittering for ID.
Say you figure out an ID for steering and want
to only see messages from it on your screen because you want
to see what happens when you turn the wheel.
Which is a lot of what we did right.
You are looking for reactions in the data bytes
for things you are physically doing to the car.
This does it all.
And it's probably a bit of a mess.
But you should be able to kind of look through it and figure it out.
CHARLIE MILLER: We're going release this weekend or something.
CHRIS VALASEK: Then we have our E com cat API.
It's written in C.
The E com cat EPI is also written in C.
API functions for abstracting a lot of E com cat.
So instead of having to I don't know, like, change we have like defines
at the top for the ID that you want to look for.
CHARLIE MILLER: It's actually in python.
Obviously he really worked hard on that aspect of the project.
CHRIS VALASEK: I've been asleep at the wheel far too long.
But the ECOM cat EPI the Python portion of what we did
for ECOM cat.
And there's another thing called car lib that is the thing written in C that
the ECOM cat API uses.
There we go.
It's just an easy way to do car stuff without having
to write C and then it makes it really easy.
We also did PYECOM which is just more Python stuff.
The neat stuff is you don't have to worry about ISO TP.
You can just say send data bytes.
If it's going send you 2,000 bytes back it takes care
of you and you get it back and can do whatever you want with it.
Here's some example code.
Open a device and then you can say, hey, here's one
of those debug lines we know.
Send it.
Done.
So instead of having to do all this in C and do eight months
of research you can buy an ECOM cable,
copy and paste this and your car happy.
CHARLIE MILLER: The idea is you can read and write cam traffic
with two lines of Python now.
CHRIS VALASEK: So, you know, not all the functions
in the automobiles are performed by CAN.
For example in Charlie's car the acceleration pedal was directly
wired into the engine ECU.
Not everything is going to happen.
CHARLIE MILLER: There's no way it's ever going to listen to anything
on the cam bus that tells it to do anything related to the throttle.
It just knows that doesn't happen on CAN.
CHRIS VALASEK: Al you have to realize there's contention
between what the ECU is sending and what you are trying forge.
So you are not going have completely proper reactions all the time
for certain things.
Then there's going to be actually safety features involved.
We'll talk more about steering with park assist right we couldn't go
over a certain speed.
CHARLIE MILLER: So let's get to some of the things that we can inject.
There's one packet.
You can set the speedometer and the tachometer on the Ford.
This is the code, the Python code that would do that.
CHRIS VALASEK: If you had a Ford escape you could literally copy
and paste that.
CHARLIE MILLER: Right.
Oops I did the wrong thing.
Here is a video.
This is like I'm on a closed test track that I rented out.
(Laughter).
CHRIS VALASEK: You can tell we were really careful.
CHARLIE MILLER: I'm not really driving 60 miles an hour
but sure looks like it.
Then you can do the same thing for Toyota.
Let's see.
CHRIS VALASEK: I want to show people CHARLIE MILLER:
It's like a magic trick.
Really the garage is moving on a flatbed truck and it's all a trick.
We don't really know what the hell we're doing.
CHRIS VALASEK: We hired Michael Bay to figure this out.
CHARLIE MILLER: So you can change the speedometer.
CHRIS VALASEK: In the Toyota you can do braking.
Before I talked about how the pre collision system can brake
for you.
We isolated the messages sent.
Usually they would come across saying hey don't brake.
Finally I took some garbage cans out and backed the car
up about 200 meters and floored it then went right for the garbage cans
and hit them and it would beep and the brakes pumped when it happened.
Not enough to stop from destroying the garbage cans
but enough that we found out what the messages were.
Here's the code for that.
You can copy and paste that.
We just decided we want the brakes at full force.
So here is a video of us CHARLIE MILLER: Again we're
on a closed test track.
CHRIS VALASEK: Right now you will see when
the car stops CHARLIE MILLER: We're driving about 50.
Right now we do it.
Then we're like errr.
CHRIS VALASEK: You can even press on the acceleration pedal
and you can't move.
This completely immobilizes the car.
Steering in Toyota was a bit tricky.
But eventually like Charlie said we were
the people outside parallel parking our cars for two months straight looking
like crazy people and trying to get these messages.
We figured these out.
The only thing with a Toyota it refused
to do it unless you were in reverse.
Then we had to figure out how do we trick the car
to think it's in reverse?
So we did that.
CHARLIE MILLER: It would only work if you were going slow.
CHRIS VALASEK: So if you saw the Nintendo controller demo wee did
that before we figured out how to trick it.
We're like now we need to make it figure
out how it thinks it's going to slow.
So we have code and files we're going put up.
And it's like we're going slow.
We're in reverse.
Hey jerk that wheel man.
