Hacking Electric Skateboards: Vehicle Research for Mortals

Hacking Electric Skateboards: Vehicle Research for Mortals

Presentation given with Mike Ryan at DEFCON 23

1cdddd72590e862319c7f484ecd85a1e?s=128

Richo Healey

August 08, 2015
Tweet

Transcript

  1. Hacking electric skateboards: vehicle research for mortals Richo Healey &

    Mike Ryan
  2. @mpeg4codec / Hacking Electric Skateboards / @rich0H Who are these

    jerks anyway ‣ richo ‣ Computer Jerk ‣ @rich0H ‣ Duck Enthusiast ‣ Ran WrongIslandCon ‣ mike ‣ Bluetooth Guy ‣ @mpeg4codec ‣ Owner/Operator of conscience (sometimes)
  3. @mpeg4codec / Hacking Electric Skateboards / @rich0H Why buy an

    $nK skateboard? ‣ Lightweight ‣ (relatively) inexpensive ‣ .. maybe wanted on the hype train early
  4. @mpeg4codec / Hacking Electric Skateboards / @rich0H ‣ Lightweight ‣

    (relatively) inexpensive ‣ .. maybe wanted on the hype train early ‣ Maybe to hax it Why buy an $nK skateboard?
  5. @mpeg4codec / Hacking Electric Skateboards / @rich0H Why hax a

    $1k skateboard? ‣ Because it’s there mostly ‣ But also other reasons
  6. @mpeg4codec / Hacking Electric Skateboards / @rich0H The boards ‣

    Boosted
  7. @mpeg4codec / Hacking Electric Skateboards / @rich0H ‣ Evolve The

    boards
  8. @mpeg4codec / Hacking Electric Skateboards / @rich0H ‣ Yuneec E-go

    The boards
  9. @mpeg4codec / Hacking Electric Skateboards / @rich0H Maybe you’ve spotted

    the design trend here
  10. @mpeg4codec / Hacking Electric Skateboards / @rich0H Boosted

  11. @mpeg4codec / Hacking Electric Skateboards / @rich0H Storytime

  12. CVE-2015-2247 As far as we know, the only CVE for

    a skateboard
  13. @mpeg4codec / Hacking Electric Skateboards / @rich0H Or whatever Right

    so like hacking ‣ Most of these boards use bluetooth ‣ richo knows nothing of bluetooth ‣ richo knows mike though ‣ mike knows bluetooth ‣ How hard can this possibly be?
  14. Co-opting a GATTling gun Bluetooth and You ‣ Bought some

    uberteeth ‣ Looked at some packets ‣ Now what?
  15. Bluetooth and You ‣ Modern bluetooth supports some crypto ‣

    Using it would have made our lives annoying ‣ No crypto though ‣ Go team!
  16. A clever pun about gatt GATT ‣ Handle-wise communication ‣

    Supports either request-response or datagram alike ‣ Sits on BLE
  17. Looks like dis

  18. … many beers later painstakingly reversed with love ‣ Simple

    Duplex protocol ‣ Controller sends on handle 0x1a ‣ Reads on handle 0x1c ‣ Basically a bluetooth -> serial adaptor
  19. Message Direction Meaning RC0 Remote -> Board Speed control FUEL

    Remote -> Board Fetch current battery load REXP Remote -> Board Set expert mode RBGN Remote -> Board Set beginner mode GAUGE[1-5] Board -> Remote Inform current battery load … many beers later painstakingly reversed with love
  20. but how 2 talking? We know its language ‣ Bluetooth

    comms turn out to be sorta miserable ‣ Especially for general purpose applications ‣ x10000 for ad-hoc, general purpose applications
  21. The old school ‣ Ubertooth ‣ “minimal” ‣ BlueZ ‣

