1 1 00:00:00,000 --> 00:00:02,010 Vehicular Vulnerabilities. 2 2 00:00:02,010 --> 00:00:02,850 In this lesson, 3 3 00:00:02,850 --> 00:00:05,160 we're going to talk about planes, trains, and automobiles. 4 4 00:00:05,160 --> 00:00:06,300 Well, not really. 5 5 00:00:06,300 --> 00:00:07,312 We're going to talk about automobiles 6 6 00:00:07,312 --> 00:00:09,060 and unmanned aerial vehicles 7 7 00:00:09,060 --> 00:00:10,924 and any other vehicular thing that could be controlled 8 8 00:00:10,924 --> 00:00:13,080 by some kind of a computer. 9 9 00:00:13,080 --> 00:00:16,240 Now, these days, cars are getting smarter and smarter. 10 10 00:00:16,240 --> 00:00:19,620 For instance, we have cars like Tesla that drive themself. 11 11 00:00:19,620 --> 00:00:21,101 They use sensors around the car. 12 12 00:00:21,101 --> 00:00:23,820 They take that information back to a centralized computer, 13 13 00:00:23,820 --> 00:00:25,674 and then they adjust your steering for you 14 14 00:00:25,674 --> 00:00:28,680 or your speed for you based on what they're sensing. 15 15 00:00:28,680 --> 00:00:31,410 All of this is done by computers and by code, 16 16 00:00:31,410 --> 00:00:33,480 which means it's dangerous, right? 17 17 00:00:33,480 --> 00:00:34,680 Because all of this stuff 18 18 00:00:34,680 --> 00:00:36,720 could have software vulnerabilities. 19 19 00:00:36,720 --> 00:00:38,571 Now, these car manufacturers are doing their best 20 20 00:00:38,571 --> 00:00:41,280 to try to keep these as safe and secure as possible, 21 21 00:00:41,280 --> 00:00:44,220 but a lot of things and a lot of older vehicles 22 22 00:00:44,220 --> 00:00:45,720 are extremely vulnerable. 23 23 00:00:45,720 --> 00:00:46,753 So we have to talk about that 24 24 00:00:46,753 --> 00:00:48,840 as we think about security at large 25 25 00:00:48,840 --> 00:00:50,700 because you might have a corporate fleet of vehicles 26 26 00:00:50,700 --> 00:00:53,280 and they might have some of these vulnerabilities. 27 27 00:00:53,280 --> 00:00:54,900 Now, when we think about vehicles, 28 28 00:00:54,900 --> 00:00:58,200 these vehicles all have lots of different systems on them. 29 29 00:00:58,200 --> 00:01:00,480 These systems all have to connect some way. 30 30 00:01:00,480 --> 00:01:02,370 And so we take all these different subsystems, 31 31 00:01:02,370 --> 00:01:06,180 like the HVAC, and the steering, and the cruise control, 32 32 00:01:06,180 --> 00:01:07,680 and all of these different functions, 33 33 00:01:07,680 --> 00:01:08,513 and they all get passed 34 34 00:01:08,513 --> 00:01:12,360 over what's called a controller area network, or a CAN. 35 35 00:01:12,360 --> 00:01:13,193 Don't confuse this 36 36 00:01:13,193 --> 00:01:15,780 with the CAN you learned about back in Network+, 37 37 00:01:15,780 --> 00:01:17,310 where we talk about campus area networks, 38 38 00:01:17,310 --> 00:01:19,800 this is a controller area network. 39 39 00:01:19,800 --> 00:01:21,960 Now, when you talk about a controller area network, 40 40 00:01:21,960 --> 00:01:24,600 this is a digital serial data communications network 41 41 00:01:24,600 --> 00:01:26,790 that's used within a vehicle. 42 42 00:01:26,790 --> 00:01:28,410 Now, if you look at an airplane, for instance, 43 43 00:01:28,410 --> 00:01:30,990 they have miles and miles of cabling, 44 44 00:01:30,990 --> 00:01:32,880 and all that cabling connects together. 45 45 00:01:32,880 --> 00:01:34,290 That is a CAN. 46 46 00:01:34,290 --> 00:01:35,850 In your car, the same thing, 47 47 00:01:35,850 --> 00:01:39,030 just not as large or not as a big of an extent. 48 48 00:01:39,030 --> 00:01:40,230 Now, when we start talking 49 49 00:01:40,230 --> 00:01:42,330 about how we can talk to this CAN network, 50 50 00:01:42,330 --> 00:01:45,360 how can we as somebody in the car reach into it? 51 51 00:01:45,360 --> 00:01:49,620 Well, the primary method that we use is known as an OBD-II, 52 52 00:01:49,620 --> 00:01:52,320 which is an Onboard Diagnostics module. 