Look At What My Car Can Do
CC Attribution 3.0 Unported:
You are free to use, adapt and copy, distribute and transmit the work or content in adapted or unchanged form for any legal purpose as long as the work is attributed to the author in the manner specified by the author or licensor.
Cohen, Tyler
This presentation is an introduction to the new world of automobile communication, data and entertainment systems, highlighting the Ford Sync System. The Ford Sync System is a remarkable technological advance that has changed the automobile industry. While hard drives have been used in automobile entertainment applications for some time now, the Ford Sync System is different. It allows the user to interact with the car's communication system in a brand new way. If a vehicle with the Ford Sync system is used to commit a crime or to hide data, how would examiners be able to determine what data might be contained in the Ford Sync System? How does it get there? What forensic process or type of exploitation can be used to determine what traces are left behind on the car's hard drive? This presentation will take the audience through the process of various methods of infilling, hiding, acquiring data, and conducting a forensic exam on the Ford Sync System. Tyler Cohen is known in the digital forensic community for her work with forensics on alternate media devices and has given presentations at conferences all over the country on the topic, including the Defense Cybercrime Conference, High Tech Crime Investigation Association, Defcon, TechnoSecuity, Technoforensics, and the California District Attorney Association. She has co-authored a book entitled Alternate Data Storage Forensics (ISBN - 13: 978-1-59749-163-1) and was featured in Best Damn Cybercrime and Digital Forensics Book Period (ISBN-13: 978-1-59749-228-7). She currently works for the Department of Defense. Prior to that she worked for General Dynamics, assigned to the Department of Defense Cyber Crime Center (DC3) where she was a lead digital forensic examiner. Here she used her expertise in intrusion analysis and major crimes to successfully complete digital forensic exams. Before joining DC3, she was employed at ISS/IBM as an emergency incident responder and forensic examiner where she also showcased her expertise in intrusion analysis, major crimes and PCI standards. Prior to that, she worked for NASA as a Computer Forensic Examiner under the computer crimes division for the Inspector General.
 So what we're gonna do since you guys were so cool, we're gonna kind of turn this into a drinking game. So Digi has brought some booze with him. We're gonna kind of pass some of it out as much as we can. Every time I say the word um, you have to drink. And I say um a lot. Do you want to just like pass them around? But you can just, alcohol kills all the germs. So whoever has it, you just keep passing whoever has it. When I say um, you have to drink. This is your official invitation to Toast Musters. Oh. Thanks. Actually I'll get with you later because I am interested in that. So my name is Tyler Cohen. This presentation is Look What My Car Can Do. I want to give a special thanks to Ben Joel, Mark, Rob, Peter, Zach, Matt, Kate, Maddie, and Charles. Some of these people know that they help me. Some of these people do not. So you'd be kind of surprised at how many people I asked if I could rip apart their cars and they said no. Like it's for science, come on. So we had to come up with creative ways to get access to these cars. This car that I'm standing in front of is a Ford Fusion 2011. And in one of the photographs, there's a little hint from where that car came from. If any of you guys can see the hint, pick up on it and say where that car came from, Zach over here will buy you a beer. So just call it out when you see it. But it's in one of the photos. Alright, so this is a disclaimer. Yes, I work for the Department of Defense. This presentation reflects my own views and not any of those of my employer. Anything that I show in here or talk about potential things that you can do, I take no responsibility if you happen to avoid your warranties. I also unfortunately had to tailor my presentation at the last minute. I didn't want to get fired or sued by Ford. So there are things that I'm not going to be able to say, but I can hint to them. So I'm going to give you an overview, just a quick introduction. We're going to talk about the technology, avenues of exploitation, resources, and then the future. So also I am a, I've had about 10 years of experience doing digital forensics. I've worked for the Department of Defense Cyber Crime Center, IBM, NASA. Everyone's like, what, you did forensics for NASA? What were you like, going after people from Uranus or something? Ah! Sorry, I think that was funny. It never gets old either. So that's what this presentation is going to be geared toward. It's going to be geared toward a forensic analyst and what they can get from these cars. But also as a user, you have to understand that there's information that you're putting out there on these cars that is giving away stuff about you. So cars are not just for transportation anymore. They are now becoming entertainment centers, communication hubs. These vehicle systems now store and stream digital content, and they're used as communication mediums. So it's not like the old days where your car was just your car. This is now, you know, in today's world, people want to be connected to their social networks. They want to be able to find everything. They want access at their fingertips. And they should. I do too. So manufacturers are coming up with really innovative ways to market and sell vehicles. Emphasis has been on technology, integration, and safety. And Ford has been leading the way since 2007 with the inclusion of the Microsoft Sync system in its vehicles. So I kind of look at Ford as what Apple did, how Apple reinvented the digital music players. Ford is paving the way for cars. So their systems are much more advanced than any of the other systems. So what are the designers thinking when they're designing these cars? Obviously they're concerned about safety. But aside from safety, Ford is really, really, really concerned with digital rights management. Now, since they're using the Microsoft OS, we know that it's Microsoft DRM technology. Now, I bet you there's some of you in the audience who are experts at DRM vulnerabilities and cracking, and know a bunch of research that applies to that. But basically what I'm saying is that the Microsoft DRM is vulnerable in ways, in any way that Microsoft DRM would be vulnerable, it's vulnerable in this capacity too, because it's using the same technology. Designers are also thinking about connectivity, user-to-user, and car-to-car ease of use. You just want your stuff to work and reliability. So what do I mean by connectivity? Cars are really concerned with users connecting to their user stuff. Your gadgets and their functions are being integrated into your driving experience. So I want my content and I want it now. I want all my music that's stored in the cloud, and I want to be able to access it wherever I am. I want to be able to connect my phone and have it stream all of my information. I want to be able to use voice-dialing. I want it all just there. I want it to be easy. And then you also want to be connected to your user environment. You want to have your social applications available to you, and you want your car to do it. My car, why shouldn't it give me the cheapest price of gas? Why shouldn't it tell me happy hour specials? My brother Zach over here, he likes using social applications to look for hot chicks and dudes. He puts it up, the augmented reality, and he can see how far away a hot chick is from him, and he can chat with her, he can say, yeah, I'm going to check in, and I'm going to check in with you, and let's meet up. Why can't your car do that for you? Ease of use, your stuff should just work. I mean, most of us are pretty lazy. We just want our stuff to work. We buy it, we spend a lot of money. There shouldn't be any issues. The car companies are moving toward driving, not interfering with your social life, and things just working. That means more automation, more integration, and more inner operability. That's a tough word. Exactly. So what does that mean for us? Well, the more automation, that means the more vulnerabilities and more vectors of attack. So these are things that I want us to just kind of be keeping in our minds. Reliability, again, things should just work. There have been some complaints with the Ford systems that I've been reading on the forums, and then from people who actually have these cars. There's complaints that the car entertainment system reboots while driving, which is kind of a problem. It's a mic yourself, for what I've been trying to say. Actually, not all of it, as you're going to see in a second. Not all of it is. Changing songs shouldn't take 15 seconds, and stored data should be accurate. I know that you guys are all familiar with that story. I don't know if it's a true story or not, but woman was using her GPS data, and it essentially told her to drive off a cliff, so she did, and she died. I don't know if that's true or not, but basically you want your data to be accurate, so stuff like that doesn't happen. Alright, so what are users thinking? They're thinking we want safety, again, ease of use, and connectivity. Something that they should be thinking about is confidentiality of their data. There's a lot of data that I'm going to show you is actually stored on these devices. They need to be thinking of a friend could come into their car and get their data if they have devices set up for that. These devices have remote access now, they have wireless on them, there's Bluetooth, or a forensic analyst could come and take and get your data. So they really need to be cognizant of what's being put on there. So, you know, if there's photographs or things on there that you don't want to be found, just don't put them on there. I mean, simple as that. What are hackers thinking? Well, what do hackers do? They make something do what it's not meant to do. So some things that have actually happened, some things that are going to be happening probably in the future, controlling the car remotely. So using the wireless, the communication system is connected, and that's been proven, I believe, at this conference, and then there was a study, a school study, where they've dealt with attire pressure. It's been