Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Hacking Electric Skateboards: Vehicle Research for Mortals

Hacking Electric Skateboards: Vehicle Research for Mortals

Presentation given with Mike Ryan at DEFCON 23

Richo Healey

August 08, 2015
Tweet

More Decks by Richo Healey

Other Decks in Technology

Transcript

  1. Hacking electric skateboards: vehicle research for mortals Richo Healey &

    Mike Ryan
  2. @mpeg4codec / Hacking Electric Skateboards / @rich0H Who are these

    jerks anyway ‣ richo ‣ Computer Jerk ‣ @rich0H ‣ Duck Enthusiast ‣ Ran WrongIslandCon ‣ mike ‣ Bluetooth Guy ‣ @mpeg4codec ‣ Owner/Operator of conscience (sometimes)
  3. @mpeg4codec / Hacking Electric Skateboards / @rich0H Why buy an

    $nK skateboard? ‣ Lightweight ‣ (relatively) inexpensive ‣ .. maybe wanted on the hype train early
  4. @mpeg4codec / Hacking Electric Skateboards / @rich0H ‣ Lightweight ‣

    (relatively) inexpensive ‣ .. maybe wanted on the hype train early ‣ Maybe to hax it Why buy an $nK skateboard?
  5. @mpeg4codec / Hacking Electric Skateboards / @rich0H Why hax a

    $1k skateboard? ‣ Because it’s there mostly ‣ But also other reasons
  6. @mpeg4codec / Hacking Electric Skateboards / @rich0H The boards ‣

    Boosted
  7. @mpeg4codec / Hacking Electric Skateboards / @rich0H ‣ Evolve The

    boards
  8. @mpeg4codec / Hacking Electric Skateboards / @rich0H ‣ Yuneec E-go

    The boards
  9. @mpeg4codec / Hacking Electric Skateboards / @rich0H Maybe you’ve spotted

    the design trend here
  10. @mpeg4codec / Hacking Electric Skateboards / @rich0H Boosted

  11. @mpeg4codec / Hacking Electric Skateboards / @rich0H Storytime

  12. CVE-2015-2247 As far as we know, the only CVE for

    a skateboard
  13. @mpeg4codec / Hacking Electric Skateboards / @rich0H Or whatever Right

    so like hacking ‣ Most of these boards use bluetooth ‣ richo knows nothing of bluetooth ‣ richo knows mike though ‣ mike knows bluetooth ‣ How hard can this possibly be?
  14. Co-opting a GATTling gun Bluetooth and You ‣ Bought some

    uberteeth ‣ Looked at some packets ‣ Now what?
  15. Bluetooth and You ‣ Modern bluetooth supports some crypto ‣

    Using it would have made our lives annoying ‣ No crypto though ‣ Go team!
  16. A clever pun about gatt GATT ‣ Handle-wise communication ‣

    Supports either request-response or datagram alike ‣ Sits on BLE
  17. Looks like dis

  18. … many beers later painstakingly reversed with love ‣ Simple

    Duplex protocol ‣ Controller sends on handle 0x1a ‣ Reads on handle 0x1c ‣ Basically a bluetooth -> serial adaptor
  19. Message Direction Meaning RC0 Remote -> Board Speed control FUEL

    Remote -> Board Fetch current battery load REXP Remote -> Board Set expert mode RBGN Remote -> Board Set beginner mode GAUGE[1-5] Board -> Remote Inform current battery load … many beers later painstakingly reversed with love
  20. but how 2 talking? We know its language ‣ Bluetooth

    comms turn out to be sorta miserable ‣ Especially for general purpose applications ‣ x10000 for ad-hoc, general purpose applications
  21. The old school ‣ Ubertooth ‣ “minimal” ‣ BlueZ ‣

    Full featured, but heavy ‣ Not super fond of doing obviously broken things ‣ (Like fuzzing embedded devices)
  22. @mpeg4codec / Hacking Electric Skateboards / @rich0H Welcome to the

    new school PyBT ‣ Userland bluetooth stack implemented in Python ‣ Backs onto scapy for actually talking to the wire ‣ Uses HCI_CHANNEL_USER ‣ Prototyping++
  23. Now what Neat we can spin the wheels ‣ Need

    to be connected to the board to exploit ‣ Only one thing can be connected at a time ‣ Thinking back to that intersection ‣ richo demonstrates again that he has no idea: ‣ “How hard can jamming bluetooth be?”
  24. Super hard, it turns out Jamming bluetooth: ‣ Naive approach:

    ‣ Yell really loud ‣ Noone can hear anything ‣ ?????? ‣ Profit…..?
  25. None
  26. Super hard, it turns out Jamming bluetooth:

  27. Jamming bluetooth: Super hard, it turns out

  28. ‣ It’s like they designed the protocol itself to stop

    us from doing this exact thing ‣ By this point richo is no longer allowed to make suggestions Jamming bluetooth: Seriously like crazy difficult
  29. ‣ Bluetooth’s channel hopping stops us from jamming effectively ‣

