CHRISTIE DUDLEY: Okay.
Good afternoon.
I like to say, good morning.
Welcome, I'm here to talk about privacy in connected vehicles.
First of all, a little bit about who I am.
I have an electrical engineering degree.
And I decided that work as a network engineer -- I decided that
got boring, so I went to law school because that's where
all the really interesting problems lie.
The standard disclaimer: I'm not a lawyer.
I don't give legal advice yet.
But here is my nonstandard disclaimer.
I was contracted to work on this and I did sign an NDA in relation
to that work.
However, that was only about 20 hours of work total.
So there's not a lot of that to not disclose.
Okay.
This project.
Dedicated short range communications.
A lot of people should know what this is by now, but it's, unfortunately,
still pretty opaque.
The senate committee Subcommittee on Communications Technology
and the Internet sure is aware of it and they're really excited
about this being the panacea that solves
the wireless spectrum problem that they anticipate.
It's a multichannel protocol.
I'm going to be focusing on one channel, which
is for dedicated safety communications.
The idea is that vehicles communicate to other vehicles and
they also communicate with the infrastructure.
It would be pretty nice if 380 meters out they detected you were
approaching a red light in the middle of the night and so you never ever had
to stop because there was never any
cross traffic.
The idea of infrastructure efficiency is pretty cool.
My question will it maintain privacy?
I am not convinced that the system as described
will have enough protections for personal privacy.
I think it can, but I think it needs some very serious
people taking a very serious look at.
There have been a few reviews, like my review.
It was a very small project, and not a lot that's really convinced
the auto makers who are charging forward that they need to slow
down and consider the implications that this has on people.
The real reason that this technology is being pushed forward is safety.
And it's really dramatic the kind of safety expectations.
They just finished a large scale road test and the kind
of improvements they expect to get.
They're expecting an 82% reduction in all automobile accidents.
82%.
That's a really dramatic number.
It's revolutionizing driving.
For example, in 2009 there were 5,000 deaths just
from distracted driving alone.
That doesn't include drunk driving.
It doesn't include inattentive or emotionally distraught driving,
which also causes a large number of accidents.
5,000 deaths in 2009 that were totally preventable,
this system would completely eliminate that type or virtually eliminate that type
of accident.
There are a lot of people who are working
on this safety project.
As I mentioned before, totally nontrivial effect on death.
25% of vehicle deaths each year can be prevented even without the system.
With the system we're going to beyond what we're talking
about blind corners, dense fog, heavy rain, situations
the National Institute the NTSB, National Transportation Safety Board,
the wonderful people that brought us TSA, they have recently called
for a mandate because of two school bus accidents
in the last month.
The buses were one of them the bus driver was at fault.
He was on medication and he wasn't reacting as he should and
he ran a red light and the bus got hit by a truck moving
through the intersection.
And the other instance was the school bus was moving safely
and there was a speeding truck that couldn't slow
down in time to avoid hitting the school bus.
Two school buses, many school children died.
Each of these different scenarios could have been prevented had
the driver been warned that there was an imminent accident.
And with 380 meters communication range, that's the spec
for the communication range.
It has the potential to extend out much further.
So that's a lot of warning.
That's a lot of ability to respond in an accident.
Then the next question that comes up is this going to really happen?
And the answer is yeah.
It's already out there.
Most auto makers have plans most high end auto makers have plans
to include this in their 2014 model year cars.
The NTSB is talking about making a mandate
for 2015 model year cars, meaning every car
on the road starting in 2015 will have this.
ACDELCO is looking at aftermarket products,
perhaps saving you a little money on your insurance and bring more
money into the fold.
And then, how soon?
2014/2015.
Very soon.
They've already run large scale tests.
In Ann Arbor, Michigan, they got all the employees of the university
and the hospital to put the aftermarket version in their car
and they ran around for a year, and they measured what
the density implications were, how it dealt with the infrastructure
and how cars dealt with each other.
They learned a lot of lessons.