proven that these communication systems are connected to the car's onboard computer. So it is very possible to get a piece of malware, get it in through the communication system on the car, and then control the car. You can stop it, start it, really whatever you want to do. So hackers, good hackers, black, white hackers, they're both thinking about protecting or stealing personal data. So again, there's a lot of data that you have on this device. You really have to think of these devices like a computer. Anything you wouldn't want to put on your computer, you don't want to put on your car. Side channel comms. These cars can be used as communication devices when speaking to other cars. And I'm going to show you at the end of this presentation, the IntelliDrive, which is coming out in about five years. And cars are broadcasting, Wi-Fi coordinates, and essentially you can use this for communication. You can use the Bluetooth for communication. You can use the wireless for communication. And you can do these in such a way that your traffic is not necessarily going to be intercepted. And I'll let you guys kind of ponder that one. Use these cars as peer-to-peer devices. Share your music, share your content. Surveillance. I can get something in the car so that I can monitor the car. I can see where it's been. There's... So that's surveillance, or again, just using it like Zach's going to do to just find hot chicks. It can also be used these vehicles for propagating viruses and malware. So my vehicle, get it vehicle for propagation because it's a vehicle. So you can use this car, and this car can actually be a virus that is infecting other cars as I drive past it. These are just potential things for the future, but not that far off in the future. And then forensics, which is where I kind of come into this, and that's where the rest of this presentation is going to kind of go. If anyone has any questions, please just jump in. So what is stored? What are stored on these devices? Now, these systems can store navigation data where you've been, where you're going. It can save track data, save locations, previous destinations, which is a good thing too. Because you kind of have to find that mix between privacy and then usability. I personally like it saving my data because then that way I don't have to type it in, because I never remember addresses and it's just already there. Phone-related information, when you pair your phone up, it's going to save the Bluetooth Mac ID, pretty much most of the information on the phone. Your contacts, call logs, SMS messages, call history, save numbers, that's going to be maintained. So if you rent a car from like enterprise Hertz or whatever and you pair up your phone, just make sure you delete the profile. It's not going to be completely gone, but at least it'll make it a lot harder for someone to get your data. Music files, image files, the Ford Sync Generation 1, you can put 32 photos on the car. User voice profiles, information about the car, potentially this is a kind of now, kind of in the future. Stats on how am I driving, do I speed, all that kind of good stuff. Previously connected USB devices, wireless access points where you've been with the wireless, and then in the future like I said the driving habits. And if anyone can think of more that I missed out, just let me know after, because there's a ton of data that's contained in those cars. Okay, so as a forensic examiner, why would I care about photos or songs? Well, these photos, oh sorry, by the way Zach, I rated your music collection, you don't mind that I barge your AESA base, do you? Alright, so you think that that's just a MP3 file of AESA base? It's not. It's a stag with Zach's ways to pick up hot chicks. Just a regular photograph, by the way, is that the cutest dog you've ever seen in the world? Yeah, he is. Like his little mohawk, maybe. So that's a stag photo as well. Or child porn images, malware, really anything that you want to hide in there, because if you upload any one of these files, whether it's stagged or you've manipulated it, as long as the head or foot are going to match, the car's going to accept it in. So you can use it as storage. Alright, so these are two pictures of vehicles. They're embedded fully integrated systems with the vehicles. There's two different styles that I'm showing you right now in the first generation. The first is a Ford Fusion 2011 without the navigation system. So you can see it's just kind of got the little teeny faceplate on the radio. And then you've got the full navigation system. Now, the navigation system gives you the ability to store data. Without the navigation system, the only way you have the ability to store data is on the Flash Ron chip in the Sync module, which I'm going to get to a little bit later. But that's kind of what they look like. That's, I think, a Ford Edge 2011. Excuse me? Yes. Oh, no, no, no, no, no. It's much more subtle and it's later in the presentation. But you know this free beer means you have to sit and talk with Zach for a while, but maybe he'll go over his rules of finding hot chicks. So the first generation, Ford started doing this in 2007 and the first generation is to 2011-ish, maybe 2012-ish, because some cars still have this. Some cars are moving on to the second generation. Now, there are two separate components. Yes. This brings the question, is there a movement for the future to put the SD cards in the machines and have all the forces be able to come up, pop out your car, pop it in and it will read your second. Here's your $2,000 ticket. That's, there is that potential, but that's coming up in the end of the presentation. That's Gen 2. So this is still the Gen 1. So it has separate components on the head unit. So you have a, well, I'll get deeper into that. It's got storage. It's got a hard drive in it. The second generation, some of the 2011's already have it, but it's really going to be the 2012's and 13's and up. It's a single integrated unit. So the sync module and the NAV system are all going to be in one. And the storage, some of them will still have hard drives, but they're moving away from hard drives as storage. They're going to have a SD card that has a software lock on it and external USB storage and streaming for your data. So they're moving away from them having the integrated mass storage. Both of these generations are updatable through USB, which is going to be important later. All right, so the first generation, which is what you probably see on the road right now. The sync module, the operating system is Microsoft Automotive and it's a Windows CE based operating system. Data is stored in this module, this chip, which I'm going to show you a picture of later. You can get all the phone-related information, music indexes, user voice profiles. And then there's a couple of other little stuff that's going to be in there too that could be relevant or might not be relevant too, but it's stored in this NAN flash chip. The head unit, which is the nav system, it's got the operating system, it's Clarion VX Works. And the way that we first found out that there were two different operating systems on the nav and on the sync module, we took the sync module out of the car and the navigation system still worked. And we're like, huh, so that was a hint for us that there were two different operating systems. It's got a 40 gigabyte Peta hard drive with a TPM style protection on it. Data stored, you can get music files, photos, navigation data. So this is the inside of the sync module. You can see where the little arrow is pointing. That's the Samsung NAN flash. Now, when you open these up, it doesn't mean that in every car you're going to have a Samsung NAN flash. It could be a different manufacturer. It just kind of depends on where that car was built. But it's going to be in roughly the same place and it's going to work the same way. So again, this is going to contain the Microsoft operating system, previously paired Bluetooth information, contacts, call logs, SMS messages, phone history, save numbers. So it is of relevance if you're a forensic examiner. If you're trying to hide the data, it's also of relevance because you don't want it to be accessed. So you want to again delete the profile or wipe it or whatever. Now, I don't know how many of you guys have done a lot of work with doing forensics on NAN flash, but it's not fun. So what you have to do is there's a few ways you can do it. As you saw, there's a spare USB port on this device that you could try to acquire the NAN flash from. We actually didn't do that, so I don't know. There's also the JTAG ports right over here, kind of at the bottom. You can see them. We also didn't do that. What we did was we, not what we did, because we didn't do anything necessarily remember, hint, hint. But what could be done is you could take the chip, you could remove it, put it in this flash pack device, stick it in one of the sockets that it fits, and what's going to happen is it's going to spit out a binary file. And for those of you who have done any forensics on the NAN flash, it's kind of a pain. Because the way that it works is you have the ware leveling, which is going to be different for each chip manufacturer, but you can still figure it out. So for this one, you have every sector on the flash can be written over only 10,000 times. So what's going to happen is you're not going to have consecutive sectors. And there's going to be, I've always forgotten, if it's a 4K chunk or if it's a 16K chunk, that has a numbering sequence. So it's numbered a chunk right in front of each sector that tells you where that sector goes. So what you have to do is you have to get this binary file out of this thing, and you have to manually remove those chunks that tell you the number of where each chunk is, reorder them, and then you can pop it into any forensic tool. It'll just be a regular raw DD image file. So that's how you have to do it. Maybe it sounds complicated to you, maybe for some of you it doesn't, but it's really not that difficult. It sounds a lot worse than it is, so it is doable. So removing the sync module, I had a lot of other pictures. I mean, we just tore these cars apart. And this one actually I got permission, my good friend Ben, who I wish he was here, when I asked him if I could tear apart his car, he not only said, yeah, of course, he said I'll help you. So he did. And this is a Ford Edge 2010. The Ford sync module is located behind the center console. Really easy to get to. It's just held