    Channel hopping is deterministic ‣ Need some state- Gotta capture: ‣ Access address ‣ Hop interval ‣ Hop increment Jamming bluetooth: Seriously like crazy difficult
  30. Will be upstreamed: https://github.com/greatscottgadgets/ubertooth Jamming bluetooth: Seriously like crazy difficult

  31. Time to launch some jerks Demo Time! ‣ The plan:

    ‣ Setup a bunch of jammers ‣ Configure our repl to connect and autoreverse throttle ‣ Wait for hapless skateboarder ‣ Jam ‣ Connect ‣ Reverse ‣ ????? ‣ Launch some jerk
  32. Demo Time! Time to launch some jerks

  33. Not just for shooting at Drones

  34. Oops

  35. Boosted Response: Pretty Awesome Followup ‣ Reported to Boosted before

    Kiwicon last year ‣ Shaky start ‣ Wound up working with us ‣ Implemented a fix! ‣ Available for download soon
  36. @mpeg4codec / Hacking Electric Skateboards / @rich0H Evolve

  37. @mpeg4codec / Hacking Electric Skateboards / @rich0H ‣ Better range

    than boosted ‣ Janky looking remote ‣ Made of carbon though? ‣ So that’s neat I guess ‣ ¯\_(ツ)_/¯ Evolve
  38. @mpeg4codec / Hacking Electric Skateboards / @rich0H Evolution ‣ It

    says bluetooth right there on the tin ‣ We’re crazy cocky at this point ‣ “We oughta have this done by lunch”
  39. @mpeg4codec / Hacking Electric Skateboards / @rich0H ‣ Pull out

    the harness we used on Boosted Evolution
  40. @mpeg4codec / Hacking Electric Skateboards / @rich0H ‣ No packets

    this time :( ‣ Considered that our environment is too noisy ‣ The moratorium on richo giving advice has expired by this point ‣ “We’ll build a faraday cage!” Evolution
  41. @mpeg4codec / Hacking Electric Skateboards / @rich0H Evolution

  42. @mpeg4codec / Hacking Electric Skateboards / @rich0H ‣ merijn very

    kindly lent us his skateboard ‣ We should probably pull it to pieces and look at it ‣ Unclear if we ever mentioned that we were going to do this or that we did
 ‣ (Hi Merijn btw we pulled apart your skateboard) Evolution
  43. @mpeg4codec / Hacking Electric Skateboards / @rich0H ‣ Pulled the

    remote apart ‣ Looked up the rf part ‣ er, this is not a bluetooth chip ‣ Neither of us have even heard of this thing ‣ nRF24LE Evolution
  44. @mpeg4codec / Hacking Electric Skateboards / @rich0H Bluetoof?

  45. @mpeg4codec / Hacking Electric Skateboards / @rich0H Bluetoof?

  46. @mpeg4codec / Hacking Electric Skateboards / @rich0H Bluetoof?

  47. @mpeg4codec / Hacking Electric Skateboards / @rich0H Bluetoof?

  48. @mpeg4codec / Hacking Electric Skateboards / @rich0H ‣ Talks PowerThirst™

    Evolution
  49. @mpeg4codec / Hacking Electric Skateboards / @rich0H

  50. @mpeg4codec / Hacking Electric Skateboards / @rich0H

  51. @mpeg4codec / Hacking Electric Skateboards / @rich0H ‣ Er, ShockBurst™

    Evolution
  52. @mpeg4codec / Hacking Electric Skateboards / @rich0H ‣ No obvious

    path to glory ‣ No hackRF at my place ‣ Can’t fiddle with its radio today ‣ Let’s just dump traffic directly ‣ Hey didn’t I impulse buy a saleae a while ago? Evolution
  53. @mpeg4codec / Hacking Electric Skateboards / @rich0H Evolution

  54. @mpeg4codec / Hacking Electric Skateboards / @rich0H ‣ Dumped everything

    ‣ Nothing terribly interesting looking ‣ ¯\_(ツ)_/¯ Evolution
  55. @mpeg4codec / Hacking Electric Skateboards / @rich0H ‣ WTF is

    this thing? ‣ Antennae? ‣ Way too big for 2.4ghz Evolution
  56. @mpeg4codec / Hacking Electric Skateboards / @rich0H ‣ No dice

    on the remote ‣ Let’s fiddle with the board instead!
 ‣ (Hi Merijn) Evolution
  57. @mpeg4codec / Hacking Electric Skateboards / @rich0H ‣ Cramped AF

    ‣ Traced most of it out though ‣ Off the shelf parts ‣ Explained a bunch of hilarious bugs Evolution
  58. @mpeg4codec / Hacking Electric Skateboards / @rich0H ‣ ShockBurst is

    simplex ‣ Hence no data to the remote ‣ Not especially complex ‣ Does have a 9 member bitfield though to make our lives miserable ‣ Less tolerant to interference than BT Evolution
  59. @mpeg4codec / Hacking Electric Skateboards / @rich0H Blackbox wireless protocols