They came out with a new version and they believe they're ready
to move forward with this.
This sort of technology is already deployed in Europe.
In addition to the safety benefits, you're able to get more efficiency
by allowing cars to move closer together,
because as soon as somebody in front of you steps on the brake,
you know that so you can step on the brake.
If you're particularly alert, so you can get efficiencies, as well
as density efficiencies.
What is this?
The basic safety message is part of the protocol.
It's a digital blob that's sent out once every 10th of a second.
It's a standard blog with predefined.
There's no header information.
It's for the like ASN 1 where you have the key value pairs.
It's just the data glob.
The idea is that the cars process the messages and warn
the driver so that the driver isn't the driver actually gets to mitigate
the information and interpret it as to what they should do initially,
although the self driving car people are really excited about this technology.
They assured me that this wasn't an autonomous thing and
they would see that it works a few years
before they started automating the system.
This is what the aftermarket system looks like.
The idea is it comes with its own sensors.
It was told to me that it would be a self contained system.
There would be no existing.
They were confident they had developed
the sensor systems well enough that they wouldn't have the concerns
about coming between the sensor and the control unit.
I'm not sure that's necessarily true, but they feel that by moving away
from the architect and into this sealed system,
they could avoid a lot of the vulnerabilities that exist now.
So DSRC is not canned bus.
It's not the same technology at all.
This is a radio that communicates with other vehicles.
It has its own inertia sensors, GPS systems, as well as other systems.
They're very well aware with large cities with tall buildings
as well as in tunnels and canyons, it's sometimes very difficult
to determine GPS location.
So they need to have alternative ways.
They're working through that as well.
It is not OnStar.
I've spoken with a lot of people how is this different from OnStar?
This is a vehicle to vehicle.
All auto manufacturers would be running the same protocol.
And as I mentioned before, they're talking about mandate.
So this isn't a phone home situation.
This is a notify everybody in the vicinity.
Okay.
More technical details.
5.9 gigahertz spectrum.
The GOP owns the spectrum.
Only one of the channels will be used for safety messages.
Theoretically this does not require for the safety information
source address.
The source address was removed from the protocol in 2010
because of the privacy concerns.
Anytime you have a uniquely identified vehicle,
you have a uniquely identified vehicle.
And you have the problem of tracking.
So they removed that from the protocol.
However, if you think about it, how do you route
without a uniquely identifiable address?
How do you validate people?
They came up with the idea of certificates where you have
the fingerprint that's hard coded into each radio unit, and
the certificates are keyed to that fingerprint.
So if you have a bad actor, the whole package
of certificates are revoked by exposing the fingerprint.
Each area have some real privacy challenges.
The basic safety message.
This is the glob that's sent out much
like the canned bus message that SAE's come up with a standard for it.
The idea is it has a lot of really interesting stuff.
I don't know if you can see that.
It's very small.
It has location, acceleration, the status of your braking system
and each of these headers break down into individual values,
like for the braking system each individual brake reports its status.
To see if your interlock braking is engaged, track control,
stability control.
There are some other interesting things like message count
but it also includes your speed, your acceleration,
anticipated trajectory and your path.
In order for this to become effective, you need to have density,
because the benefit in a collision avoidance is not
from your unit transmitting anything, it's from the unit that you would
potentially hit transmitting their data.
So you would need the more units, the more vehicles
on the road that have this, the safer the road is.
So the other side of the coin is confidence.
If you don't believe that the messages you're getting
in are accurate, then you'll ignore it.
And this is where hackers come in.
I was thinking about I'll get on to that later.
Here I would like to point out that privacy
is particularly important because if people don't trust it,
then people will disable it and you wind up back
with the first problem.
If I don't feel like it's keeping my information private,
then I will I'm going to be disabling it if I can't go anywhere
without everybody being able to track me.
So in order to attack the validity problem,
they cryptographically signed all the certificates, and
the certificates are issued by a central authority.
I think that should be raising some alarm bells with some of you.