in place with clips, and then there's four screws, and you just remove it. And then you take the faceplate off, and then you have access to what I saw. Oh, one thing quickly, with this, when you pop out the chip to do the analysis on it, you're probably not going to get it back in. Just saying, you will board the warranty, and unless you're a pro with a soldering iron, you're not getting it back in. Sorry, Ben. So this is the head unit. This is the front of it. It's got, again, the 40 gig, paid-a-hard drive. This would happen to be a Hitachi Endura Star. That doesn't necessarily mean that you'll have a Hitachi if you were to get one out or if you were to buy the car. I think they just kind of use whatever they have in batches. This is going to contain, because it's generation one, navigation data, track data, breadcrumbs, saved locations, previous destinations, and all your music files, which as we know could be stagged files. So acquiring the head unit. So I'm going to go over a couple of techniques that will probably work. Hint, hint, hint. Drake. Just kidding. All right. So this is, we remove the head unit. That's kind of what it looked like. There's also a picture that Ben wouldn't let me use of Ben, like standing there, like with almost a heart attack on his face that I ripped his car apart. And that's the back. You can kind of see on the second one where the hard drive was. You just pull it out. It's really easy to get the hard drive. Although I got to tell you, when you take the car apart, it's a lot easier to take apart again than it is to put back together. So any of you who are forensic analysts, you see this, you see that the drive is connected to a right blocker and I've got it into some forensic tool. Yeah, that's not going to work. Now, why is that not going to work? Because Ford is really concerned with digital rights management and protecting music being imported to the hard drive. So they've implemented this TPM lock style protection where the hard drive is essentially looking for a serial number on a module in the head unit, so in the chassis. So without that, it's locked and it's really difficult to get around that. But it is doable. So, for example, if the hard drive gets corrupt or breaks, Ford's just going to replace the entire chassis. They're not going to get stuff off your hard drive. They're not going to fix it for you. They're just going to give you a whole new head unit with a new drive. So you can't take this hard drive and put it in another unit and have it work. It just won't, well, without some manipulation. So ways to get around this. Clarion maintains a master password that will help you unlock this device. If you can get to Clarion and you're nice to them and not necessarily lie, but tell them what you're interested in doing, they might give you that master password. Just saying. But if you're not nice, what you've got to do is you've got to find a way to get around the TPM style lock. And how do you do that the easiest way? You just keep the car running. You keep power to the vehicle and then it's not going to be an issue. So there's a hardware component that is in creation that what it does is it connects the head unit, the hard drive, and the laptop. So you can actually image this device. You can see in that map, it's a middleware component that keeps power to the car. So the car is still going. So you can just image it like you would normally image a drive. And that's probably the easiest way to do it. Now, my favorite way to do this, and you might want to look at these pictures because they're interesting. Hint, hint. Maybe. Why do you say that? Yeah. Where's it from? Enterprise. You have no idea how hard it is to go to Enterprise and actually request a specific car. They don't do it. I mean, it took a lot of social engineering to just be nice and friendly and say, you know, I really am trying to buy this car, but I want to test it first, you know. And the woman was so nice. She kept the car for me, hid the key in the fridge so no one else would get that car. It was nice. I appreciated that. I actually thanked her in the beginning. So this is a way that actually is probably going, might be your easiest bet. This is exploiting the update process. So you go to the Ford website, you update the latest file, and you put it on your USB stick, and then you stick it in the car, and you go through this update process that you can see that we're doing right here. And it's a cab file. Now, if you were to able, if you were able to get some code into this cab file and still make it readable as a cab file, you would be able to put software on the device that would allow you to exfil a drive through Bluetooth or through the wireless. So I don't want to call it malware because it's not necessarily malware because the purpose of it is different. It's malware, whatever. Whatever, you know what? Sorry, DoD, it's malware. You can exploit this update process, customize this cab file, put your malware on there that will then allow you to exploit the Bluetooth and use it to image your file. And that way you're getting around the TPM log. Now this way is kind of cool too. There's a guy in Florida, kind of a bit of a hermit, ecoastal.com, and what he's done is he's created some hardware that you put on the back. He puts the system into a canned diagnostic mode and what he does is he flashes the radio with predefined options. So again, you could use this method, you could flash the radio with these predefined options and some of those options you put on are again malware that allow you to access the car. And I'm saying this because this is what a forensic analyst would do, but keep in mind that these are also things that someone with not so good intentions could do as well. So they could put stuff so they could constantly get access to your car. Would it be possible to flash the radio files on the hard drive itself to remove the check consider number? I don't know, we haven't tried that. It could be something worth trying. So the second generation is going to be a little bit different. It's going to be a single integrated component. So the Microsoft sync chip is going to be in the head unit. And they're getting away from the Clarion VX works and the operating system for the nav unit and for the chip is going to be Microsoft Office and again, Windows CE based. So again, exploits that we're going to work against Windows CE might work against this as well. They're moving away from having a hard drive. They're moving toward having all of their storage be an external USB drive or an SD card. And the SD card has software lock protection on it. I haven't been able to get one yet, but I'm going to get one and play around with that. How come no one's drinking? I just said, oh, come on. So they have a full suite of wireless products. You can turn your car into a wireless hotspot. You can connect to any wireless network that you want. Again, that information is going to be stored in the chip. So that's information that you can get access to as well. Yeah, drink. How come no one's drinking? Someone drink. I saw you drink, all right. All right, so this is the second generation 2012 Ford Explorer with the second generation system. And I thought that I was being a master social engineer here. I thought I was being so smart. So we dress up. We go to the Ford dealer and I started asking him all kinds of questions, pretending like I'm going to buy the car, and ask if I can take pictures of stuff so that I could show you guys what's going to be there. And I should have known that the true social engineer masters are car salesmen, because if my husband hadn't been there with me, I would have walked out with that car and an $800 car payment because my car is still in release. Yeah, I hate they're like, what can I do to get you in this car today? And I've got stars. I'm like, anything. Yeah, that was, but that car is really nice, really nice. So again, this includes the SD card in the center console. You can see it. This is the Ford Explorer 2012. Or is this the F-150 Explorer? It's got two USB ports. Oh, that's important to note too. The USB ports are not connected to the head unit, the hard drive. So you can stream stuff from it, but you can't use them as points of doing a forensic acquisition. And this is important to note too. The only way that you can get information onto the hard drive, the photos, currently is through the CD, but then again, using some of these methods that I spoke about are ways of cracking that so that you can get your music on there through Bluetooth, through wireless, if you put that piece of malware on there using those other methods. It is. Yeah, it is. Can you say that loud? It is. Ford has attempted to firewall it off. But, and I'm saying Ford is really leading this. They've really thought of a lot of things, but GM hasn't, Dodge hasn't. And as pretty much everyone in this audience knows, you can find ways to get around a firewall. But at least they're making an effort. So you can see on this SD card case, this contains the maps. It says on there, this card is right protected. It can't be used in any other system. So that just kind of shows you also it's software protected. But then I had my boy, like, there is no information about this stuff on the Internet. There just really isn't. So we had to do a lot of work. And Ford, Ford dealers know nothing about this because they ship out the systems to Claryon or to some other radio manufacturer. And they just bring it back. No one fixes them. They just go away through Ford dealer to a radio manufacturer to Claryon and to Ford, finally, Ford engineer. So there wasn't a lot of information out there. So anyway, so this is the plastic case that comes with it. It's your maps. I think you can see that when the card is not in, the navigation system will just not work. So you have no access to your nav data. And since this is an all-in-one component, you need that SD card in there. So I think one of these is SD card fault. You need to insert it. And then the other one says it's now enabled so it can work. This is kind of an OK picture. I mean, the guy was, like, standing over me, like telling me all the options on the car. So I'm, like, sitting here drooling while Matt's, like, trying to lean over me to, like, take photos. So this is just showing you what it looks like, the second generation. The wireless and internet is what I was most interested in. So you see you've got your Wi-Fi settings, USB mobile broadband, Bluetooth, and then the prioritized