Th The Fu Futur ure Is Is He Here e - Mode dern rn Attack - - PowerPoint PPT Presentation

▶
th the fu futur ure is is he here e
SMART_READER_LITE
LIVE PREVIEW

Th The Fu Futur ure Is Is He Here e - Mode dern rn Attack - - PowerPoint PPT Presentation

Jun 18, 2023 466 likes •1.29k views

Th The Fu Futur ure Is Is He Here e - Mode dern rn Attack ttack Sur urface ace On On Au Automotiv omotive Lior Yaari 28/11/2019 Techy Trainer at DeepSec 7 Years In Cyber Security Vulnerability Researcher Sec-Dev CS Teacher

slide-1
SLIDE 1

Th The Fu Futur ure Is Is He Here e - Mode dern rn Attack ttack Sur urface ace On On Au Automotiv

  • motive

Lior Yaari

28/11/2019

slide-2
SLIDE 2

Techy Casual Cool Hobby

7 Years In Cyber Security Born In Jerusalem Trainer at DeepSec Sec-Dev Consultant Studying German CS Teacher Vulnerability Researcher

slide-3
SLIDE 3
slide-4
SLIDE 4

IDS IPS Automotive SOC Prevention Concepts

Bypassing ECU protections End to End Security Testing Building Security Products Breaking through the cloud or factory Vehicle Security Research

slide-5
SLIDE 5

Disclaimer

As part of our job with CYMOTIVE we are working closely with several automotive companies and because of that many of our findings are under NDA. We will not include ANY customer names and real issues which can cause any harm and focus more on the tech side

* All photos in this presentation are from open sources found on the internet

slide-6
SLIDE 6

Progress Bar

  • Who I Am
  • Automotive Past & Future
  • Connected Technologies
  • Centralized Management
slide-7
SLIDE 7

Automotive Main Trends

V2X Bluetooth NFC 4G Wifi PLC LiDAR Sonar GPS SLAM Thermo

slide-8
SLIDE 8

Who talks to my car?

Year 2005~

slide-9
SLIDE 9

Who talks to my car?

Bluetooth, Wifi

Year 2015~

slide-10
SLIDE 10

Who talks to my car?

Year 2025~

RF,BLE Cloud OTA

slide-11
SLIDE 11

What does it imply?

slide-12
SLIDE 12

Changes

CAN Bus Ethernet

Mechanical Engineer Software Developer

slide-13
SLIDE 13

New Demands

Vehicle Clouds

Growing IT Department Tons of Infosec Jobs

slide-14
SLIDE 14
slide-15
SLIDE 15

Some Terminology

Original Equipment Manufacturer (OEM)

slide-16
SLIDE 16

Some Terminology

Engine ABS Door Door Radio Nav Diag Airbag Body

Electronic Control Unit (ECU)

Info Gateway

slide-17
SLIDE 17

Some Terminology

Infotainment (Information + Entertainment)

slide-18
SLIDE 18

Progress Bar

  • Who We Are
  • Automotive Past & Future
  • Connected Technologies
  • Centralized Management
slide-19
SLIDE 19

The new fashion in vehicle IoT are “Aftermarket Solutions”

Which are also the solution for hackers

slide-20
SLIDE 20

Aftermarket Solutions

Vinli OBD-II Chainway TSP Samsung Engie Viper Smart Start Drone Mobile MYCAR

slide-21
SLIDE 21

Hacking the: Server, Phone, Dongle

  • >

Hacking the car

Dongle Server

slide-22
SLIDE 22

Keyless Entry =< Car Sharing

slide-23
SLIDE 23

By Continental https://www.youtube.com/watch?v=vdnrr5i4naE

slide-24
SLIDE 24

MYCAR App - Found by Jmaxxz Car2Go App

slide-25
SLIDE 25

The Bluetooth Problem

Infotainment, Dongles, Keys are all Bluetooth connected

Hell2CAP (Cymotive)

CVE-2018-20378

KNOB (SUTD)

CVE-2019-9506

BleedingBit (Armis)

CVE-2018-16986 CVE-2018-7080

slide-26
SLIDE 26

Hell2CAP Found by Barak

Caspi at Cymotive

State machine bug in BlueSDK L2CAP (~100 Million Devices) We Are Here

slide-27
SLIDE 27

L2CAP Channel Multiplexing L2CAP_Connect(PSM=0x1)

PSM – “Protocol ID”

slide-28
SLIDE 28

L2CAP Channel Multiplexing L2CAP_Connect(PSM=0x1)