53 53 00:01:52,320 --> 00:01:54,187 Now, this is something that was put in all cars 54 54 00:01:54,187 --> 00:01:56,790 starting in about the 1990s. 55 55 00:01:56,790 --> 00:01:57,623 And the reason for this 56 56 00:01:57,623 --> 00:01:59,650 was as we started having onboard computers in the cars 57 57 00:01:59,650 --> 00:02:01,770 and we got things like a check engine light, 58 58 00:02:01,770 --> 00:02:03,510 and you want to know how do you check the engine? 59 59 00:02:03,510 --> 00:02:05,635 Well, you plug in something into the OBD-II port 60 60 00:02:05,635 --> 00:02:07,560 and that's going to end up coming back with a code 61 61 00:02:07,560 --> 00:02:09,150 that tells you what's wrong. 62 62 00:02:09,150 --> 00:02:11,250 That's what the port was originally designed for 63 63 00:02:11,250 --> 00:02:13,830 but these days, it can be used for a lot more. 64 64 00:02:13,830 --> 00:02:15,330 Now, when we look at a CAN bus, 65 65 00:02:15,330 --> 00:02:17,416 this operates a lot like ethernet does. 66 66 00:02:17,416 --> 00:02:19,770 If you think back to the way I talked about ethernet 67 67 00:02:19,770 --> 00:02:21,510 all the way back in Network+, 68 68 00:02:21,510 --> 00:02:23,158 we talked about the fact that ethernet was developed 69 69 00:02:23,158 --> 00:02:25,620 with the idea that everybody on there was trusted 70 70 00:02:25,620 --> 00:02:27,600 and so we didn't have to have a lot of security. 71 71 00:02:27,600 --> 00:02:29,490 And CANs are built the same way. 72 72 00:02:29,490 --> 00:02:30,960 Again, they're a contentious network, 73 73 00:02:30,960 --> 00:02:32,602 where people are going to take turns talking, 74 74 00:02:32,602 --> 00:02:34,200 and if not, there's going to be collisions 75 75 00:02:34,200 --> 00:02:35,550 and they're going to have to repeat. 76 76 00:02:35,550 --> 00:02:37,110 This is all very similar to ethernet, 77 77 00:02:37,110 --> 00:02:38,250 the way it works. 78 78 00:02:38,250 --> 00:02:39,876 Now, this is because the manufacturers, 79 79 00:02:39,876 --> 00:02:40,940 essentially, never thought 80 80 00:02:40,940 --> 00:02:43,350 that we were going to use these systems in cars 81 81 00:02:43,350 --> 00:02:45,210 to the fact the way we do 'em now. 82 82 00:02:45,210 --> 00:02:47,130 These CANs were developed in the 80s and 90s. 83 83 00:02:47,130 --> 00:02:48,654 Did anyone think about self-driving cars 84 84 00:02:48,654 --> 00:02:50,400 back in the 80s and 90s? 85 85 00:02:50,400 --> 00:02:51,480 Probably not. 86 86 00:02:51,480 --> 00:02:53,280 And the things that we can do with cars these days 87 87 00:02:53,280 --> 00:02:56,640 is amazing compared to what we could do just 30 years ago. 88 88 00:02:56,640 --> 00:02:57,720 And so this is the idea 89 89 00:02:57,720 --> 00:03:00,450 of what we're doing with these cars in this CAN network. 90 90 00:03:00,450 --> 00:03:02,111 Now, if the CAN is completely isolated, 91 91 00:03:02,111 --> 00:03:04,020 it's probably pretty secure, 92 92 00:03:04,020 --> 00:03:06,480 but the problem is in a lot of modern vehicles, 93 93 00:03:06,480 --> 00:03:08,310 we've actually started bringing other networks 94 94 00:03:08,310 --> 00:03:09,540 into these cars. 95 95 00:03:09,540 --> 00:03:11,550 Some cars have cellular built in, 96 96 00:03:11,550 --> 00:03:13,650 some cars have Wi-Fi built in, 97 97 00:03:13,650 --> 00:03:16,274 and this is now bringing in the WAN into our cars 98 98 00:03:16,274 --> 00:03:18,090 and bringing the outside world in, 99 99 00:03:18,090 --> 00:03:19,890 which could also bring in vulnerabilities. 100 100 00:03:19,890 --> 00:03:22,650 So, essentially, our cars have now become part 101 101 00:03:22,650 --> 00:03:24,360 of the Internet of Things. 102 102 00:03:24,360 --> 00:03:26,970 Now, there is no concept of source addressing 103 103 00:03:26,970 --> 00:03:29,580 or message authentication within the CAN bus, 104 104 00:03:29,580 --> 00:03:31,800 and this goes back to the idea of security. 