connection methods. So you have a lot of options here. Oh, it even has a nice little map that kind of shows you what you can do, too. And then here, this is just to show you the wireless options. You can go to Starbucks and get on their network. And I don't know. I mean, I guess this really means you could really, really do war driving because you're in your car. Hey, I think I'm funny. So, again, I haven't done a ton with the wireless, but I will tell you that most of the wireless hacks that you've seen at this conference that you know about, that you've researched about, they're going to work here. So, again, what my concern is is I saw this CSI episode, which is the way they did it wasn't accurate, but what they said kind of was that they had a hacker who wirelessly got into a car and he was able to make the car drive to some location that a guy ended up getting murdered at, or something crazy like that. But there are ways to get in wirelessly to the car and eventually control the car, as these young gentlemen will probably be talking about later today at three. So just kind of be thinking about that. So what's the future? So future integration, one thing that I'm kind of interested and I'm sure is going to happen is what I had mentioned before, using your car itself as a virus, whether you send the virus out over wireless Bluetooth or this new IntelliDrive that I'm going to show you or various other methods. I mean, it's kind of cool, but it's kind of scary, too. I mean, you could set up some kind of hotspot and have someone drive by and their car just shuts down. And using the car as a communication channel, say I had something that I had to talk to Matt about and I didn't want for Zane to be able to read it. So I used my car and his car and we communicate on a protocol that Zane might not be looking for. And obviously that's not something you'd really use it for. You broaden your mind, like think about it in covert channels, ways that you need to hide your data. So I'm going to show you this video because it's damn cool. And this is showing you the future of this IntelliDrive. And while you're watching it, think about the possibilities and the potentials for this technology, using it as a communication device, surveillance, sending out viruses, or just saving lives, which is what it was meant to do. Back now at 745 with remarkable new technology designed to keep you safer behind the wheel. CMDC's Phil LeBeau is at RFK Stadium in Washington, DC with an exclusive first look at something that could prevent thousands of potentially deadly collisions. Good morning to you, Phil. Good morning, Meredith. Imagine your car could talk to any other car truck on the road and warn you if you were about to crash into each other. It's called IntelliDrive and it may sound like something out of the Jetsons, but it's closer than you think to becoming reality. It happens every six seconds in the U.S. Car crashes, head-on side impact, or rear-end collisions. More than 5 million in 2009, killing almost 34,000 and injuring 2 million more. A group of major automakers, including Ford, GM, and Toyota, are developing a technology called IntelliDrive that will allow cars to communicate with each other and warn drivers when they're about to crash. We feel that the IntelliDrive program fully implemented can save up to 80% of traffic accidents for non-impaired drivers. Here's how it works. Using GPS transmitters and Wi-Fi, cars constantly send out signals with their location and speed. So a driver about to be broad-sided at an intersection would be warned to hit the brakes and avoid a collision. We wanted to be like a vigilante copilot that they have with them all the time. We tested the technology with engineers from Ford, first at a blind intersection. Looks like it's safe for me to go, so at this point I'm going to accelerate. Whoa! Not a good idea. And attempting to change lanes. With this system, it warns you if you're going to lane change into another car. So here's an example. Right there, the system warns me that in the lane right next to me, there was a car that I would have hit. With technology that helps prevent rollovers and drifting across lanes, cars are already doing some of the thinking for you. And Google is testing a car that does the driving for you. It's possible that someday cars will drive themselves like the space vehicles on the Jetsons. Hey! Looks like I'm opening up ahead! Until that day, Intellidrive will make a big impact on safety. I think this has huge potential, a huge potential to reduce crashes on our freeways. And save lives. And save lives, which is really the ultimate goal. So when might we see Intellidrive in all new cars and trucks? Well, maybe five or six years down the road. It'll take the federal government some time to make the rules and mandate everything for the automakers. But make no mistake, Meredith, talking cars are coming and it could save thousands of lives. Yeah, I love the idea. Phil Levo, thank you so much. Alright, thank you, Meredith. So you can see where that's going and I hope that your gears are turning. We're probably going to be presenting this at the DoD Cyber Crime Conference. Maybe I might submit for Shmucon, I don't know. But I think at those conferences we'll be able to release the tool that we were talking about through the update file that will actually enable you to get the Bluetooth back and hopefully demo it. If there's enough room to bring one of the cars in, I might try to do that too. Does anyone have any questions? Yeah, see this, will you say that louder? Oh, he wanted to know if you could go get one of the pineapples and use it against cars? The answer is yes. And any other questions? The operating system is on top of the chip. So there's firmware that's the chip manufacturer that's going to be in there, and there's also the Microsoft that does have the firmware on there. Yes? Yeah, not in the exact way, but yes, every car is affected. Hey, before you guys leave, wait, stop. Which one of you guys was the one who picked out that that was an enterprise car and gets to have Zach buy you a drink? Who was that? It was you? Oh, come on up to the front then. My time? Three minutes. Three minutes? All right, any other questions? All right, thank you.
 So what we're gonna do since you guys were so cool, we're gonna kind of turn this into a drinking game.  So Digi has brought some booze with him.  We're gonna kind of pass some of it out as much as we can.  Every time I say the word um, you have to drink.  And I say um a lot.  Do you want to just like pass them around?  But you can just, alcohol kills all the germs.  So whoever has it, you just keep passing whoever has it.  When I say um, you have to drink.  This is your official invitation to Toast Musters.  Oh.  Thanks.  Actually I'll get with you later because I am interested in that.  So my name is Tyler Cohen.  This presentation is Look What My Car Can Do.  I want to give a special thanks to Ben Joel, Mark, Rob, Peter, Zach, Matt, Kate, Maddie, and Charles.  Some of these people know that they help me.  Some of these people do not.  So you'd be kind of surprised at how many people I asked if I could rip apart their cars and they said no.  Like it's for science, come on.  So we had to come up with creative ways to get access to these cars.  This car that I'm standing in front of is a Ford Fusion 2011.  And in one of the photographs, there's a little hint from where that car came from.  If any of you guys can see the hint, pick up on it and say where that car came from, Zach over here will buy you a beer.  So just call it out when you see it.  But it's in one of the photos.  Alright, so this is a disclaimer.  Yes, I work for the Department of Defense.  This presentation reflects my own views and not any of those of my employer.  Anything that I show in here or talk about potential things that you can do, I take no responsibility if you happen to avoid your warranties.  I also unfortunately had to tailor my presentation at the last minute.  I didn't want to get fired or sued by Ford.  So there are things that I'm not going to be able to say, but I can hint to them.  So I'm going to give you an overview, just a quick introduction.  We're going to talk about the technology, avenues of exploitation, resources, and then the future.  So also I am a, I've had about 10 years of experience doing digital forensics.  I've worked for the Department of Defense Cyber Crime Center, IBM, NASA.  Everyone's like, what, you did forensics for NASA?  What were you like, going after people from Uranus or something?  Ah!  Sorry, I think that was funny.  It never gets old either.  So that's what this presentation is going to be geared toward.  It's going to be geared toward a forensic analyst and what they can get from these cars.  But also as a user, you have to understand that there's information that you're putting out there on these cars  that is giving away stuff about you.  So cars are not just for transportation anymore.  They are now becoming entertainment centers, communication hubs.  These vehicle systems now store and stream digital content, and they're used as communication mediums.  So it's not like the old days where your car was just your car.  This is now, you know, in today's world, people want to be connected to their social networks.  They want to be able to find everything.  They want access at their fingertips.  And they should. I do too.  So manufacturers are coming up with really innovative ways to market and sell vehicles.  Emphasis has been on technology, integration, and safety.  And Ford has been leading the way since 2007 with the inclusion of the Microsoft Sync system in its vehicles.  So I kind of look at Ford as what Apple did, how Apple reinvented the digital music players.  Ford is paving the way for cars.  So their systems are much more advanced than any of the other systems.  So what are the designers thinking when they're designing these cars?  Obviously they're concerned about safety.  But aside from safety, Ford is really, really, really concerned with digital rights management.  Now, since they're using the Microsoft OS, we know that it's Microsoft DRM technology.  Now, I bet you there's some of you in the audience who are experts at DRM vulnerabilities and cracking,  and know a bunch of research that applies to that.  But basically what I'm saying is that the Microsoft DRM is vulnerable in ways,  in any way that Microsoft DRM would be vulnerable, it's vulnerable in this capacity too,  because it's using the same technology.  