    Full featured, but heavy ‣ Not super fond of doing obviously broken things ‣ (Like fuzzing embedded devices)
  22. @mpeg4codec / Hacking Electric Skateboards / @rich0H Welcome to the

    new school PyBT ‣ Userland bluetooth stack implemented in Python ‣ Backs onto scapy for actually talking to the wire ‣ Uses HCI_CHANNEL_USER ‣ Prototyping++
  23. Now what Neat we can spin the wheels ‣ Need

    to be connected to the board to exploit ‣ Only one thing can be connected at a time ‣ Thinking back to that intersection ‣ richo demonstrates again that he has no idea: ‣ “How hard can jamming bluetooth be?”
  24. Super hard, it turns out Jamming bluetooth: ‣ Naive approach:

    ‣ Yell really loud ‣ Noone can hear anything ‣ ?????? ‣ Profit…..?
  25. None
  26. Super hard, it turns out Jamming bluetooth:

  27. Jamming bluetooth: Super hard, it turns out

  28. ‣ It’s like they designed the protocol itself to stop

    us from doing this exact thing ‣ By this point richo is no longer allowed to make suggestions Jamming bluetooth: Seriously like crazy difficult
  29. ‣ Bluetooth’s channel hopping stops us from jamming effectively ‣

    Channel hopping is deterministic ‣ Need some state- Gotta capture: ‣ Access address ‣ Hop interval ‣ Hop increment Jamming bluetooth: Seriously like crazy difficult
  30. Will be upstreamed: https://github.com/greatscottgadgets/ubertooth Jamming bluetooth: Seriously like crazy difficult

  31. Time to launch some jerks Demo Time! ‣ The plan:

    ‣ Setup a bunch of jammers ‣ Configure our repl to connect and autoreverse throttle ‣ Wait for hapless skateboarder ‣ Jam ‣ Connect ‣ Reverse ‣ ????? ‣ Launch some jerk
  32. Demo Time! Time to launch some jerks

  33. Not just for shooting at Drones

  34. Oops

  35. Boosted Response: Pretty Awesome Followup ‣ Reported to Boosted before

    Kiwicon last year ‣ Shaky start ‣ Wound up working with us ‣ Implemented a fix! ‣ Available for download soon
  36. @mpeg4codec / Hacking Electric Skateboards / @rich0H Evolve

  37. @mpeg4codec / Hacking Electric Skateboards / @rich0H ‣ Better range

    than boosted ‣ Janky looking remote ‣ Made of carbon though? ‣ So that’s neat I guess ‣ ¯\_(ツ)_/¯ Evolve
  38. @mpeg4codec / Hacking Electric Skateboards / @rich0H Evolution ‣ It

    says bluetooth right there on the tin ‣ We’re crazy cocky at this point ‣ “We oughta have this done by lunch”
  39. @mpeg4codec / Hacking Electric Skateboards / @rich0H ‣ Pull out

    the harness we used on Boosted Evolution
  40. @mpeg4codec / Hacking Electric Skateboards / @rich0H ‣ No packets

    this time :( ‣ Considered that our environment is too noisy ‣ The moratorium on richo giving advice has expired by this point ‣ “We’ll build a faraday cage!” Evolution
  41. @mpeg4codec / Hacking Electric Skateboards / @rich0H Evolution

  42. @mpeg4codec / Hacking Electric Skateboards / @rich0H ‣ merijn very

    kindly lent us his skateboard ‣ We should probably pull it to pieces and look at it ‣ Unclear if we ever mentioned that we were going to do this or that we did
 ‣ (Hi Merijn btw we pulled apart your skateboard) Evolution
  43. @mpeg4codec / Hacking Electric Skateboards / @rich0H ‣ Pulled the

    remote apart ‣ Looked up the rf part ‣ er, this is not a bluetooth chip ‣ Neither of us have even heard of this thing ‣ nRF24LE Evolution
  44. @mpeg4codec / Hacking Electric Skateboards / @rich0H Bluetoof?

  45. @mpeg4codec / Hacking Electric Skateboards / @rich0H Bluetoof?

  46. @mpeg4codec / Hacking Electric Skateboards / @rich0H Bluetoof?

  47. @mpeg4codec / Hacking Electric Skateboards / @rich0H Bluetoof?

