Cybersecurity and Safety Risks of Modern Vehicles: Understanding Vulnerabilities and Solutions with Kevin Walter

Aaron Crow (0:2.205): Hey, thank you for listening to the show guys. I'm excited to have this, the Kevin on today to talk about, uh, all things vehicle. So it's definitely an area outside of my expertise, but it's definitely one that is constantly in the news with all the technology that's going into cars. So Kevin, thank you for joining us. Why don't you tell us who you are? Kind of a little bit about, about your background and what you guys do.

Kevin (0:21.036): So my name is Kevin Walter and I am, I do vehicle security research. A lot of it is on my own and I have a master's degree in cyber security. One of the things that I did pretty extensively when I was in graduate school is research on vehicles and I am still doing research myself. I started my own LLC.

Kevin (0:49.292): Right now it's just sole proprietorship at this point, but that's just a little background on me.

Aaron Crow (0:59.037): What kind of things were you researching for when you're going through school and things like that? It kind of dipped your tone of this. Cause I know you, you, we talked a little bit offline, but you know, you started out in a, in a completely different field and you transitioned fairly recently, right? And the cyber security recently in your career. I mean,

Kevin (1:16.300): Yeah, yeah, so about about 2020 is when I transitioned into cyber security and so so um some of the things that I researched into vehicles was things like tire pressure monitor systems um also I had researched the CAN the CAN net boss which stands for controller area network and that is the

Kevin (1:46.220): vehicle network and computer system on a vehicle and typically this this network has about 50 different what are called electronic control units on it and so you can interface with that network by using and it's called an onboard diagnostics tool so it's OBD2 and that's the standard that is in vehicles from 1996.

Kevin (2:16.332): to the current day. And so it's a standard that's in every vehicle, almost every vehicle. Some vehicles like Teslas, I believe, don't have that interface. But it is a standard that is in the majority of vehicles today. So that the mechanic can go in there and they can read the computer and see.

Kevin (2:46.668): if there's any problems with the vehicle and help themselves diagnose the vehicle. And just a little bit more about my background. So yeah, I was actually an independent contractor, transportation contractor. And so I was doing that business for several years. And at a certain point, I decided to...

Kevin (3:16.588): learned to be a mechanic because when I did all the books on my business, my biggest expense was on vehicles, obviously, because it's the business I'm in. So I decided to take a couple of courses in mechanics. And then I ended up getting a Pennsylvania vehicle safety inspector license and a Pennsylvania emissions inspector license.

Kevin (3:46.348): I also have motor vehicle air conditioning licenses. And then what happened was COVID hit and then I, it basically hit my business pretty hard. So I was at home, I was playing around with vehicle electronics and electronics that are similar to what are in a vehicle. I actually made one. One of my projects was I made a, it's almost like a mini robot.

Kevin (4:15.852): self -driving vehicle. I bought a kit off Amazon and so they tell you how to put the whole thing together and they had some scripts in Python and one of them was you could throw a red ball on the ground and you can get the robot to follow it. It was a pretty cool project but uh so it was one of them and that was that was when I started to get inspired to to go into IT.

Aaron Crow (4:18.717): Mm -hmm.

Kevin (4:44.684): I still wasn't like, yeah, I'm going to do cybersecurity specifically. But I started to get inspired to go into IT. I started learning programming because I was so fascinated with like Raspberry Pi computers and arduinos. And a lot of the same components that are in a vehicle are in some of those electronics you can play around with on an arduino set.

Aaron Crow (5:5.373): Mm -hmm.

Kevin (5:14.892): like potentiometers and things like that. So I just got fascinated by it. I was sort of plugging in, building the breadboard and putting different electronic components on the breadboard in connection to the computer. And then I had all these different Arduino scripts that I put in the Arduino developer IDE. And...

Aaron Crow (5:41.149): I know.

Kevin (5:43.756): I was like this is so cool so I started learning programming and then I was I signed up for Codecademy I don't know if you guys are familiar with that but so I started learning programming on there and then what happened was I actually made a I made a cyber see I wasn't in cyber security yet so I made all the same mistakes that people don't shouldn't do

Aaron Crow (5:54.461): Mm -hmm.