Designers are also thinking about connectivity, user-to-user, and car-to-car ease of use.  You just want your stuff to work and reliability.  So what do I mean by connectivity?  Cars are really concerned with users connecting to their user stuff.  Your gadgets and their functions are being integrated into your driving experience.  So I want my content and I want it now.  I want all my music that's stored in the cloud, and I want to be able to access it wherever I am.  I want to be able to connect my phone and have it stream all of my information.  I want to be able to use voice-dialing.  I want it all just there.  I want it to be easy.  And then you also want to be connected to your user environment.  You want to have your social applications available to you, and you want your car to do it.  My car, why shouldn't it give me the cheapest price of gas?  Why shouldn't it tell me happy hour specials?  My brother Zach over here, he likes using social applications to look for hot chicks and dudes.  He puts it up, the augmented reality, and he can see how far away a hot chick is from him,  and he can chat with her, he can say, yeah, I'm going to check in, and I'm going to check in with you, and let's meet up.  Why can't your car do that for you?  Ease of use, your stuff should just work.  I mean, most of us are pretty lazy.  We just want our stuff to work.  We buy it, we spend a lot of money.  There shouldn't be any issues.  The car companies are moving toward driving, not interfering with your social life, and things just working.  That means more automation, more integration, and more inner operability.  That's a tough word.  Exactly.  So what does that mean for us?  Well, the more automation, that means the more vulnerabilities and more vectors of attack.  So these are things that I want us to just kind of be keeping in our minds.  Reliability, again, things should just work.  There have been some complaints with the Ford systems that I've been reading on the forums,  and then from people who actually have these cars.  There's complaints that the car entertainment system reboots while driving, which is kind of a problem.  It's a mic yourself, for what I've been trying to say.  Actually, not all of it, as you're going to see in a second. Not all of it is.  Changing songs shouldn't take 15 seconds, and stored data should be accurate.  I know that you guys are all familiar with that story.  I don't know if it's a true story or not, but woman was using her GPS data,  and it essentially told her to drive off a cliff, so she did, and she died.  I don't know if that's true or not, but basically you want your data to be accurate,  so stuff like that doesn't happen.  Alright, so what are users thinking?  They're thinking we want safety, again, ease of use, and connectivity.  Something that they should be thinking about is confidentiality of their data.  There's a lot of data that I'm going to show you is actually stored on these devices.  They need to be thinking of a friend could come into their car and get their data  if they have devices set up for that.  These devices have remote access now, they have wireless on them, there's Bluetooth,  or a forensic analyst could come and take and get your data.  So they really need to be cognizant of what's being put on there.  So, you know, if there's photographs or things on there that you don't want to be found,  just don't put them on there.  I mean, simple as that.  What are hackers thinking?  Well, what do hackers do?  They make something do what it's not meant to do.  So some things that have actually happened, some things that are going to be happening  probably in the future, controlling the car remotely.  So using the wireless, the communication system is connected, and that's been proven,  I believe, at this conference, and then there was a study, a school study,  where they've dealt with attire pressure.  It's been proven that these communication systems are connected to the car's onboard computer.  So it is very possible to get a piece of malware, get it in through the communication system on the car,  and then control the car.  You can stop it, start it, really whatever you want to do.  So hackers, good hackers, black, white hackers, they're both thinking about protecting or stealing personal data.  So again, there's a lot of data that you have on this device.  You really have to think of these devices like a computer.  Anything you wouldn't want to put on your computer, you don't want to put on your car.  Side channel comms.  These cars can be used as communication devices when speaking to other cars.  And I'm going to show you at the end of this presentation, the IntelliDrive,  which is coming out in about five years.  And cars are broadcasting, Wi-Fi coordinates, and essentially you can use this for communication.  You can use the Bluetooth for communication.  You can use the wireless for communication.  And you can do these in such a way that your traffic is not necessarily going to be intercepted.  And I'll let you guys kind of ponder that one.  Use these cars as peer-to-peer devices.  Share your music, share your content.  Surveillance.  I can get something in the car so that I can monitor the car.  I can see where it's been.  There's...  So that's surveillance, or again, just using it like Zach's going to do to just find hot chicks.  It can also be used these vehicles for propagating viruses and malware.  So my vehicle, get it vehicle for propagation because it's a vehicle.  So you can use this car, and this car can actually be a virus that is infecting other cars as I drive past it.  These are just potential things for the future, but not that far off in the future.  And then forensics, which is where I kind of come into this, and that's where the rest of this presentation is going to kind of go.  If anyone has any questions, please just jump in.  So what is stored? What are stored on these devices?  Now, these systems can store navigation data where you've been, where you're going.  It can save track data, save locations, previous destinations, which is a good thing too.  Because you kind of have to find that mix between privacy and then usability.  I personally like it saving my data because then that way I don't have to type it in, because I never remember addresses and it's just already there.  Phone-related information, when you pair your phone up, it's going to save the Bluetooth Mac ID, pretty much most of the information on the phone.  Your contacts, call logs, SMS messages, call history, save numbers, that's going to be maintained.  So if you rent a car from like enterprise Hertz or whatever and you pair up your phone, just make sure you delete the profile.  It's not going to be completely gone, but at least it'll make it a lot harder for someone to get your data.  Music files, image files, the Ford Sync Generation 1, you can put 32 photos on the car.  User voice profiles, information about the car, potentially this is a kind of now, kind of in the future.  Stats on how am I driving, do I speed, all that kind of good stuff.  Previously connected USB devices, wireless access points where you've been with the wireless, and then in the future like I said the driving habits.  And if anyone can think of more that I missed out, just let me know after, because there's a ton of data that's contained in those cars.  Okay, so as a forensic examiner, why would I care about photos or songs?  Well, these photos, oh sorry, by the way Zach, I rated your music collection, you don't mind that I barge your AESA base, do you?  Alright, so you think that that's just a MP3 file of AESA base? It's not.  It's a stag with Zach's ways to pick up hot chicks. Just a regular photograph, by the way, is that the cutest dog you've ever seen in the world?  Yeah, he is. Like his little mohawk, maybe. So that's a stag photo as well.  Or child porn images, malware, really anything that you want to hide in there, because if you upload any one of these files, whether it's stagged or you've manipulated it, as long as the head or foot are going to match, the car's going to accept it in.  So you can use it as storage.  Alright, so these are two pictures of vehicles. They're embedded fully integrated systems with the vehicles.  There's two different styles that I'm showing you right now in the first generation.  The first is a Ford Fusion 2011 without the navigation system.  So you can see it's just kind of got the little teeny faceplate on the radio.  And then you've got the full navigation system. Now, the navigation system gives you the ability to store data.  Without the navigation system, the only way you have the ability to store data is on the Flash Ron chip in the Sync module, which I'm going to get to a little bit later.  But that's kind of what they look like. That's, I think, a Ford Edge 2011.  Excuse me? Yes.  Oh, no, no, no, no, no. It's much more subtle and it's later in the presentation.  But you know this free beer means you have to sit and talk with Zach for a while, but maybe he'll go over his rules of finding hot chicks.  So the first generation, Ford started doing this in 2007 and the first generation is to 2011-ish, maybe 2012-ish, because some cars still have this.  Some cars are moving on to the second generation. Now, there are two separate components. Yes.  This brings the question, is there a movement for the future to put the SD cards in the machines and have all the forces be able to come up, pop out your car, pop it in and it will read your second. Here's your $2,000 ticket.  That's, there is that potential, but that's coming up in the end of the presentation. That's Gen 2. So this is still the Gen 1.  So it has separate components on the head unit. So you have a, well, I'll get deeper into that.  It's got storage. It's got a hard drive in it. The second generation, some of the 2011's already have it, but it's really going to be the 2012's and 13's and up.  It's a single integrated unit. So the sync module and the NAV system are all going to be in one. And the storage, some of them will still have hard drives, but they're moving away from hard drives as storage.  They're going to have a SD card that has a software lock on it and external USB storage and streaming for your data. So they're moving away from them having the integrated mass storage.  Both of these generations are updatable through USB, which is going to be important later.  