The question is who is that authority?
There has been discussions each auto maker is its own authority.
There's a government authority that
issues certificates?
Really?
There's public private partnerships.
All sorts of things.
And then the revocation.
They plan on using a black list system.
The Internet tried that, I think.
(laughter).
The idea is that the system, however, should invalidate itself
if its sensor checks fail.
It shouldn't be transmitting bad information
if its internal checks are not working.
They believe they have a lot of information available
for sensor validations.
If they can't even control their own drones, who knows how that can go.
So certificates, the idea is that they're limited time use so that
you can't be tracked by a unique identifier,
because as soon as you use the certificate for a little while,
then it's as easy to track you by that certificate as it would be
by any other unique identifier.
The idea is that they're refreshed.
You use I had discussions with people who were working
on these radios.
How big should we make our memory to store these certificates?
And they were thinking on the order of three years.
And it occurred to me three years to renew your certificates.
By the way, you have to report the bad accuracy when you renew
your certificates.
So if you're only recording bad actors every three years and then you get
a report back the next three years when you update,
it becomes pretty clear that that's kind of a bad idea.
So privacy.
Here we go.
Starting with Mac layer, at the very bottom.
The idea is that there is a changeable source
or no source addressed in the protocol.
This is been debated in the past.
Whether it does or doesn't have that source, really it will come
down to the implementation, because anybody who has worked
closely with protocols understands that nobody implements
a protocol perfectly.
And so if the leading implementation winds up demanding a source address,
then everybody has to use source addresses.
And this is the first to market problem rather than
a market penetration problem, because the first
to market sets the standard.
I'm thinking Hayes compatible modems.
Any traffic to these devices would be unroutable.
This is an interesting thought, considering we're talking
about moving vehicles if you had only an address to, like,
an infrastructure based station.
That would be great, but the infrastructure based station
would move out of range very quickly
and you would need some scheme to track that particular vehicle
and which direction out of range it's gone and could come
up with a pretty good tracking system, even
if you avoided tracking individuals.
So there's no initial privacy concern, but the implementation in how
they use it will create a problem.
So coming back to what I showed you earlier, up there
in the header elements I just kind of grouped some like things.
They have this temporary ID field.
It is a specific field in the basic safety message itself.
Temporary, that sounds pretty good.
It's not a persistent identifier, but depending
on the application implementation, it could be.
Everybody's idea of temporary is somewhat different.
My idea of temporary is no longer than five minutes plus
or minus three.
So I don't think everybody is on the same page.
So certificates.
They try to address the identity validity conflict.
You want to trust somebody, but they don't want you
to know who they are.
And it's something that you deal with all the time struggling
between the authenticated user and the anonymous user.
If we have constantly changing certificates with unsteady shift,
then that could help.
Once again, it depends on the implementation.
But the biggest issue is the issuing authority who can control
it, who knows what vehicle maps to what fingerprint maps
to what certificate and what location they are.
There have been proposals that the units are shipped sealed and
the fingerprint is not known to the auto maker.
So they can't map a VIN, but then there have been proposals
to the IATF that the VIN be used as the fingerprint, which is expose
the VIN, expose the vehicle, the whole vehicle can no longer use
the system ever again if there's
a problem and then you wind up in the aftermarket use vehicle sector
picking up radios just for their VIN.
So the fingerprint, no correspondence.
I think I've covered all this.
So the delivery is the next challenge that I saw.
How to get the certificates to the vehicle
is we don't currently have mechanism to communicate that doesn't
authenticate or uniquely identify both sides of the conversation.
And most include some trackable method like I think cellular
is the leading contender right now for certificate delivery.
Wireless or even using DSRC end band and that hurts my head
to think that end band certificate delivery could happen.
There's just so many opportunities that that could entail.
So more worrisome what's going on with this, I mentioned that
the safety was only one channel on many channels
of the DSRC spectrum.
The other channels there's a lot of applications.