Kevin (6:11.116): I got into cyber security and my account got hacked on Codecademy. So somebody got in there and they ordered a three hundred something dollar subscription there and then I talked to the person at the company and they said they told me give me some pointers and they said go on haveibendpond .com I saw my email address was on the dark web.

Kevin (6:40.748): And so what I did is I started to study cybersecurity because of what happened there. And then ever since then, it hasn't stopped. And now it was about four years ago. And so that's what inspired me, somebody hacking my account.

Aaron Crow (7:5.341): Yeah. I mean, sometimes it takes an incident like that to kind of get us, get us rolling. You know, you talked about the, going back to the, the car hacking and the ODB two, you know, I had a Chevrolet Avalanche, which is the truck. It's kind of like the Tahoe with a, with a bed on it instead. Right. Um, but I had one of the motor, I bought the car or the truck. It was an older vehicle, had a lot of miles on it. Um, and sure enough, at some point, the motor blew.

Aaron Crow (7:32.541): Um, so I ended up getting a junkyard, uh, engine off of eBay and they sent me the engine and I had to put the mo I put the motor and it was a six liter as opposed to the five three was what was in the car before, but it's got, it marries up to the transmission, all that. So I put it in, um, and I had to buy the scan or like a programming tool to actually program it. And the really cool thing I thought it was interesting. Um, Chevrolet.

Kevin (7:36.460): Yeah.

Kevin (7:48.556): Yeah.

Kevin (8:1.004): Daddy.

Aaron Crow (8:2.813): all of the settings for every different Tahoe and every different configuration is in the computer. So even like they had the hybrid option, they had the six liter option, they had the five three option, they had all these different things. So even though, so to tune the car, all I had to do is put the motor in, plug everything up, all the sensors, and then go into the computer and say, Hey, this is a six liter and here's it's air fuel ratio chart as opposed to what it used to be because it's a different motor.

Kevin (8:7.916): Yes.

Aaron Crow (8:32.125): and all of that. And I had to play around with it a little bit to make it work, but it was a motor from a different year, but I was able to plug it in. And because all of those settings were already in the computer, I was able to just download a config from somebody else that had done a six liter in this, you know, in this, this year and make it run. And man, it worked great. I drove that car for another, I don't know, a year and a half, two years on a replacement motor with using my own computer.

Aaron Crow (8:57.629): And I'm not a mechanic. I mean, I play around, I'm a shade crew mechanic at best, but I was able to do it by hacking and playing and messing with settings and things like that. So it's amazing what you can do with a computer and through that ODB2 port and the infotainment systems connected to it and almost everything is connected in through that network that controls that car.

Kevin (9:1.356): Thank you.

Kevin (9:17.452): Yeah, that is really cool. Actually, I have a similar tool that I just purchased and I'm playing with on my vehicle and you can really go in depth and there's a lot of hidden features that are actually on the vehicle that people don't know about and it's like one thing that I recently uncovered with some of my research is that...

Kevin (9:46.156): there's this key fob hack in there where you can you can uh so you press the lock button on the key fob and then you press it a second time and hold it down and it will close the window and it's the same thing with the unlock feature hit the unlock button once and then hold it a second time and it will close the window but that's a feature that's hidden on my vehicle and i had to go into the computer system to change that.

Kevin (10:16.204): And there's a lot of other stuff. Actually, one of the things I didn't know I had on my vehicle was adaptive cruise control. It was shut off. And I went in there and turned it on. So the reason actually that I got asked to be on this podcast is because I went to the B -Sides Harrisburg Convention. And so so it's about a three and a half hour drive from Pittsburgh.

Kevin (10:46.220): to Harrisburg, I'm from Pittsburgh, and I wish I would have had that, because I'm playing around with the cruise control constantly and manually readjusting it, and I just found out about that recently, so it would have been nice to have that.