This is a really good video of Charlie and I almost dying
on our closed test track.
CHARLIE MILLER: Yes.
I'm driving along minding my own business.
CHRIS VALASEK: And I'm next to Charlie.
(Laughter).
I could even hold the go pro.
I think here is where we almost died.
CHARLIE MILLER: I make the mistake of trying
to adjust my seatbelt right when it was going to happen.
Almost killed me.
So here's the if you are driving what it looks like.
CHRIS VALASEK: That's not good times in traffic.
(Applause) CHRIS VALASEK: So we have acceleration.
Acceleration was a bit weird.
Charlie mentioned before there was two CAN buses.
They both ran at the same rate.
This one was kind of segregated.
So although we had to just clip into this individual CAN bus
and couldn't do it over ODB ll, if you are going to compromise
the ECU, this ECU is this bus and this is the one you want to pump.
Basically I found out here is what happens when you send
these messages.
And it kind of, you know, simulates pressing
the acceleration pedal.
Unfortunately, for the Toyota it's hybrid synergy drive.
CHARLIE MILLER: So we're going tell it that the accelerator's
all the way floored.
What you will see in the video is Chris will be driving and he'll pick his
legs up.
If you look super close you can see the speedometer start to go up.
Listen to the engine too if the sound is good.
CHRIS VALASEK: Trying to listen to the engine I guess.
CHARLIE MILLER: His legs are not on the accelerator right now.
CHRIS VALASEK: You can see I am a bit scared.
CHARLIE MILLER: Then notice we stop but you can hear the engine
is still at full rev.
CHRIS VALASEK: You can hear the RPMs are way up, right?
CHARLIE MILLER: Then he can't turn off the car.
And this is the last time that car's ever started.
CHRIS VALASEK: Seriously if we would have filmed this two
seconds longer you heard a pop.
I was like that never happened before.
And it just died.
We actually blew up the inverter.
It's going to cost us $5,000 to get it out of the shop.
They're like we've never seen this happen.
I was like well.
(Laughter) (Applause) CHARLIE MILLER: Luckily stark enterprises
going to foot the bill.
CHRIS VALASEK: So we're all good.
CHARLIE MILLER: That was all the stuff we did
by injecting normal cam traffic.
The traffic you would normally see.
Now we're going look at if we start to do diagnostic things.
So we had to first figure out how to get around the security access.
The way we did that was well for the one this is, like, really funny.
One of the module ECUs didn't send a random thing it just sent
the same thing every time.
So you could watch it once and play it.
In the paper you can see the explanation of why that happens.
But the other ECUs do send random things.
So you can't force it, replay things.
So what we did was we bought all the tools
the mechanics using then reversed them.
CHRIS VALASEK: Along with the shirts.
CHARLIE MILLER: Yes.
So this is the IDS tool you can get from Ford.
You know, only qualified mechanics can get it.
Like us.
So then you can start to reverse it.
We're good at software.
So this was the easy part.
CHRIS VALASEK: This was the easiest part.
CHARLIE MILLER: This is the algorithm it uses
to compute the response.
Then you can find where they store all the keys for all the cars.
(Laughter).
CHRIS VALASEK: For 200 easy dollars you too can have all the keys.
CHARLIE MILLER: That's all in our Python script.
The keys it turns out on five byte values
but sometimes would make them ASCII bytes.
CHRIS VALASEK: Those are all Ford keys by the way.
CHARLIE MILLER: Hackers the movie they said God
is the most used password.
And they didn't use God but they did use Jesus.
CHRIS VALASEK: God bless.
CHARLIE MILLER: Here's the keys for the 2010 Ford escape.
CHRIS VALASEK: All on API.
Toyota is much the same.
They actually just used two bytes and (inaudible)them
with two static values.
I think we can all do that.
CHARLIE MILLER: But we do it for you in Python.
Then you can send these diagnostic ones.
Here is killing the engine.
I'm driving up a hill and then I kill the engine here.
Then you can see like we stop then trying start the car
but it won't start.
So I'm rolling downhill.
(Laughter).
My son is actually filming it.
And he's talking to me.
You can kill the engine at any time and I won't start until you turn that off.
CHRIS VALASEK: You can turn the lights on and off in the Toyota
if they're in auto state.
Turn them on, turn them off.
Car blew up, we didn't get a chance to film it.
Check the paper we'll have a Python script.
CHARLIE MILLER: We were going to film this right
after the acceleration video.
But we don't have a video for that.
And the Ford you can take out the ECU that is in control
of all the lights in the car.
And so here is an example of that.
You can hear me talking.
I'll turn that down.
So the lights go out and, like, it's like the air conditioning goes out,
the radio goes out, the brake lights go out,
the headlights go out.