105 105 00:03:31,800 --> 00:03:34,177 So if there's no way to authenticate a message, 106 106 00:03:34,177 --> 00:03:36,376 that means any message that goes on that CAN bus 107 107 00:03:36,376 --> 00:03:38,970 is immediately considered trusted by the computer. 108 108 00:03:38,970 --> 00:03:41,197 So if I can get a message into the CAN bus that says, 109 109 00:03:41,197 --> 00:03:42,985 "Make the car go 100 miles an hour." 110 110 00:03:42,985 --> 00:03:44,130 It's going to do it 111 111 00:03:44,130 --> 00:03:46,410 because it's going to trust that that message was real 112 112 00:03:46,410 --> 00:03:48,300 because it got to the CAN bus. 113 113 00:03:48,300 --> 00:03:50,910 That's the only way it knows that something is trusted. 114 114 00:03:50,910 --> 00:03:53,250 If the message got to the CAN bus, it must be trusted. 115 115 00:03:53,250 --> 00:03:54,480 That's how it was designed. 116 116 00:03:54,480 --> 00:03:57,330 And so that is a big flaw that we have in these systems. 117 117 00:03:57,330 --> 00:03:58,920 Let me give you a good example of this. 118 118 00:03:58,920 --> 00:04:00,720 Here's an article from a couple years ago, 119 119 00:04:00,720 --> 00:04:03,087 and it was written by Andy Greenberg, who's a journalist. 120 120 00:04:03,087 --> 00:04:04,770 He's a journalist for Wired Magazine. 121 121 00:04:04,770 --> 00:04:06,116 He reported on his driving experience 122 122 00:04:06,116 --> 00:04:07,422 while driving a Jeep 123 123 00:04:07,422 --> 00:04:11,520 going at about 70 miles an hour outside Downtown St. Louis, 124 124 00:04:11,520 --> 00:04:13,740 when hackers decided to start doing an exploit. 125 125 00:04:13,740 --> 00:04:15,590 Now, he was doing this as part of an experiment 126 126 00:04:15,590 --> 00:04:17,610 and the hackers were actually pen testers, 127 127 00:04:17,610 --> 00:04:19,987 but let me read to you what he said. 128 128 00:04:19,987 --> 00:04:21,630 "Though I hadn't touched the dashboard, 129 129 00:04:21,630 --> 00:04:24,030 the vents in the Jeep Cherokee started blasting cold air 130 130 00:04:24,030 --> 00:04:25,380 at the maximum setting, 131 131 00:04:25,380 --> 00:04:26,730 chilling the sweat on my back 132 132 00:04:26,730 --> 00:04:29,130 through the in-seat climate control system. 133 133 00:04:29,130 --> 00:04:31,710 Next, the radio switched to the local hip hop station 134 134 00:04:31,710 --> 00:04:34,920 and began blurring Skee-Lo at full volume. 135 135 00:04:34,920 --> 00:04:36,210 I spun the control knob left 136 136 00:04:36,210 --> 00:04:38,490 and hit the power button to no avail. 137 137 00:04:38,490 --> 00:04:40,410 Then, the windshield wipers turned on, 138 138 00:04:40,410 --> 00:04:42,510 and the wiper fluid blurred the glass." 139 139 00:04:42,510 --> 00:04:43,470 And he keeps going on 140 140 00:04:43,470 --> 00:04:46,230 with all the things the pen testers were able to do 141 141 00:04:46,230 --> 00:04:48,990 as he was driving this vehicle 70 miles an hour 142 142 00:04:48,990 --> 00:04:50,827 down the street, and they were able to hack into it 143 143 00:04:50,827 --> 00:04:52,770 and do all this stuff remotely. 144 144 00:04:52,770 --> 00:04:53,962 So if you're interested in seeing this article, 145 145 00:04:53,962 --> 00:04:55,830 if you just type in the name of this article, 146 146 00:04:55,830 --> 00:04:56,790 it'll come up in Google, 147 147 00:04:56,790 --> 00:04:59,010 you can watch the video and actually see it happening. 148 148 00:04:59,010 --> 00:04:59,848 It's pretty interesting, 149 149 00:04:59,848 --> 00:05:00,681 and it gives you a good idea 150 150 00:05:00,681 --> 00:05:01,950 of what we're talking about here 151 151 00:05:01,950 --> 00:05:04,290 with the vulnerabilities of a CAN system. 152 152 00:05:04,290 --> 00:05:07,770 So how can an attacker get into a vehicle and modify it? 153 153 00:05:07,770 --> 00:05:09,360 Well, they have to get to the CAN bus, 154 154 00:05:09,360 --> 00:05:10,740 and there's really three ways to do it. 155 155 00:05:10,740 --> 00:05:12,570 One is they can do it locally. 