They're talking about mesh networking routing,
sharing MP3's with the other cars on the highway
is the big joke about that.
The advertising is one that particularly gets me,
because that's not only a concern for people who bought
a car and don't expect to be pummelled with advertising
all the time, but also we've, I imagine, discussed different ways that
advertising can be used as malware delivery.
(laughter).
What concerns me the most is the last one.
I'm giving a talk tomorrow on data brokers,
but data brokers using this fixed infrastructure, giving it to you
for free so they can select all the data, which neighbors go to which malls
and which neighbors go where.
There is a lot of data in this system that cannot
be overlooked.
Another problem with in is law enforcement.
You're transmitting your speed every tenth of a second, even if you're
the most conscientious driver, occasionally you
will be transmitting a speed that is over the posted speed limit.
There's really published studies on there.
There's no way to get around that.
Downhill, cross winds, suddenly shifting wind directions can
push you over the speed limit.
Can small law enforcement agencies start issuing tickets by mail?
That's not very bright.
It's possible to correlate location and speed and get
a nice license plate reader to go along with the system so that when you
pass through their camera, they can catch you that way.
It's very easy to de anonymize this and law enforcement has
at their disposal.
So I know if I got a speed ticket in the mail, I would disable the system.
I'm neither the most nor the least conscientious driver,
but I don't want to expose myself to that specific vulnerability
and that expense.
So what can you do?
And this is kind of a call to action to all of you.
You're hackers.
You have an idea about how these things can be broken
probably even more than I do.
The radios are commercially available.
COHDA is the leading manufacturer right now.
Cisco has an interest in them.
They just released a brand new unit that is designated
as a reference design for production so that others can enter
test with that.
DSA is out there, but it's behind pay walls.
I've tried to get a couple of other people to really play with it
and break it.
All the documents are behind pay walls.
And become politically engaged.
The senate knows what this is.
You guys should know what this is.
Every auto manufacturer knows what this is.
The administrative agencies, they're all totally on board with this.
Hackers need to be jumping in and making a difference here.
More than anything else, that certificate authority needs
to be hashed out.
If we're to maintain any privacy at all, there needs to be a separation
between the government, the auto makers and the users.
All three of these need to have a stake in this decision.
So that pretty much concludes my slide show.
I'd like to acknowledge a few people.
Professor Dorothy Glancy led me down this path, and introduced me
to a lot of people in DC 650.
We kind of hammered this out.
Here is my contact information.
If you have questions, we have a microphone up here,
if you would like to step forward.
(applause) How about the problem of false warnings and what would be
the per vehicle cost of these new systems?
How robust and the cost maintenance?
Does it break every 30 days?
The cost of the system, how robust, and also false warnings.
CHRISTIE DUDLEY: Okay.
False warnings, three questions.
False warnings, the cost of the system, and maintenance.
Those are all three very good questions.
Every auto maker, of course, is going to have a different cost
for their systems.
The idea of this being a sealed system suggests that it's not
going to break down for at least two or three years
until your extended warranty is up.
(applause).
But the idea is it's supposed to be built very robust.
And the third question was false positives.
False positives is a really serious concern.
Much of my report to the auto makers involved
the threat of the false positive and the threat of the false report.
There are a couple of other really obvious basic things.
You can't cause collisions because there's a human involved,
but you can cause traffic slowdowns.
You can get people out of the way
because you don't even have to tell them you're a police car,
you can just tell them you're speeding and you're going
to hit them and they'll get out of the way.
So there's a lot of concern there.
I have a question about the message globs,
so when looking at them you said the source address is optional now
and the ID that's included is temporary.
How susceptible do you think they are to fingerprinting in general?
For example, your browser could be fingerprinted
just by the sequence of fonts that are installed
and things like that.
Can you comment on that?
CHRISTIE DUDLEY: There are a couple of things.
Another issue in the glob of data is the size of the vehicle.
I'm fairly certain within a certain range you'll be able
to identify manufacturer of vehicles.