All right, so the first generation, which is what you probably see on the road right now. The sync module, the operating system is Microsoft Automotive and it's a Windows CE based operating system.  Data is stored in this module, this chip, which I'm going to show you a picture of later. You can get all the phone-related information, music indexes, user voice profiles.  And then there's a couple of other little stuff that's going to be in there too that could be relevant or might not be relevant too, but it's stored in this NAN flash chip.  The head unit, which is the nav system, it's got the operating system, it's Clarion VX Works.  And the way that we first found out that there were two different operating systems on the nav and on the sync module, we took the sync module out of the car and the navigation system still worked.  And we're like, huh, so that was a hint for us that there were two different operating systems. It's got a 40 gigabyte Peta hard drive with a TPM style protection on it.  Data stored, you can get music files, photos, navigation data. So this is the inside of the sync module.  You can see where the little arrow is pointing. That's the Samsung NAN flash.  Now, when you open these up, it doesn't mean that in every car you're going to have a Samsung NAN flash.  It could be a different manufacturer. It just kind of depends on where that car was built.  But it's going to be in roughly the same place and it's going to work the same way.  So again, this is going to contain the Microsoft operating system, previously paired Bluetooth information, contacts, call logs, SMS messages, phone history, save numbers.  So it is of relevance if you're a forensic examiner. If you're trying to hide the data, it's also of relevance because you don't want it to be accessed.  So you want to again delete the profile or wipe it or whatever.  Now, I don't know how many of you guys have done a lot of work with doing forensics on NAN flash, but it's not fun.  So what you have to do is there's a few ways you can do it. As you saw, there's a spare USB port on this device that you could try to acquire the NAN flash from.  We actually didn't do that, so I don't know. There's also the JTAG ports right over here, kind of at the bottom. You can see them.  We also didn't do that. What we did was we, not what we did, because we didn't do anything necessarily remember, hint, hint.  But what could be done is you could take the chip, you could remove it, put it in this flash pack device, stick it in one of the sockets that it fits,  and what's going to happen is it's going to spit out a binary file. And for those of you who have done any forensics on the NAN flash, it's kind of a pain.  Because the way that it works is you have the ware leveling, which is going to be different for each chip manufacturer, but you can still figure it out.  So for this one, you have every sector on the flash can be written over only 10,000 times. So what's going to happen is you're not going to have consecutive sectors.  And there's going to be, I've always forgotten, if it's a 4K chunk or if it's a 16K chunk, that has a numbering sequence.  So it's numbered a chunk right in front of each sector that tells you where that sector goes.  So what you have to do is you have to get this binary file out of this thing, and you have to manually remove those chunks that tell you the number of where each chunk is,  reorder them, and then you can pop it into any forensic tool. It'll just be a regular raw DD image file.  So that's how you have to do it. Maybe it sounds complicated to you, maybe for some of you it doesn't, but it's really not that difficult.  It sounds a lot worse than it is, so it is doable.  So removing the sync module, I had a lot of other pictures. I mean, we just tore these cars apart.  And this one actually I got permission, my good friend Ben, who I wish he was here, when I asked him if I could tear apart his car,  he not only said, yeah, of course, he said I'll help you. So he did.  And this is a Ford Edge 2010. The Ford sync module is located behind the center console. Really easy to get to.  It's just held in place with clips, and then there's four screws, and you just remove it.  And then you take the faceplate off, and then you have access to what I saw.  Oh, one thing quickly, with this, when you pop out the chip to do the analysis on it, you're probably not going to get it back in.  Just saying, you will board the warranty, and unless you're a pro with a soldering iron, you're not getting it back in.  Sorry, Ben. So this is the head unit. This is the front of it. It's got, again, the 40 gig, paid-a-hard drive.  This would happen to be a Hitachi Endura Star. That doesn't necessarily mean that you'll have a Hitachi if you were to get one out  or if you were to buy the car. I think they just kind of use whatever they have in batches.  This is going to contain, because it's generation one, navigation data, track data, breadcrumbs, saved locations, previous destinations,  and all your music files, which as we know could be stagged files.  So acquiring the head unit. So I'm going to go over a couple of techniques that will probably work.  Hint, hint, hint. Drake. Just kidding. All right. So this is, we remove the head unit. That's kind of what it looked like.  There's also a picture that Ben wouldn't let me use of Ben, like standing there, like with almost a heart attack on his face  that I ripped his car apart. And that's the back. You can kind of see on the second one where the hard drive was.  You just pull it out. It's really easy to get the hard drive. Although I got to tell you, when you take the car apart,  it's a lot easier to take apart again than it is to put back together.  So any of you who are forensic analysts, you see this, you see that the drive is connected to a right blocker  and I've got it into some forensic tool. Yeah, that's not going to work. Now, why is that not going to work?  Because Ford is really concerned with digital rights management and protecting music being imported to the hard drive.  So they've implemented this TPM lock style protection where the hard drive is essentially looking for a serial number on a module  in the head unit, so in the chassis. So without that, it's locked and it's really difficult to get around that.  But it is doable. So, for example, if the hard drive gets corrupt or breaks, Ford's just going to replace the entire chassis.  They're not going to get stuff off your hard drive. They're not going to fix it for you.  They're just going to give you a whole new head unit with a new drive.  So you can't take this hard drive and put it in another unit and have it work.  It just won't, well, without some manipulation.  So ways to get around this. Clarion maintains a master password that will help you unlock this device.  If you can get to Clarion and you're nice to them and not necessarily lie, but tell them what you're interested in doing,  they might give you that master password. Just saying.  But if you're not nice, what you've got to do is you've got to find a way to get around the TPM style lock.  And how do you do that the easiest way? You just keep the car running.  You keep power to the vehicle and then it's not going to be an issue.  So there's a hardware component that is in creation that what it does is it connects the head unit, the hard drive, and the laptop.  So you can actually image this device. You can see in that map, it's a middleware component that keeps power to the car.  So the car is still going. So you can just image it like you would normally image a drive.  And that's probably the easiest way to do it.  Now, my favorite way to do this, and you might want to look at these pictures because they're interesting.  Hint, hint.  Maybe. Why do you say that?  Yeah. Where's it from? Enterprise.  You have no idea how hard it is to go to Enterprise and actually request a specific car.  They don't do it. I mean, it took a lot of social engineering to just be nice and friendly and say,  you know, I really am trying to buy this car, but I want to test it first, you know.  And the woman was so nice. She kept the car for me, hid the key in the fridge so no one else would get that car.  It was nice. I appreciated that. I actually thanked her in the beginning.  So this is a way that actually is probably going, might be your easiest bet.  This is exploiting the update process.  So you go to the Ford website, you update the latest file, and you put it on your USB stick,  and then you stick it in the car, and you go through this update process that you can see that we're doing right here.  And it's a cab file. Now, if you were to able, if you were able to get some code into this cab file  and still make it readable as a cab file, you would be able to put software on the device that would allow you to  exfil a drive through Bluetooth or through the wireless.  So I don't want to call it malware because it's not necessarily malware because the purpose of it is different.  It's malware, whatever. Whatever, you know what? Sorry, DoD, it's malware.  You can exploit this update process, customize this cab file, put your malware on there that will then allow you to  exploit the Bluetooth and use it to image your file. And that way you're getting around the TPM log.  Now this way is kind of cool too. There's a guy in Florida, kind of a bit of a hermit, ecoastal.com,  and what he's done is he's created some hardware that you put on the back.  He puts the system into a canned diagnostic mode and what he does is he flashes the radio with predefined options.  So again, you could use this method, you could flash the radio with these predefined options and some of those options  you put on are again malware that allow you to access the car.  And I'm saying this because this is what a forensic analyst would do, but keep in mind that these are also things  that someone with not so good intentions could do as well.  So they could put stuff so they could constantly get access to your car.  Would it be possible to flash the radio files on the hard drive itself to remove the check consider number?  I don't know, we haven't tried that. It could be something worth trying.  So the second generation is going to be a little bit different.  It's going to be a single integrated component.  So the Microsoft sync chip is going to be in the head unit.  And they're getting away from the Clarion VX works and the operating system for the nav unit and for the chip  is going to be Microsoft Office and again, Windows CE based.  So again, exploits that we're going to work against Windows CE might work against this as well.  