Aaron Crow (11:1.181): Yeah, it's incredible. I mean, all the way back to 20, you mentioned Tesla, right? All the way back to, I think whenever the, the model three, all the way back to 2018, I think, um, you know, Tesla has all options, all the hardware is there for all options on every car. It's just a matter of what you unlock. It's like more like a licensing code. Did you unlock full drive capability? Did you unlock these things? And it's a license that you can be upgraded to and you're getting over the air updates.

Aaron Crow (11:30.717): I don't own a Tesla, but a lot of people that do, that's one of the things they love is they have an older car, but it unlocks these new capabilities as they upgrade the software and the capabilities in the OS of the running car, which is amazing. The old model is I gotta go buy a new car to get those features. You want Apple CarPlay? You gotta buy a new car, you gotta replace the head unit, right? A lot of the hardware is the same, it's just a software thing, but...

Kevin (11:53.100): Yeah.

Aaron Crow (11:56.989): The old companies are not software companies. So more and more of these software, all these cars are becoming just computers with wheels. Yeah.

Kevin (12:2.892): Yeah, basically what they are it's really neat and one of the things that I found is really cool is that When I researched more it seems like it's mostly mechanics that are doing all these hacks on the cars You go on YouTube and you watch all these videos. It's a lot of the guys that do this They're just going in their car and playing around tuning different things, but there's not

Kevin (12:31.628): as many people who come from a mechanic background and then get in cyber security, but I think it's going to be a growing field in the future and that might be a demographic that say they got a bad back or something and they want to transition into cyber security because it's almost an IT specialized job today. I mean there's physical work in it, but...

Kevin (13:1.260): If you have a bad back or something happens, they take your mechanic license, then you have a stroke and they take your mechanic license. I feel like you can pivot into IT from that.

Aaron Crow (13:16.509): Well, I mean, if you think about it, you know, again, I grew up working on cars and again, not, not an actual mechanic, but, you know, modifying my cars and putting lift kits or, or, you know, enhancing the, the, the aftermarket parts, et cetera. Right. But you can't even work on a car nowadays unless you have a computer, unless you have, uh, the, the ability to run those scanners and be able to program that stuff. Like you just can't do it. So.

Kevin (13:34.380): page.

Kevin (13:44.044): Okay.

Aaron Crow (13:45.085): Even, even your old school mechanics that have been doing this for 40 or 50 years, unless they have the ability to interact with the computers, they can't work on newer cars. Like anything from the late nineties on, you have to have some level of computer ability to, to plug into and enable features and troubleshoot. Cause it's not the same troubleshooting. Like the kit, the computer, I remember changing a battery on a BMW and the battery just went bad, but just replacing the battery.

Kevin (14:8.172): Yeah.

Aaron Crow (14:12.829): I had to take it to the shop and they had to enable the new battery in the computer, even though it was just a fricking battery, but they had to enable it in the car, in the computer. And the BMWs, I didn't have a scanner because it wasn't the same scanner. It was back that circle scanner in the earlier nineties. So there wasn't anything I could do. I had to take it to a mechanic and they charged me $500 to just check a box that says, yeah, this battery is okay.

Kevin (14:18.860): Yeah.

Kevin (14:37.996): Yeah, yeah, it's crazy. It seems like it shouldn't be that much money, but they have the tool to do it, so...

Aaron Crow (14:51.421): So talk about some of the security and safety issues, obviously with cars and OT, one of the things that's different in OT and absolutely goes into the car side is the implications of these things. There's a physical reaction to them, right? If I hack a car, I can make brakes not work. I can make power steering go off. I can make your speedometer miscalibrated. There's an infinite number of things that I can do. I can set off airbags. Like I could do some really scary things.

Aaron Crow (15:20.349): with these cars. And you know, if we're not considering cyber when we're building these cars, especially in the future, it's not necessarily you could something you can go back to and put a firewall on something. But you can absolutely at least be aware of what the risks are when you're buying a car, which cars are better than others as far as what what risks and vulnerabilities there are on.

Kevin (15:40.844): Yeah, so there are several different vulnerabilities that I covered in my presentation in Harrisburg. One of them was on tire sensors. And so the tire sensors are kind of a unique vulnerability because it was 2000, I think it was 2008, was the year they passed the TRED Act. And so that required every vehicle.