Beyond that I'm not sure.
One of the things you bring up another point.
One of the things that I think is very important to consider in privacy,
you can get too far beyond where it's useful.
Facial recognition technology is involved in my eyeballs
and we don't consider that to be an invasion of privacy.
If you don't consider an automatic thing
a significant threat to your process, but as soon as the people get taken
out of the system or the person who is operating
the radio frequency fingerprinting, if you have to follow a car
around to fingerprint or if you have to have careful spectrum analysis,
I imagine you could do it at a mall parking lot or something
like that where you're looking at the vehicle.
But to identify a whole class of vehicles,
you're not really narrowing it down to an individual so much.
So it's a concern.
It's not the biggest concern, I guess, is where I'm going with that.
Thank you.
Hi.
Thank you for bringing this up to this particular community.
You know work for one of the agencies involved.
CHRISTIE DUDLEY: Yes.
Could you lower the microphone?
Okay.
Some of us have to look at the problems you brought up.
I'm glad you're bringing it to the attention of this group.
If you don't mind, what I'll do is to let the group know about some
of the data sets that we're making available from the Ann Arbor test.
CHRISTIE DUDLEY: You might as well mention your TLA.
That's a web address.
I'll repeat this twice.
It's www.its rde.net.
Www.its rde.net.
That is the exchange that we have set up for the Ann Arbor test data.
All the basic safety message that Christie talked about are available
from that and we would like to put up an informal challenge where
government agency and we are in sequester right now
because we can't put any cash behind this, but we would
like to challenge the community to take a look
at that data and use that data set to identify any of the drivers
without using social engineering.
Just from the data set itself.
We think we have it, but we're still in the prototype stage.
We would like as many holes punched into this
as technically possible now so we can fix those.
Thank you again, Christie.
CHRISTIE DUDLEY: And he brings up a very important point.
The more we can hack on this right now,
the better chance we will have of not seeing faulty units get installed
in vehicles, because they're ready to roll.
And we need to stop them if they're break things.
Do you know how they plan on switching the fingerprint?
So or switching the certificate?
So I imagine a couple of problems with that.
So if you switch it while you're driving and you have that path history;
that would probably stay the same across different certificates
so that you could correlate them together.
If you only do that for a single run of the car, then you know where
they start and where they end, and so you could probably identify
them that way.
So it seems pretty challenging to do that.
CHRISTIE DUDLEY: Yeah.
My recommendations were based on the average trip length.
And so you want assert that lasts no longer than half your average
trip length.
And there's a lot of discussion about when you start transmitting.
If you want to do it at the point where
the power door locks engage, so you don't know exactly quite where
they started, but you do get that information
as soon as it's necessary.
So there's a lot of thought that's going
into at what points.
Like my recommendation also was not to have fixed periods,
but rather have a plus or minus and have a little randomness
in there so that they can't set up listening stations to track you
as you leave their store.
My thought is a big box store wants to know if you left and went
to their competitor or where did you go when you left their store.
So where were you before you came?
The idea that having a flexible length and minimum
of half the average trip size or maximum.
Great.
Thanks.
Hi.
This was focused mainly on emerging DSRC.
My question is how much or are you involved in some
of the other things that are emerging, for instance of the Calematics
out of Detroit.
CHRISTIE DUDLEY: I'm not really involved in any
of the other specialty systems.
My specialty is privacy.
I look at a variety of embedded devices.
Automotive privacy is very interesting to me,
because even more than your cellphone, which
is my previous research, even more than your cellphone,
your vehicle tells where you've been, where you're going, and it tells
a lot about you, who you associate with and where you spend your time.
It says a lot about you.
So it's critical that neither the government
nor the advertisers take that information from you
without your consent.
In that case I would point you to Calematics Detroit.
If you Google that, the session abstract
for every session of that conference CHRISTIE
DUDLEY: Oh, I'm aware of the conference.
Split up all the data in the car.
So thank you.