They're moving away from having a hard drive.  They're moving toward having all of their storage be an external USB drive or an SD card.  And the SD card has software lock protection on it.  I haven't been able to get one yet, but I'm going to get one and play around with that.  How come no one's drinking? I just said, oh, come on.  So they have a full suite of wireless products.  You can turn your car into a wireless hotspot.  You can connect to any wireless network that you want.  Again, that information is going to be stored in the chip.  So that's information that you can get access to as well.  Yeah, drink. How come no one's drinking? Someone drink.  I saw you drink, all right.  All right, so this is the second generation 2012 Ford Explorer with the second generation system.  And I thought that I was being a master social engineer here.  I thought I was being so smart.  So we dress up.  We go to the Ford dealer and I started asking him all kinds of questions,  pretending like I'm going to buy the car, and ask if I can take pictures of stuff  so that I could show you guys what's going to be there.  And I should have known that the true social engineer masters are car salesmen,  because if my husband hadn't been there with me, I would have walked out with that car  and an $800 car payment because my car is still in release.  Yeah, I hate they're like, what can I do to get you in this car today?  And I've got stars. I'm like, anything.  Yeah, that was, but that car is really nice, really nice.  So again, this includes the SD card in the center console.  You can see it. This is the Ford Explorer 2012.  Or is this the F-150 Explorer?  It's got two USB ports. Oh, that's important to note too.  The USB ports are not connected to the head unit, the hard drive.  So you can stream stuff from it, but you can't use them as points of doing a forensic acquisition.  And this is important to note too.  The only way that you can get information onto the hard drive, the photos,  currently is through the CD, but then again, using some of these methods that I spoke about  are ways of cracking that so that you can get your music on there through Bluetooth,  through wireless, if you put that piece of malware on there using those other methods.  It is. Yeah, it is.  Can you say that loud?  It is. Ford has attempted to firewall it off.  But, and I'm saying Ford is really leading this.  They've really thought of a lot of things, but GM hasn't, Dodge hasn't.  And as pretty much everyone in this audience knows, you can find ways to get around a firewall.  But at least they're making an effort.  So you can see on this SD card case, this contains the maps.  It says on there, this card is right protected.  It can't be used in any other system.  So that just kind of shows you also it's software protected.  But then I had my boy, like, there is no information about this stuff on the Internet.  There just really isn't.  So we had to do a lot of work.  And Ford, Ford dealers know nothing about this because they ship out the systems to  Claryon or to some other radio manufacturer.  And they just bring it back.  No one fixes them.  They just go away through Ford dealer to a radio manufacturer to Claryon and to Ford,  finally, Ford engineer.  So there wasn't a lot of information out there.  So anyway, so this is the plastic case that comes with it.  It's your maps.  I think you can see that when the card is not in, the navigation system will just not work.  So you have no access to your nav data.  And since this is an all-in-one component, you need that SD card in there.  So I think one of these is SD card fault.  You need to insert it.  And then the other one says it's now enabled so it can work.  This is kind of an OK picture.  I mean, the guy was, like, standing over me, like telling me all the options on the car.  So I'm, like, sitting here drooling while Matt's, like, trying to lean over me to, like, take photos.  So this is just showing you what it looks like, the second generation.  The wireless and internet is what I was most interested in.  So you see you've got your Wi-Fi settings, USB mobile broadband, Bluetooth,  and then the prioritized connection methods.  So you have a lot of options here.  Oh, it even has a nice little map that kind of shows you what you can do, too.  And then here, this is just to show you the wireless options.  You can go to Starbucks and get on their network.  And I don't know.  I mean, I guess this really means you could really, really do war driving because you're in your car.  Hey, I think I'm funny.  So, again, I haven't done a ton with the wireless, but I will tell you that most of the wireless hacks  that you've seen at this conference that you know about, that you've researched about, they're going to work here.  So, again, what my concern is is I saw this CSI episode, which is the way they did it wasn't accurate,  but what they said kind of was that they had a hacker who wirelessly got into a car  and he was able to make the car drive to some location that a guy ended up getting murdered at,  or something crazy like that.  But there are ways to get in wirelessly to the car and eventually control the car,  as these young gentlemen will probably be talking about later today at three.  So just kind of be thinking about that.  So what's the future?  So future integration, one thing that I'm kind of interested and I'm sure is going to happen is what I had mentioned before,  using your car itself as a virus, whether you send the virus out over wireless Bluetooth  or this new IntelliDrive that I'm going to show you or various other methods.  I mean, it's kind of cool, but it's kind of scary, too.  I mean, you could set up some kind of hotspot and have someone drive by and their car just shuts down.  And using the car as a communication channel, say I had something that I had to talk to Matt about  and I didn't want for Zane to be able to read it.  So I used my car and his car and we communicate on a protocol that Zane might not be looking for.  And obviously that's not something you'd really use it for.  You broaden your mind, like think about it in covert channels, ways that you need to hide your data.  So I'm going to show you this video because it's damn cool.  And this is showing you the future of this IntelliDrive.  And while you're watching it, think about the possibilities and the potentials for this technology,  using it as a communication device, surveillance, sending out viruses, or just saving lives, which is what it was meant to do.  Back now at 745 with remarkable new technology designed to keep you safer behind the wheel.  CMDC's Phil LeBeau is at RFK Stadium in Washington, DC with an exclusive first look at something that could prevent thousands of potentially deadly collisions.  Good morning to you, Phil.  Good morning, Meredith. Imagine your car could talk to any other car truck on the road and warn you if you were about to crash into each other.  It's called IntelliDrive and it may sound like something out of the Jetsons, but it's closer than you think to becoming reality.  It happens every six seconds in the U.S.  Car crashes, head-on side impact, or rear-end collisions.  More than 5 million in 2009, killing almost 34,000 and injuring 2 million more.  A group of major automakers, including Ford, GM, and Toyota, are developing a technology called IntelliDrive  that will allow cars to communicate with each other and warn drivers when they're about to crash.  We feel that the IntelliDrive program fully implemented can save up to 80% of traffic accidents for non-impaired drivers.  Here's how it works. Using GPS transmitters and Wi-Fi, cars constantly send out signals with their location and speed.  So a driver about to be broad-sided at an intersection would be warned to hit the brakes and avoid a collision.  We wanted to be like a vigilante copilot that they have with them all the time.  We tested the technology with engineers from Ford, first at a blind intersection.  Looks like it's safe for me to go, so at this point I'm going to accelerate.  Whoa! Not a good idea.  And attempting to change lanes.  With this system, it warns you if you're going to lane change into another car.  So here's an example.  Right there, the system warns me that in the lane right next to me, there was a car that I would have hit.  With technology that helps prevent rollovers and drifting across lanes, cars are already doing some of the thinking for you.  And Google is testing a car that does the driving for you.  It's possible that someday cars will drive themselves like the space vehicles on the Jetsons.  Hey! Looks like I'm opening up ahead!  Until that day, Intellidrive will make a big impact on safety.  I think this has huge potential, a huge potential to reduce crashes on our freeways.  And save lives.  And save lives, which is really the ultimate goal.  So when might we see Intellidrive in all new cars and trucks?  Well, maybe five or six years down the road.  It'll take the federal government some time to make the rules and mandate everything for the automakers.  But make no mistake, Meredith, talking cars are coming and it could save thousands of lives.  Yeah, I love the idea.  Phil Levo, thank you so much.  Alright, thank you, Meredith.  So you can see where that's going and I hope that your gears are turning.  We're probably going to be presenting this at the DoD Cyber Crime Conference.  Maybe I might submit for Shmucon, I don't know.  But I think at those conferences we'll be able to release the tool that we were talking about through the update file  that will actually enable you to get the Bluetooth back and hopefully demo it.  If there's enough room to bring one of the cars in, I might try to do that too.  Does anyone have any questions?  Yeah, see this, will you say that louder?  Oh, he wanted to know if you could go get one of the pineapples and use it against cars?  The answer is yes.  And any other questions?  The operating system is on top of the chip.  So there's firmware that's the chip manufacturer that's going to be in there,  and there's also the Microsoft that does have the firmware on there.  Yes?  Yeah, not in the exact way, but yes, every car is affected.  Hey, before you guys leave, wait, stop.  Which one of you guys was the one who picked out that that was an enterprise car  and gets to have Zach buy you a drink?  Who was that?  It was you?  Oh, come on up to the front then.  My time?  Three minutes.  Three minutes?  All right, any other questions?  All right, thank you.