Kevin (16:10.188): on the road to have a tire pressure monitor sensor in every tire. Because the reason they passed that was, I don't know if you remember a while back, but there was all those firestone tire burnouts on highways. It was maybe late 1980s.

Aaron Crow (16:30.973): Yep. The Ford, it was a Ford Ford escape or explore. I think it was the Ford Explorer was the most common of them that were like flipping and stuff because of that. Yeah. I remember that.

Kevin (16:40.012): Yeah, so they when they get to high speeds they would burn out and so so what this what the law did was it required to have that sensor in there and whenever one tire is eight psi pounds per square inch below the recommended manufacturer's setting then that sensor will go off.

Kevin (17:7.404): and it will tell the driver you need to put air in this tire. And so the one vulnerability flaw in them though is that if you think about a tire, it's a moving piece. It keeps, it goes in a circle and how do you connect the wire to that? You can't really do that. So they put radio signal transmitting from that sensor.

Kevin (17:37.708): And so that opens a vulnerability up on the tire. And so what was demonstrated was that there was a study done by University of South Carolina and Rutgers. And they uncovered several vulnerabilities with these sensors. One of them is just a basic privacy concern with them. So each sensor...

Kevin (18:6.444): has a unique ID. And so you have four different unique IDs and they transmit these packets within about, I think it's, you can get up to about a hundred meters. So that's around maybe, I don't know, 60, I forget the conversion, but 60 feet or so. And so if somebody were to put,

Kevin (18:35.436): Receiver on the side of the road they can track your location So that's that's one issue with them. Another one is that so you have So you can actually intercept these these packets you can reverse engineer them and Then you can send spoof packets to to the sense to the module That the tire pressure module that receives signals from the tire sensor

Kevin (19:5.420): And if you flood that module with packets, you can actually shut the vehicle down while somebody's driving. That was another finding that they had and they demonstrated. Another one was that you could actually drain the battery if, say, the car is just sitting there idle, parked on the side of the road, you can repeatedly flood it.

Kevin (19:34.764): with spoof packets and drain the battery of the vehicle. And so those are just some of the vulnerabilities that are in the tire sensor. And the other thing is that what they found in this study was that the packets are just accepted completely. There's no authentication on them. It just accepts.

Kevin (20:4.204): whatever command you send to it. And you could also make the sensor send messages to the computer so that it causes the tire sensor to keep flashing even though the tires are fine. And that could maybe cause somebody to pull over to the side of the road or whatever. Say they're on a busy highway, that could put them in a dangerous situation. So those are just a few of the findings they had.

Kevin (20:34.572): in that study.

Aaron Crow (20:37.725): Or I mean, I'm guessing sure you could also send everything is fine, even though the pressure is low. So someone would ignore a low tire because they wouldn't know that it's there. So yeah, it's definitely an example of how sensors that are designed to help, help us out. Um, and no, cause used to back in the day, you just walk around your car and made sure your tire pressure was good for you. Went, got going. And now we assume everything is good with our, with our, uh, uh, the sensors that we have built into our cars now.

Kevin (21:4.076): Yeah. Yeah, I see.

Aaron Crow (21:7.037): Well, I know I've got a 16 year old or soon to be 16 year old and one of his friends, you know, just got a new car. Um, or not new, but you know, a Toyota Highlander or something, but I've seen how kids today, when they're learning to drive and they're learning to like, for instance, back up, they only use their camera. Like, I don't think they have the skillset to back up. So what happens if the camera stops working? Are they going to be able to back up, um, without wrecking because they're.

Kevin (21:28.908): Yeah.

Kevin (21:33.036): Yeah. Yeah.

Aaron Crow (21:36.797): They're a hundred percent dependent upon these tools, which are great tools. I'm glad we have them, but they can't do it without them. So that can be a problem if you know, you hack it and your camera goes down.

Kevin (21:47.756): Yeah, yeah, I mean I grew up I learned how to look behind me but it's yeah. Yeah. And then my prior Vico I had it was kind of hard to even look behind me because the visibility wasn't good but it had sonar but it didn't have a camera and I had to depend on that sonar sound but it was.