156 156 00:05:12,570 --> 00:05:15,870 They can attach an exploit locally to the OBD-II. 157 157 00:05:15,870 --> 00:05:16,703 Now, you might think, 158 158 00:05:16,703 --> 00:05:18,360 "Well, that means they have to be in the car with you." 159 159 00:05:18,360 --> 00:05:19,710 Well, not necessarily. 160 160 00:05:19,710 --> 00:05:22,350 You can create a plug that plugs into the OBD-II, 161 161 00:05:22,350 --> 00:05:25,170 and most OBD-IIs are underneath the dashboard 162 162 00:05:25,170 --> 00:05:26,850 where somebody doesn't see it visibly. 163 163 00:05:26,850 --> 00:05:28,640 So, let's say you went to a local restaurant, 164 164 00:05:28,640 --> 00:05:31,350 and you actually handed your car off to some valet. 165 165 00:05:31,350 --> 00:05:32,183 While you were in there, 166 166 00:05:32,183 --> 00:05:34,318 he could have plugged in something to the OBD-II, 167 167 00:05:34,318 --> 00:05:35,566 and now he has a connection 168 168 00:05:35,566 --> 00:05:37,470 that he can run an exploit from. 169 169 00:05:37,470 --> 00:05:38,557 So, again, this is vulnerabilities 170 170 00:05:38,557 --> 00:05:40,111 that we have to think about. 171 171 00:05:40,111 --> 00:05:41,071 Now, another thing they can do 172 172 00:05:41,071 --> 00:05:43,800 is they can actually exploit over the onboard cellular. 173 173 00:05:43,800 --> 00:05:46,080 If your car has a cell modem built into it, 174 174 00:05:46,080 --> 00:05:48,000 that means you have a connection to the outside world, 175 175 00:05:48,000 --> 00:05:50,160 which means they have a connection to you. 176 176 00:05:50,160 --> 00:05:52,440 Now, most cars have two networks. 177 177 00:05:52,440 --> 00:05:53,633 They have the entertainment network 178 178 00:05:53,633 --> 00:05:57,120 and the vehicular CAN network, and they are separated. 179 179 00:05:57,120 --> 00:05:59,190 For instance, I have a Tesla that I drive. 180 180 00:05:59,190 --> 00:06:00,647 It has a cell modem built in. 181 181 00:06:00,647 --> 00:06:02,730 That runs through the entertainment system 182 182 00:06:02,730 --> 00:06:03,953 so I can listen to the radio, 183 183 00:06:03,953 --> 00:06:06,763 I can listen to songs over Pandora and Spotify, 184 184 00:06:06,763 --> 00:06:08,520 and things like that. 185 185 00:06:08,520 --> 00:06:09,960 That is one system. 186 186 00:06:09,960 --> 00:06:10,793 And then there's the system 187 187 00:06:10,793 --> 00:06:12,630 that controls the driving of the car. 188 188 00:06:12,630 --> 00:06:14,250 They've built that as two separate systems 189 189 00:06:14,250 --> 00:06:15,600 because of this vulnerability. 190 190 00:06:15,600 --> 00:06:17,070 But if you have a manufacturer 191 191 00:06:17,070 --> 00:06:19,110 who doesn't have a clear separation of the two, 192 192 00:06:19,110 --> 00:06:20,550 that could be an issue. 193 193 00:06:20,550 --> 00:06:21,383 And then the third, 194 194 00:06:21,383 --> 00:06:23,970 you can have an exploit over the onboard Wi-Fi. 195 195 00:06:23,970 --> 00:06:26,085 Again, a lot of cars have onboard Wi-Fi 196 196 00:06:26,085 --> 00:06:27,077 as a feature that was added 197 197 00:06:27,077 --> 00:06:29,190 within the last five to 10 years. 198 198 00:06:29,190 --> 00:06:30,540 And so if I'm driving close to you 199 199 00:06:30,540 --> 00:06:31,791 and I can reach your Wi-Fi, 200 200 00:06:31,791 --> 00:06:34,620 and there's a link between that Wi-Fi and the CAN, 201 201 00:06:34,620 --> 00:06:37,590 I can then get message into your CAN and cause issues. 202 202 00:06:37,590 --> 00:06:39,390 So, again, this isn't a big area 203 203 00:06:39,390 --> 00:06:42,360 that we as cybersecurity analysts are really going to work in, 204 204 00:06:42,360 --> 00:06:44,970 except to know that this vulnerability exists. 205 205 00:06:44,970 --> 00:06:45,803 For the exam, 206 206 00:06:45,803 --> 00:06:47,790 if you can remember these three vulnerabilities, 207 207 00:06:47,790 --> 00:06:50,290 you'll do fine when it comes to vehicle questions.