DEF_CON_19_-_Tyler_Cohen_-_Look_At_What_My_Car_Can_Do_ESmYO4VMyiw_1_0_1187.png DEF_CON_19_-_Tyler_Cohen_-_Look_At_What_My_Car_Can_Do_ESmYO4VMyiw_1_1188_1931.png DEF_CON_19_-_Tyler_Cohen_-_Look_At_What_My_Car_Can_Do_ESmYO4VMyiw_1_1932_4235.png DEF_CON_19_-_Tyler_Cohen_-_Look_At_What_My_Car_Can_Do_ESmYO4VMyiw_1_4236_6251.png DEF_CON_19_-_Tyler_Cohen_-_Look_At_What_My_Car_Can_Do_ESmYO4VMyiw_1_6252_8711.png DEF_CON_19_-_Tyler_Cohen_-_Look_At_What_My_Car_Can_Do_ESmYO4VMyiw_1_8712_11507.png DEF_CON_19_-_Tyler_Cohen_-_Look_At_What_My_Car_Can_Do_ESmYO4VMyiw_1_11508_11879.png DEF_CON_19_-_Tyler_Cohen_-_Look_At_What_My_Car_Can_Do_ESmYO4VMyiw_1_11880_12791.png DEF_CON_19_-_Tyler_Cohen_-_Look_At_What_My_Car_Can_Do_ESmYO4VMyiw_1_12792_20579.png DEF_CON_19_-_Tyler_Cohen_-_Look_At_What_My_Car_Can_Do_ESmYO4VMyiw_1_20580_21131.png DEF_CON_19_-_Tyler_Cohen_-_Look_At_What_My_Car_Can_Do_ESmYO4VMyiw_1_21132_22211.png DEF_CON_19_-_Tyler_Cohen_-_Look_At_What_My_Car_Can_Do_ESmYO4VMyiw_1_22212_30251.png DEF_CON_19_-_Tyler_Cohen_-_Look_At_What_My_Car_Can_Do_ESmYO4VMyiw_1_30252_32315.png DEF_CON_19_-_Tyler_Cohen_-_Look_At_What_My_Car_Can_Do_ESmYO4VMyiw_1_32316_32423.png DEF_CON_19_-_Tyler_Cohen_-_Look_At_What_My_Car_Can_Do_ESmYO4VMyiw_1_32424_37823.png DEF_CON_19_-_Tyler_Cohen_-_Look_At_What_My_Car_Can_Do_ESmYO4VMyiw_1_37824_38627.png DEF_CON_19_-_Tyler_Cohen_-_Look_At_What_My_Car_Can_Do_ESmYO4VMyiw_1_38628_40343.png DEF_CON_19_-_Tyler_Cohen_-_Look_At_What_My_Car_Can_Do_ESmYO4VMyiw_1_40344_49403.png DEF_CON_19_-_Tyler_Cohen_-_Look_At_What_My_Car_Can_Do_ESmYO4VMyiw_1_49404_52931.png DEF_CON_19_-_Tyler_Cohen_-_Look_At_What_My_Car_Can_Do_ESmYO4VMyiw_1_52932_55547.png DEF_CON_19_-_Tyler_Cohen_-_Look_At_What_My_Car_Can_Do_ESmYO4VMyiw_1_55548_56579.png DEF_CON_19_-_Tyler_Cohen_-_Look_At_What_My_Car_Can_Do_ESmYO4VMyiw_1_56580_58355.png DEF_CON_19_-_Tyler_Cohen_-_Look_At_What_My_Car_Can_Do_ESmYO4VMyiw_1_58356_59483.png DEF_CON_19_-_Tyler_Cohen_-_Look_At_What_My_Car_Can_Do_ESmYO4VMyiw_1_59484_60251.png DEF_CON_19_-_Tyler_Cohen_-_Look_At_What_My_Car_Can_Do_ESmYO4VMyiw_1_60252_60407.png DEF_CON_19_-_Tyler_Cohen_-_Look_At_What_My_Car_Can_Do_ESmYO4VMyiw_1_60408_60791.png DEF_CON_19_-_Tyler_Cohen_-_Look_At_What_My_Car_Can_Do_ESmYO4VMyiw_1_60792_60875.png DEF_CON_19_-_Tyler_Cohen_-_Look_At_What_My_Car_Can_Do_ESmYO4VMyiw_1_60876_60971.png DEF_CON_19_-_Tyler_Cohen_-_Look_At_What_My_Car_Can_Do_ESmYO4VMyiw_1_60972_61139.png DEF_CON_19_-_Tyler_Cohen_-_Look_At_What_My_Car_Can_Do_ESmYO4VMyiw_1_61140_61199.png DEF_CON_19_-_Tyler_Cohen_-_Look_At_What_My_Car_Can_Do_ESmYO4VMyiw_1_61200_61715.png DEF_CON_19_-_Tyler_Cohen_-_Look_At_What_My_Car_Can_Do_ESmYO4VMyiw_1_61716_61967.png DEF_CON_19_-_Tyler_Cohen_-_Look_At_What_My_Car_Can_Do_ESmYO4VMyiw_1_61968_62159.png DEF_CON_19_-_Tyler_Cohen_-_Look_At_What_My_Car_Can_Do_ESmYO4VMyiw_1_62160_62447.png DEF_CON_19_-_Tyler_Cohen_-_Look_At_What_My_Car_Can_Do_ESmYO4VMyiw_1_62448_62507.png DEF_CON_19_-_Tyler_Cohen_-_Look_At_What_My_Car_Can_Do_ESmYO4VMyiw_1_62508_62759.png DEF_CON_19_-_Tyler_Cohen_-_Look_At_What_My_Car_Can_Do_ESmYO4VMyiw_1_62760_62927.png DEF_CON_19_-_Tyler_Cohen_-_Look_At_What_My_Car_Can_Do_ESmYO4VMyiw_1_62928_63107.png DEF_CON_19_-_Tyler_Cohen_-_Look_At_What_My_Car_Can_Do_ESmYO4VMyiw_1_63108_63359.png DEF_CON_19_-_Tyler_Cohen_-_Look_At_What_My_Car_Can_Do_ESmYO4VMyiw_1_63360_63455.png DEF_CON_19_-_Tyler_Cohen_-_Look_At_What_My_Car_Can_Do_ESmYO4VMyiw_1_63456_63959.png DEF_CON_19_-_Tyler_Cohen_-_Look_At_What_My_Car_Can_Do_ESmYO4VMyiw_1_63960_64079.png DEF_CON_19_-_Tyler_Cohen_-_Look_At_What_My_Car_Can_Do_ESmYO4VMyiw_1_64080_64175.png DEF_CON_19_-_Tyler_Cohen_-_Look_At_What_My_Car_Can_Do_ESmYO4VMyiw_1_64176_64427.png DEF_CON_19_-_Tyler_Cohen_-_Look_At_What_My_Car_Can_Do_ESmYO4VMyiw_1_64428_64475.png DEF_CON_19_-_Tyler_Cohen_-_Look_At_What_My_Car_Can_Do_ESmYO4VMyiw_1_64476_64859.png DEF_CON_19_-_Tyler_Cohen_-_Look_At_What_My_Car_Can_Do_ESmYO4VMyiw_1_64860_65507.png DEF_CON_19_-_Tyler_Cohen_-_Look_At_What_My_Car_Can_Do_ESmYO4VMyiw_1_65508_65687.png DEF_CON_19_-_Tyler_Cohen_-_Look_At_What_My_Car_Can_Do_ESmYO4VMyiw_1_65688_66239.png DEF_CON_19_-_Tyler_Cohen_-_Look_At_What_My_Car_Can_Do_ESmYO4VMyiw_1_66240_66971.png DEF_CON_19_-_Tyler_Cohen_-_Look_At_What_My_Car_Can_Do_ESmYO4VMyiw_1_66972_69347.png DEF_CON_19_-_Tyler_Cohen_-_Look_At_What_My_Car_Can_Do_ESmYO4VMyiw_1_69348_69839.png