Aaron Crow (21:55.485): You didn't have a choice. That's all the way we had. We could do it, right?

Kevin (22:15.148): very hard to look back and see but this one is fine and every other car I've had is I've been able to look back and it's fine.

Aaron Crow (22:25.021): Yeah. So what are some of the other, other issues that you've seen are, are, are coming up in cars? Obviously I know there's a, there's a lot going on. I think a recent bill just came out where the government can actually shut down your vehicle. Um, so if there's a police chase, they can actually shut down your car. Um, now obviously that's only supposed to be done from, you know, authorized personnel, but if they can do it and theoretically, then somebody could hack it and be able to do that and shut down your car as well. So again,

Kevin (22:38.860): Oh yeah.

Aaron Crow (22:54.429): drive it on the highway and shut your car off.

Kevin (22:56.748): Yeah, yeah, so one of the things I like to do in my research is I like to find the wiring diagrams on the vehicle and then I like to screenshot all the different vehicles I research that have you see a telematics unit which is what it's like a cellular connection to the internet and then you

Kevin (23:26.316): you have this wire that goes over here and then it connects to the CAN bus and it's like here telematics unit the wire goes and connects to that network and so it's if you can get into that telematics unit then you can there there are potentially ways you can pivot into that CAN bus and as I said before with with the tire sensors

Kevin (23:55.084): A lot of the vehicles don't have authentication and you can just send whatever command in there that you want to. Now I think some of the newer vehicles are improving on this but some of the models that when they first started connecting to the internet it's...

Kevin (24:23.180): maybe not as secure, but some of the newer ones have like ethernet and they could segment some of those components. So each component would say like, I don't know, a powertrain module. So it's harder to get into those ones, but yeah, you can, it's been demonstrated that you can definitely remotely get into vehicles. And one of the most famous,

Kevin (24:52.396): hacks on cars remotely was that 2014 Jeep hack. I don't know if you're familiar with that one, but...

Aaron Crow (24:59.229): Yeah, but why don't you talk about it?

Kevin (25:0.588): Yeah, so it was Andy Greenberg and I believe it's his name, Charlie Miller and Chris Valasek. They're pretty prominent vehicle hackers. And so what they did is they had Andy Greenberger, he's like a pretty popular wire reporter and he was driving the Jeep down the highway and this was all pre -consent and everything. And they...

Kevin (25:29.644): And they got, first they started turning the radio on and blasting it really high. And then they put pictures of themselves on the infotainment system. Started making the wipers go like crazy on and off. And then I think one of the things that Andy Greenberg got mad at was that they actually shut the engine down on the highway. And I don't think he was too happy about that. But.

Kevin (25:59.820): And then another part of that video they didn't do this on on a highway, but they did it like in a parking lot and they They shut the brakes down while he was like going maybe like two miles per hour And it made his the Jeep go into a ditch And it was just stuck there and so that was another one they did so yeah, that that's just demonstrated that

Kevin (26:27.596): there is some vulnerabilities that could potentially be exploited. Now that was a 2014 hack, so I think that they, some people may have started to improve on those. Yeah, yeah.

Aaron Crow (26:46.845): Yeah. But the problem is, is there's 2014 still on the road, right? You know, I've got to drive a 2017 car. So, and I drive a 2017, you know, Toyota Alexis brand, right? So Toyota is kind of late to the game on, on upgrading that kind of stuff. So it's possible that mine is vulnerable to those types of things. Right? So it's very similar in all things. OT is we've kind of, we started adding these, these technologies and these capabilities in.

Kevin (26:53.676): Thank you.

Kevin (26:57.292): Yeah.

Aaron Crow (27:13.437): without fully understanding the implications and the risks behind them. And especially when you're talking about how many thousands of cars are out there that have this type of thing. And now granted, how many people are sitting around with a laptop with the capabilities that are going to go down and try to do these things, but it's still something that we need to get in there that we can stop this because again, if you look at the bill that just came out again with, with talking about being able to shut down a car, a nation state, a bad actor, if they were able to get into that system,

Kevin (27:28.300): Yeah.