  48. @mpeg4codec / Hacking Electric Skateboards / @rich0H ‣ Talks PowerThirst™

    Evolution
  49. @mpeg4codec / Hacking Electric Skateboards / @rich0H

  50. @mpeg4codec / Hacking Electric Skateboards / @rich0H

  51. @mpeg4codec / Hacking Electric Skateboards / @rich0H ‣ Er, ShockBurst™

    Evolution
  52. @mpeg4codec / Hacking Electric Skateboards / @rich0H ‣ No obvious

    path to glory ‣ No hackRF at my place ‣ Can’t fiddle with its radio today ‣ Let’s just dump traffic directly ‣ Hey didn’t I impulse buy a saleae a while ago? Evolution
  53. @mpeg4codec / Hacking Electric Skateboards / @rich0H Evolution

  54. @mpeg4codec / Hacking Electric Skateboards / @rich0H ‣ Dumped everything

    ‣ Nothing terribly interesting looking ‣ ¯\_(ツ)_/¯ Evolution
  55. @mpeg4codec / Hacking Electric Skateboards / @rich0H ‣ WTF is

    this thing? ‣ Antennae? ‣ Way too big for 2.4ghz Evolution
  56. @mpeg4codec / Hacking Electric Skateboards / @rich0H ‣ No dice

    on the remote ‣ Let’s fiddle with the board instead!
 ‣ (Hi Merijn) Evolution
  57. @mpeg4codec / Hacking Electric Skateboards / @rich0H ‣ Cramped AF

    ‣ Traced most of it out though ‣ Off the shelf parts ‣ Explained a bunch of hilarious bugs Evolution
  58. @mpeg4codec / Hacking Electric Skateboards / @rich0H ‣ ShockBurst is

    simplex ‣ Hence no data to the remote ‣ Not especially complex ‣ Does have a 9 member bitfield though to make our lives miserable ‣ Less tolerant to interference than BT Evolution
  59. @mpeg4codec / Hacking Electric Skateboards / @rich0H Blackbox wireless protocols

    ‣ Used richo’s doppleganger’s The Next Hope badge
  60. @mpeg4codec / Hacking Electric Skateboards / @rich0H ‣ Workable jamming

    attack ‣ Sadly not much else to do here ‣ Outside of “Attacker has physical access” scenarios there’s not much to attack Evolution
  61. @mpeg4codec / Hacking Electric Skateboards / @rich0H E-go

  62. @mpeg4codec / Hacking Electric Skateboards / @rich0H Taming a wild

    ego ‣ Says bluetooth all over it ‣ Has a smartphone app ‣ Has to be bluetooth right?
  63. @mpeg4codec / Hacking Electric Skateboards / @rich0H ‣ Sniffed a

    lot of bluetooth ‣ No packets again ‣ WTF? Taming a wild ego
  64. @mpeg4codec / Hacking Electric Skateboards / @rich0H ‣ WTF is

    this switch on the side? ‣ BT|WIFI ‣ wat Taming a wild ego
  65. @mpeg4codec / Hacking Electric Skateboards / @rich0H So this smartphone

    business ‣ Looked at the smartphone app ‣ Didn’t find a whole lot ‣ iPhone bluetooth is hard to jam ‣ Hard to believe that right thinking people will use the phone interface anyway Taming a wild ego
  66. @mpeg4codec / Hacking Electric Skateboards / @rich0H ‣ Yup this

    damn thing talks bluetooth *and* their own yolo thing ‣ Paired with a phone it’s bluetooth ‣ Paired with the remote it’s ~a mystery~ Taming a wild ego
  67. guts

  68. The doctor is in Diagnosing wireless comms

  69. @mpeg4codec / Hacking Electric Skateboards / @rich0H

  70. @mpeg4codec / Hacking Electric Skateboards / @rich0H

  71. None
  72. @mpeg4codec / Hacking Electric Skateboards / @rich0H

  73. @mpeg4codec / Hacking Electric Skateboards / @rich0H

  74. Hop Interval Taming a wild ego

  75. ‣ Yolo channel hopping algo ‣ Reimplemented the same ideas

    we used on boosted ‣ Runs on ubertooth ‣ Also upstreamed! ‣ github.com/greatscottgadgets/ubertooth Taming a wild ego
  76. @mpeg4codec / Hacking Electric Skateboards / @rich0H