CHRISTIE DUDLEY: Thank you.
I had two questions.
CHRISTIE DUDLEY: Closer to the microphone.
Sorry.
I had two questions.
The first one was what sorts of displays would be would we be
looking at as far as, like, getting the driver information?
And the second question was would there be any drawbacks to, like,
the certificates changing before the trip has ended as far
as its safety?
CHRISTIE DUDLEY: Okay.
First, here is an example of the display they have in mind.
This is one of several different things they've been
toying around with a small display in the center of the dash.
They have talked about lights in various places in the cockpit there
is a lot of human interaction research that's done on what kind
of displays and everybody has a little bit different idea.
What was your second question?
Is there any drawbacks to having the certificates changed
before the trip is completed?
Like you have one car driving and it's one car to the computers
and then, like, instantly it changes to another car.
CHRISTIE DUDLEY: Persistence of vision.
Cars can do it, too.
The cars around you don't get confused when the certificate changes.
In fact, you wouldn't even notice.
One of the concerns about changing certificates is well,
if you were to be followed, then they would be able to track
the certificate changes, but if you should be followed,
then you're being followed.
So the real interest is in just the persistence at the point of change.
That shouldn't be a problem, because what the system does
is it takes the packet and validates it
and then strips the certificate off.
So all the processing is done once the packet's been validated.
So it really shouldn't change anything at all.
Okay?
Is this system supposed to be operating internationally?
CHRISTIE DUDLEY: Yes.
If yes, then how do you solve the foreign certificate issue?
CHRISTIE DUDLEY: The European bandwidth that is available
is the same as the bandwidth in the United States and they plan
to do the same protocols in Europe as the United States.
The only difference is in Japan where that bandwidth
is not available.
It's been allocated elsewhere.
The law makers that are working on this, I worked with three European,
three American, and three Japanese auto makers.
They were adamant about having the exact same system in the U.S.
and in Europe.
What about certificate authorities?
CHRISTIE DUDLEY: That's a really good question.
And when you start crossing international borders,
the government piece of the three interests changes.
And there will be all sorts of interesting wrangling in that respect.
That's a very good point.
The gentleman from the ITSRDE described this
as a prototype system.
You described the user enter base as very much under development.
You mentioned this is expected to ship on high end automobiles
for the 2014 model year.
Those are on the lot now.
And 2015 cars you were thinking about that maybe being a mandate.
That seems contradictory to me.
Can you explain where we're at in the development cycle
and how close we really are to having these on the road?
CHRISTIE DUDLEY: I don't know the stuff on the lot right now.
I don't follow model years.
As I mentioned, my specialty is privacy.
I do know that they were working when I spoke
with them around this time last year, August, I wasn't able to come
to DEF CON because I was working on this project.
When I was speaking with them that last August,
they were talking about already having radios.
And I actually got to put my hands on some.
And they already had the radios.
They already were trying to get them in the cars.
And so that's the best information I have.
When I say "high end," I mean the BMW's who are doing automatic
parking and the various where they're kind
of going off a little bit on their own that.
The user interfaces, there wouldn't be no uniform interface,
just like there is no uniform car interior.
Every auto maker will have its own interpretation
of the kinds of alarms and the way that they will alarm you.
That seems really scary to me.
I mean, if I'm used to, to use your example, a BMW,
and then I rent a Cadillac and the system is different, I'm not used
to the warning systems, I'm sure lawyers would love
to argue liability over that.
CHRISTIE DUDLEY: Well, the liability of not responding
to a warning system is what you're talking about there.
And that's a really interesting point that I don't think anybody else
has discussed.
Yeah, to argue the liability for not responding, that would be
an interesting argument because the situation you would be
in there would be that somebody was driving erratically and it was the duty
of the person who was not driving erratically to heed the warnings
and get out of their way.
So that's the only situation where the liability would be at issue.
Thank you.
CHRISTIE DUDLEY: Okay.
We're done.
Done.
Thank you all very much.
(applause).