Kevin (27:40.428): Yeah.

Aaron Crow (27:41.597): They could potentially shut down every car that has a capability, right? Every car with, with that, that cell phone connection, everything I think newer than like 2014 or 2012, they could, they could potentially shut down those vehicles, which obviously that could be an impact. So there's a national security risk. There's a, there's about actor risk, but there's also just a general safety. You know, if you lock brakes up on the highway, you're going to cause people to crash and injuries and, and there's, there's a lot of implications that could come from all these things. We're dealing with a real world problem.

Kevin (28:4.876): Thank you.

Kevin (28:8.876): Thanks.

Kevin (28:11.276): Yeah, so I actually read the write -up that Charlie Miller and Chris Valisic wrote on very specific detail on how they implemented that hack on the vehicles. And the way that it wasn't really on the...

Kevin (28:40.972): If you go on YouTube and you watch it, but there was a potential that they wrote in there that say you could get into all of those vehicles simultaneously. And you could say spread a worm that way. And then it would just go to all of them. And then simultaneously you could have millions of cars go take control of them. And it's, that's a huge.

Kevin (29:9.004): National security risk in my opinion and but I think that they they did release a patch on that. So that's at least a good thing and

Aaron Crow (29:19.389): Well, and that CAN bus system, that architecture is used across maritime, it's used in airplanes. So that CAN bus system is obviously not that specific problem. And obviously airplanes, they're probably looking, or I know they're looking at that differently than they are cars, but still there's a similar architecture issue. There's a similar consideration we need to be looking at for all these types of systems when we're integrating. It's easiest to just plug it into the network that's available.

Aaron Crow (29:49.437): That's like putting the, you know, the power plant. I'm just going to plug it into the internet because it's the closest network available, but we all know the problems with doing that and the risks that we're opening up by doing that as well.

Kevin (29:59.628): Yeah.

Kevin (30:2.540): Yeah, it's kind of, it's, so yeah, I mean, I think the one thing is that how do you update these vehicles too is, like it's very easy, I think, to do it on a computer or a phone, but when it comes to vehicles, not all of them have over the year capability to update it in the, in.

Kevin (30:29.740): When you go in the computer and you look, is this something you can update over the year? And some of them have it restricted to, you have to go into the dealership or download the software off of the manufacturer and plug a USB stick in and update it. And so, it's, so that can be a complexity. It depends on, on which one, but, but I know like, uh, there's certain features when I went in my vehicle with the tool I have.

Kevin (30:59.308): or over -the -air capabilities to update certain components in the vehicle or just use a USB stick. So it's like people need to go find somebody to help them update it. Now there are a lot of over -the -ear means to update it too, but it's like, I'm sure there's some vehicles out there that are not updated and...

Kevin (31:30.188): So that can be an issue too.

Aaron Crow (31:33.949): Yeah, absolutely. I mean, especially when you start looking at, you know, I'm not a mechanic or people that are not capable or comfortable doing those things. And maybe they live in a remote area. They don't take it to the dealership, whatever those, those, those cars can be vulnerable to that because they haven't gone in and taken it. So, you know, all the way down to, I remember I had a Harley Davidson, you know, the infotainment system on that. If I wanted to enable it to use Spotify or, or airplay with my, with my phone.

Kevin (31:34.476): Yeah.

Aaron Crow (32:3.837): I had to take it in the dealership. They had to plug in their, into their scanner, which it wasn't ODB2. It was some other proprietary Harley thing, but it was the same type of connection and connect into the CAN bus and the, and the infotainment system to enable that checkbox. Like we were talking about when I did the avalanche on the Chevy platform, just to enable that. And that was a, they charged me a hundred dollar mechanic fee, you know, shop charge, uh, and you know, uh, the cable, I don't remember what it was, but it was like 250 bucks.

Kevin (32:24.204): Thank you.

Kevin (32:31.980): Yeah.