  77. ‣ Same kind of issues as evolve ‣ Very little

    attack surface So this Controller business Taming a wild ego
  78. @mpeg4codec / Hacking Electric Skateboards / @rich0H Demo: jamming ego

  79. @mpeg4codec / Hacking Electric Skateboards / @rich0H Boosted: Redux

  80. Persistence Remote code execution on a skateboard, you say? ‣

    From pulling the board apart we knew it was a pic24f ‣ Didn’t have much luck initially trying to find debug ports on the skateboard ‣ Later discovered that we missed them ‣ A few months later though, this happens:
  81. Persistence Remote code execution on a skateboard, you say?

  82. Persistence Remote code execution on a skateboard, you say?

  83. Persistence Remote code execution on a skateboard, you say?

  84. ‣ Has a firmware update facility ‣ This oughta be

    good ‣ Upgrade one of our boards ‣ Dump bluetooth traffic with jailbroken iThing ‣ Dump https traffic with burp ‣ Both sides of the conversation, hopefully we learn how to upload + format firmware Persistence Remote code execution on a skateboard, you say?
  85. ‣ many hours later we’ve stitched a firmware blob together

    out of the dumps ‣ Strings are encoded as, eg: ‣ “FU\x00\x00EL” => “FUEL” ‣ Write a dumb python script to strip nulls, strings(1) to the rescue ‣ Learn about a bunch of new commands! Persistence Remote code execution on a skateboard, you say?
  86. … many many beers later Message Direction Meaning RC0 Remote

    -> Board Speed control FUEL Remote -> Board Fetch current battery load REXP Remote -> Board Set expert mode RBGN Remote -> Board Set beginner mode GAUGE[1-5] Board -> Remote Inform current battery load PING Remote -> Board Fetch version information GIT Remote -> Board Fetch git revision of firmware STAT Remote -> Board Fetch detailed diagnostic info NUMSKL Remote -> Board Number of skill settings ODO Remote -> Board Fetch current odometer reading SOC Remote -> Board Fetch fine grained battery info painstakingly reversed with love
  87. Persistence RCE on a skateboard, you say? ‣ With this

    in hand, richo writes a repl for boosted boards ‣ Nico works out how to unbrick a skateboard when we inevitably screw this up ‣ https://github.com/richo/skateboard/blob/master/ boosted_repl.py
  88. Persistence RCE on a skateboard, you say? ‣ Finally, it’s

    time to reverse the transfer protocol ‣ Winds up like intel .hex over bluetooth Length Address Flags Data Checksum
  89. Persistence RCE on a skateboard, you say? ‣ Becomes:

  90. … many many beers Message Direction Meaning BTLD Remote ->

    Board Begin firmware blob BBLC Remote -> Board Fetch current firmware region BBLR Board -> Remote Carries current region S_END Either End binary dump painstakingly reversed with love
  91. Persistence RCE on a skateboard, you say? ‣ What do

    you even *do* with code execution on a skateboard? ‣ Could probably make the board dangerous to its rider ‣ Mostly wanted to be able to own my own hardware
  92. In which we make a $2k paperweight Fail :( ‣

    Sadly, our experiments here didn’t end well ‣ The board we flashed remotely proceeded to hard fail days later
  93. Further Work

  94. These jerks are alright Gr33tz and Th4nx ‣ nico, who

    showed up at the last second and helped us hax firmware, is an Arduino Uno expert ‣ merijn for lending us his evolve despite it obviously being a Bad Idea ‣ Jared Boone for helping us SDR at the 11th hour ‣ @safehex who bought the e-go at the auction ‣ Boosted ‣ Evolve ‣ Yuneec
  95. Resources ‣ github.com/mikeryan/PyBT ‣ github.com/richo/skateboard ‣ github.com/greatscottgadgets/ubertooth ‣ We’ll tweet

    the links to these slides ‣ @rich0H ‣ @mpeg4codec