PSM – “Protocol ID” DCID – channel identifier

L2CAP_ConnectResp(DCID=0x41)

slide-29
SLIDE 29

L2CAP Channel Multiplexing L2CAP_Connect(PSM=0x1)

PSM – “Protocol ID” DCID – channel identifier

L2CAP_ConnectResp(DCID=0x41) L2CAP_ConfReq(DCID=0x41, …)

slide-30
SLIDE 30

L2CAP Configuration

Can config: MTU, Timeout and more Minimal Bluetooth MTU is 48

  • Bluetooth Specification Version 3.0 + HS [Vol 3]
slide-31
SLIDE 31

L2CAP Configuration

Pseudo code

Save MTU Check Size Set Invalid On Fail

slide-32
SLIDE 32

L2CAP Configuration Connect

Channel 0x41 Valid – Yes MTU – 0x500

slide-33
SLIDE 33

L2CAP Configuration Connect

Channel 0x41 Valid – Yes MTU – 0x200

L2CAP_ConfReq(DCID=0x41, MTU=0x200) L2CAP_ConfResp(DCID=0x41, SUCCESS)

slide-34
SLIDE 34

L2CAP Configuration Connect

Channel 0x41 Valid – No MTU – 0x10

L2CAP_ConfReq(DCID=0x41, MTU=0x10) L2CAP_ConfResp(DCID=0x41, INVALID)

slide-35
SLIDE 35

Hell2CAP

Red flag – Values is stored (4) than checked (5) Can we restore channel to be valid?

slide-36
SLIDE 36

Hell2CAP

Red flag – Values is stored (4) than checked (5) Can we restore channel to be valid?

ConfigRequest (MTU = 20) Channel Invalid. ch.MTU = 20 ConfigRequest (FlushTimeout = 0x1337) Channel Valid ch.MTU = 20

slide-37
SLIDE 37

Hell2CAP

On upper layer – SDP there is fragmentation code MTU from L2CAP, we control it

slide-38
SLIDE 38

Hell2CAP

On upper layer – SDP there is fragmentation code

MTU = 48 -> availableSizeForFragment = 48 – 9 = 39 MTU = 8 -> availableSizeForFragment = 8 – 9 = 0xFFFF

Integer underflow

slide-39
SLIDE 39

Hell2CAP

Set Low MTU Integer Underflow Buffer Overflow

Profit

slide-40
SLIDE 40

The problem with Bluetooth is that it is not the only problem

V2X

slide-41
SLIDE 41

V2X – Vehicle to X

slide-42
SLIDE 42

By Autotalks https://www.youtube.com/watch?v=RRDiDPnv_b4

slide-43
SLIDE 43

V2X payload is ASN.1 based

slide-44
SLIDE 44

A fake V2X module could

Create False Traffic Force Emergency Breaks Generate False Alarms

slide-45
SLIDE 45

Charging Evolution

slide-46
SLIDE 46

Charging PLC EVSE – Electric Vehicle Supply Equipment PEV – Plug-in Electric Vehicle

EVSE PEV

slide-47
SLIDE 47

Charging PLC PLC – Power Line Communication

EVSE PEV

slide-48
SLIDE 48

Charging Protocol Stack

Wired / Ethernet IPv6 TCP UDP HPGP SLAC

Vendor Specific

SDP

V2GTP XML- EXI

TLS

slide-49
SLIDE 49

Wired / Ethernet IPv6 TCP UDP HPGP SLAC

Vendor Specific

SDP

V2GTP XML- EXI

TLS

Header Edge Cases XML Parsers Vulns

slide-50
SLIDE 50

Wired / Ethernet IPv6 TCP UDP HPGP SLAC

Vendor Specific

SDP

V2GTP XML- EXI

TLS

Header Edge Cases XML Parsers Vulns

VxWorks TCP/IP Stack CVEs by Armis Labs URGENT/11 (19.7.2019): IP RCE: CVE-2019-12256 TCP RCE: CVE-2019-12255, CVE-2019-12260, CVE-2019- 12261, CVE-2019-12263

slide-51
SLIDE 51

EVSE! Use Buffer Overflow!

slide-52
SLIDE 52

Hackers Benefits

EVSE PEV

Charge your credit card and not your car Hack other ECUs from PEV

slide-53
SLIDE 53

Progress Bar

  • Who I Am
  • Automotive Past & Future
  • Connected Technologies
  • Centralized Management
slide-54
SLIDE 54