Aaron Crow (32:32.861): to basically do something I could do at home, but I didn't have the software to do it, right? So it's pretty frustrating that they're doing that. And then I know Tesla, you know, Tesla really doesn't allow you to do any, you have to get all work done at Tesla, right? There is no, you can't just take it to your local mechanic or have your brother -in -law fix it or even do it yourself. You really don't have that ability. I know there's a lot of lawsuits around those things, but.

Kevin (32:37.388): Yeah.

Kevin (32:54.156): Yeah.

Aaron Crow (32:59.325): They don't have the software availability. You can't just download an open source, uh, software package and get the scanner. A normal car. If you have a check engine light, you can go up to, you know, auto zone or O 'Reilly or any of these places. They can plug in their scanner and tell you at least what the code is. Hey, this is for the air conditioning system, or this is a ABS sensor, or this is an ODB two scan, uh, or a, uh, O two sensor. They'll at least narrow it down and tell you what the cut, what the code is. But on a Tesla.

Aaron Crow (33:30.013): Unless it tells you on the display, which I don't know enough. Obviously there's not as many parts and sensors and things to break necessarily, but it's just different. So it makes it difficult when you don't have the ability to at least diagnose and troubleshoot. And what is the life cycle of that car beyond the cybersecurity impacts of it? What is the life cycle of that car? If I can't maintain it myself, because eventually the warranty is going to end. If I want that car to last after that fact, because I can buy a 1962 Mustang and I can still work on her.

Aaron Crow (33:57.565): 62 is not right. 64 and a half would be the first one, but you get my point. I can buy a 60s car and I can still work on it. I can put a new motor in it. I can do all the work on it. I can do the same thing with the 2012, but I'm going to have to have a computer, but a Tesla, I know there's that one guy on YouTube, what is his name? Russ or Ross or whatever. And he takes Teslas and finds them in junkyards and pieces them together and makes one, but Tesla won't even sell them apart.

Aaron Crow (34:26.397): because they refuse to sell him anything, which is to me asinine, but I've taken this, I've taken us down another, another panel there, but it's, it all goes back to being able to understand what's in your, in your system and in your, in your car, because ultimately it's impacting you as a, as a consumer and me as a, as another, in another vehicle driving on the same highway as you.

Kevin (34:28.812): Hehehehe

Kevin (34:31.884): Yeah.

Kevin (34:47.212): Yeah.

Kevin (34:51.212): Yeah, it's definitely an issue there.

Aaron Crow (34:56.637): So what do you see of how, how do you get ahead of this from a, from a cyber perspective is, and across all these different car manufacturers and we've got different countries where these cars are put in, you know, you know, Toyotas are built in Japan and the company is Japan, but they obviously we have them here. There's, but there's a right side drive car. There's a left side drive car. Like we've got all of these issues, but from an American perspective, um, on our highways, if we just focus in on just America, just for a second.

Aaron Crow (35:25.533): You know, how do we, how do we look at this from a, from a policy perspective or from a future engineering perspective of how do we make these things more secure and more reliable? Cause reliability is really the biggest impact. We don't really care about cyber except for the fact that it can impact availability and safety.

Kevin (35:43.148): Yeah, I think one of the things is that just like they passed a standard for tire sensors, they have to be in the vehicle. And then the OBD2 in 1996 and newer vehicles all have to have that same network for universal trouble code diagnostics. There should be some type of standard for safety on.

Kevin (36:13.292): on the vehicles for that because it's a very important subject and this isn't just like say you hack into a computer and somebody loses money and data and someone puts a ransomware on your computer but it goes beyond that to people's lives could be at stake and it's also a national security risk and

Kevin (36:42.572): So I think maybe some type of standard across the board should maybe be implemented to make the vehicle safer. So I think that's a good solution. And I guess there's a lot of people that will have to come into play and try to figure out how that needs to be implemented. But that's my idea.

Aaron Crow (37:10.749): Well, and I know as we have more and it's beyond just Tesla, you mentioned earlier of the auto, the cameras are noticing speed. My car, it recognizes the speed of the speed limit signs. And I know that's easily hacked. I know you talked about that in your speech or in your talk at B -sides where you can just put...