If you can imagine driving down a dark street you would be
in super stealth mode engaged.
You can see me, like, I can't get out of park either.
Because the electronics to control the thing that stops you
from jamming it into gear wouldn't let me out of parking.
CHRIS VALASEK: We can do the horn in Toyota.
You can blast the horn forever.
Or until it malfunctions.
Here is us messing with Andy Greenberg.
Could not do anything.
CHARLIE MILLER: Even if you turn off the car the horn
is still going.
CHRIS VALASEK: We talked about the pre collision system.
Toyota we can yank the seatbelts.
So if the driver is driving you see here it's me versus
Charlie via seatbelt.
CHARLIE MILLER: I'm going fight it.
CHRIS VALASEK: Fight it Charlie.
CHARLIE MILLER: I'm like stop it.
CHRIS VALASEK: It's not that great.
It is really annoying.
(Laughter).
I kept telling him that's the last one.
I'm done I swear.
You can unlock and lock all the doors in the Prius via
the CAN bus.
We meant to do that video.
Car blew up.
We don't have it.
Check the paper we have Python script unlock and lock all doors.
And that could be great if you had
a remote and wanted interior access.
Fuel gauge.
We can tell the Toyota it has as much or little gas as we please.
You see we have a quarter tank of Petro and now we have a full tank.
This would be a good joke on friends.
Tell him he always has a full tank of gas.
CHARLIE MILLER: Here's one for the Ford that I made Chris wet
himself on.
He knew that I was going to make the brakes not work
but he didn't know that it comes with this super loud scary sound
at the same time.
CHRIS VALASEK: I have a lot of cackles.
But you will see in this video this is my I'm deathly afraid cackle.
We're not stopping.
CHARLIE MILLER: This only happens if you are going, like, five
or ten miles an hour.
CHRIS VALASEK: But imagine the orphanage let out that day.
CHARLIE MILLER: He is going to come park over here.
That's the noise.
Now we're over the curb.
Now we're driving into the weeds.
Now he CHRIS VALASEK: I even tried
to use my left foot.
I didn't know what to do.
CHARLIE MILLER: Turns out the brakes are disabled
for either foot.
(Laughter).
So we're pretty much out of time but you can actually dump
the frameware.
Check out the paper for details and you can reverse the whole thing,
disassemble it.
So here's just a video that shows I will rewrite the firmware
of an ECU so it continues to send out a packet even though I'm not
connected anymore.
Now I've overwritten the ECU firmware.
So now I'm not connected anymore to the OBD II port.
The reverse family is still on even though I'm going forward
on the closed test track.
Even though I'm driving, I'm not connected to the ODB ll port.
CHRIS VALASEK: In the malware game I believe this
is called persistence.
So that's a big deal because that's the difference
between just spoofing CAN messages then completely taking control
of a computer that exist in that car and making it do stuff.
So those are the things that are, like, the scary stuff.
Toyota reflashing is astronomically weird.
Check out the paper.
I think I wrote 14 pages on how to reverse their file format.
CHARLIE MILLER: So the good thing
is now that we released to data you can think
about how you could stop these attacks.
Couple things really stick out.
One is that you should never so the normal packets are very
regularly scheduled.
So you can always and we flood the network.
So, if you see floods going on then something's going.
This is like a histogram of what you would expect.
When we would attack it would not look anything like this.
Also you probably shouldn't see diagnostic packets while driving
around on the highway.
CHRIS VALASEK: Disabling the brakes via diagnostics probably
shouldn't happen while driving.
That's just us.
CHARLIE MILLER: We're not car experts or anything.
Then we gave our white paper to Ford and Toyota, you know,
like a few weeks back.
Toyota issued this statement that says that they don't consider this "hacking."
CHRIS VALASEK: We're not hackers, and we didn't hack
the car so no big deal.
CHARLIE MILLER: And it says that we can do this and it says our focus
is to stop the remote part and they don't care about the local stuff.
And they have, like, super expensive R & D facilities just
like that.
CHRIS VALASEK: They have test tracks as we.
CHARLIE MILLER: So sort of the take away is that
they really focus on remote attacks.
So, you know CHRIS VALASEK: That's the same thing.
You have a firewall and you have AV, don't worry about it.
Nothing's going to get in.
CHARLIE MILLER: That's basically the way their cars are running.
Which is cool.
So anyway check out the paper.
It's got everything you want to know about ECUs.
CHRIS VALASEK: If you are really interested check out the paper.
It's 101 pages.
All the code.
All of our data.
Everything.
You are going to get every thing we ever had.
Hope it helps everyone get in the game.
CHARLIE MILLER: Thanks a lot guys!
CHRIS VALASEK: Yeah, thanks!