Hackers Benefits

Vehicle Clouds

EVSEs are all cloud connected

slide-55
SLIDE 55

The Vehicle Cloud

The Magical Place Where Everything Is Possible

(For a Hacker)

slide-56
SLIDE 56

The Vehicle Cloud

Normal Stuff

Juicy Stuff

Private Information Credit Cards OEM Secrets GPS Coordinates Remote Unlock OTA Updates

slide-57
SLIDE 57

The Vehicle Cloud

Futuristic Stuff

Centralized Control for Shared Transportation Next-Gen Police The cloud is the limit…

slide-58
SLIDE 58

OTA – Over The Air Most modern cars receive software updates with 4G connection to the OEM servers

slide-59
SLIDE 59

The Vehicle Cloud

Update Update Update Update Update

slide-60
SLIDE 60

The Vehicle Cloud

Update Update Update Update Update

slide-61
SLIDE 61

ST STOP! OP! Pay 5000$ to unlock this car

slide-62
SLIDE 62

4/11/2019

slide-63
SLIDE 63

The bright side

OEMs invest immense efforts in cyber security Connected autonomous would be really great

slide-64
SLIDE 64

Risks Opportunities

Everything Is Connected New Attack Vectors – BT, Wifi, NFC, V2X, PLC Less Accidents Life Changing Technologies

TL;DR

slide-65
SLIDE 65

Ask Me Anything

Lior.yaari@cymotive.com Lior@imperium-sec.com Twitter: @lior_yaari

slide-66
SLIDE 66
slide-67
SLIDE 67

Hell2CAP Found by Barak Caspi at Cymotive State machine bug in BlueSDK L2CAP (~100 Million Devices) We Are Here

slide-68
SLIDE 68

L2CAP Channel Multiplexing L2CAP_Connect(PSM=0x1)

PSM – “Protocol ID”

slide-69
SLIDE 69

L2CAP Channel Multiplexing L2CAP_Connect(PSM=0x1)

PSM – “Protocol ID” DCID – channel identifier

L2CAP_ConnectResp(DCID=0x41)

slide-70
SLIDE 70

L2CAP Channel Multiplexing L2CAP_Connect(PSM=0x1)

PSM – “Protocol ID” DCID – channel identifier

L2CAP_ConnectResp(DCID=0x41) L2CAP_ConfReq(DCID=0x41, …)

slide-71
SLIDE 71

L2CAP Configuration

Can config: MTU, Timeout and more Minimal Bluetooth MTU is 48

  • Bluetooth Specification Version 3.0 + HS [Vol 3]
slide-72
SLIDE 72

L2CAP Configuration

Pseudo code

Save MTU Check Size Set Invalid On Fail

slide-73
SLIDE 73

L2CAP Configuration Connect

Channel 0x41 Valid – Yes MTU – 0x500

slide-74
SLIDE 74

L2CAP Configuration Connect

Channel 0x41 Valid – Yes MTU – 0x200

L2CAP_ConfReq(DCID=0x41, MTU=0x200) L2CAP_ConfResp(DCID=0x41, SUCCESS)

slide-75
SLIDE 75

L2CAP Configuration Connect

Channel 0x41 Valid – No MTU – 0x10

L2CAP_ConfReq(DCID=0x41, MTU=0x10) L2CAP_ConfResp(DCID=0x41, INVALID)

slide-76
SLIDE 76

Hell2CAP

Red flag – Values is stored (4) than checked (5) Can we restore channel to be valid?

slide-77
SLIDE 77

Hell2CAP

Red flag – Values is stored (4) than checked (5) Can we restore channel to be valid?

ConfigRequest (MTU = 20) Channel Invalid. ch.MTU = 20 ConfigRequest (FlushTimeout = 0x1337) Channel Valid ch.MTU = 20

slide-78
SLIDE 78

Hell2CAP

On upper layer – SDP there is fragmentation code MTU from L2CAP, we control it

slide-79
SLIDE 79

Hell2CAP

On upper layer – SDP there is fragmentation code

MTU = 48 -> availableSizeForFragment = 48 – 9 = 39 MTU = 8 -> availableSizeForFragment = 8 – 9 = 0xFFFF

Integer underflow

slide-80
SLIDE 80

Hell2CAP

Set Low MTU Integer Underflow Buffer Overflow

Profit

slide-81
SLIDE 81

Ask Me Anything

Lior.yaari@cymotive.com Lior@imperium-sec.com Twitter: @lior_yaari