Aaron Crow (37:36.925): reflective tape on a speed limit sign and it reads it as a different speed than it actually is. So there's easy ways that I can physically manipulate those things that have a giant impact. So talk a little bit about the, the, the, the autonomy from, from a vehicle perspective. And as we're adding more autonomous self -driving capabilities more than just Tesla have that now, that's it. That's a big risk. Uh, there's, there's self -driving cars in San Francisco. There's even some, well, there were some in Austin here.

Aaron Crow (38:5.789): where there were driverless vehicles where you could get a car and it would show up and there's no driver in it. You just get in the back and it takes you to your destination.

Kevin (38:13.132): Yes, so I remember seeing them in Pittsburgh too because Uber was a, this was basically the hub for Uber for their self -driving vehicles in Pittsburgh. And then there was that one accident, it was on a St. Patrick's day several years ago. And I guess it didn't recognize the woman who was crossing the street with a shopping cart. And I...

Kevin (38:41.387): and then ever since then I have not seen any of those vehicles on the road in Pittsburgh. They basically just shut the program down, Uber did.

Kevin (38:53.644): But yeah, that's definitely a big issue. Like the speed limit signs, that is a hack that was demonstrated and it's so simple for an attacker to implement. I mean, it's just, you had a 35 mile per hour speed limit sign and somebody put black tape across the middle of the three. It wasn't even a complete eight, but...

Kevin (39:23.468): Tesla's automated driver assist. It interpreted that as an 85 mile per hour speed limit sign. There was one video actually, I didn't put it in my presentation, but you can look it up on YouTube where you can actually see that demonstration. So there's a driver in the car and it starts going up to maybe about 50 or 55.

Kevin (39:53.836): and then the driver catches it and puts the brake on but that's still a potential of what if so what if somebody is like oh this automated vehicle is doing fine driving me to work or whatever I'm reading my newspaper and then all of a sudden it just slams into the back of somebody's car so that's I mean that's an issue and it's I think that's just

Aaron Crow (40:12.925): Mm -hmm.

Kevin (40:19.372): These AI systems, they need to be fine -tuned to be able to see certain visual stimuli. And it's still not fine -tuned enough, I think, today for it to be safe. But hopefully someday it will be better. But yeah, they're still working on that. And it's still a risk. So I actually saw another issue where.

Kevin (40:48.844): So the brake assist, they showed all these different vehicles and they had a guy on a mock, it was just a dummy, a mock motorcycle and like 90 % of them just slammed straight into the back of the parked motorcycle. And so it's, I mean, they try to slow down a little bit, but it's things like that that need to be worked out with.

Kevin (41:17.740): with the AI machine learning on vehicles.

Aaron Crow (41:24.093): Yeah, I mean, not to mention that most of our cars now are keyless. So I put a, you know, I have a key fob in my pocket that's got some kind of RFID or something that's registered to the car. Um, but there's also a lot of things on YouTube, et cetera, that you can see in cars being stole left and right, because they have, they have tools that can, can figure out the codes, either they're capturing the codes when you click it, um, uh, or, or they're just trying multiple codes. Um, and that's how they're, they're stealing vehicles and these are brand new cars and not, they're not.

Aaron Crow (41:52.829): Old school days where they, you know, take a screwdriver and break your lock or break a window to get in your car. They're just doing it like the, the, the garage door openers of, of the nineties. And they're just using tools to get into your car, open it up, and then they drive it off with your car and you don't even register it as stolen. It thinks you're the right person.

Kevin (42:10.572): Yeah, so for those attacks, that's a relay attack, and I explained in that one that...

Kevin (42:28.044): Okay, so on the relay attack, what they do is that they get a component, a device that you can connect. It's messing me up here. I need to unplug it. Yeah. Yeah.

Aaron Crow (42:43.037): Just hang on, hang on a second, wait till it finishes and we go on.

Aaron Crow (42:49.053): It's all right, I'll cut it out. I'm just impressed you have a home phone, bro.

Kevin (42:57.644): Yeah, thing keeps won't stop ringing. But anyway, so what happens is that...

Aaron Crow (43:3.389): Alright, go ahead.

Transcript lightly edited for readability.