    ‣ Used richo’s doppleganger’s The Next Hope badge
  60. @mpeg4codec / Hacking Electric Skateboards / @rich0H ‣ Workable jamming

    attack ‣ Sadly not much else to do here ‣ Outside of “Attacker has physical access” scenarios there’s not much to attack Evolution
  61. @mpeg4codec / Hacking Electric Skateboards / @rich0H E-go

  62. @mpeg4codec / Hacking Electric Skateboards / @rich0H Taming a wild

    ego ‣ Says bluetooth all over it ‣ Has a smartphone app ‣ Has to be bluetooth right?
  63. @mpeg4codec / Hacking Electric Skateboards / @rich0H ‣ Sniffed a

    lot of bluetooth ‣ No packets again ‣ WTF? Taming a wild ego
  64. @mpeg4codec / Hacking Electric Skateboards / @rich0H ‣ WTF is

    this switch on the side? ‣ BT|WIFI ‣ wat Taming a wild ego
  65. @mpeg4codec / Hacking Electric Skateboards / @rich0H So this smartphone

    business ‣ Looked at the smartphone app ‣ Didn’t find a whole lot ‣ iPhone bluetooth is hard to jam ‣ Hard to believe that right thinking people will use the phone interface anyway Taming a wild ego
  66. @mpeg4codec / Hacking Electric Skateboards / @rich0H ‣ Yup this

    damn thing talks bluetooth *and* their own yolo thing ‣ Paired with a phone it’s bluetooth ‣ Paired with the remote it’s ~a mystery~ Taming a wild ego
  67. guts

  68. The doctor is in Diagnosing wireless comms

  69. @mpeg4codec / Hacking Electric Skateboards / @rich0H

  70. @mpeg4codec / Hacking Electric Skateboards / @rich0H

  71. None
  72. @mpeg4codec / Hacking Electric Skateboards / @rich0H

  73. @mpeg4codec / Hacking Electric Skateboards / @rich0H

  74. Hop Interval Taming a wild ego

  75. ‣ Yolo channel hopping algo ‣ Reimplemented the same ideas

    we used on boosted ‣ Runs on ubertooth ‣ Also upstreamed! ‣ github.com/greatscottgadgets/ubertooth Taming a wild ego
  76. @mpeg4codec / Hacking Electric Skateboards / @rich0H

  77. ‣ Same kind of issues as evolve ‣ Very little

    attack surface So this Controller business Taming a wild ego
  78. @mpeg4codec / Hacking Electric Skateboards / @rich0H Demo: jamming ego

  79. @mpeg4codec / Hacking Electric Skateboards / @rich0H Boosted: Redux

  80. Persistence Remote code execution on a skateboard, you say? ‣

    From pulling the board apart we knew it was a pic24f ‣ Didn’t have much luck initially trying to find debug ports on the skateboard ‣ Later discovered that we missed them ‣ A few months later though, this happens:
  81. Persistence Remote code execution on a skateboard, you say?

  82. Persistence Remote code execution on a skateboard, you say?

  83. Persistence Remote code execution on a skateboard, you say?

  84. ‣ Has a firmware update facility ‣ This oughta be

    good ‣ Upgrade one of our boards ‣ Dump bluetooth traffic with jailbroken iThing ‣ Dump https traffic with burp ‣ Both sides of the conversation, hopefully we learn how to upload + format firmware Persistence Remote code execution on a skateboard, you say?
  85. ‣ many hours later we’ve stitched a firmware blob together

    out of the dumps ‣ Strings are encoded as, eg: ‣ “FU\x00\x00EL” => “FUEL” ‣ Write a dumb python script to strip nulls, strings(1) to the rescue ‣ Learn about a bunch of new commands! Persistence Remote code execution on a skateboard, you say?
  86. … many many beers later Message Direction Meaning RC0 Remote

    -> Board Speed control FUEL Remote -> Board Fetch current battery load REXP Remote -> Board Set expert mode RBGN Remote -> Board Set beginner mode GAUGE[1-5] Board -> Remote Inform current battery load PING Remote -> Board Fetch version information GIT Remote -> Board Fetch git revision of firmware STAT Remote -> Board Fetch detailed diagnostic info NUMSKL Remote -> Board Number of skill settings ODO Remote -> Board Fetch current odometer reading SOC Remote -> Board Fetch fine grained battery info painstakingly reversed with love
  87. Persistence RCE on a skateboard, you say? ‣ With this

    in hand, richo writes a repl for boosted boards ‣ Nico works out how to unbrick a skateboard when we inevitably screw this up ‣ https://github.com/richo/skateboard/blob/master/ boosted_repl.py
  88. Persistence RCE on a skateboard, you say? ‣ Finally, it’s

    time to reverse the transfer protocol ‣ Winds up like intel .hex over bluetooth Length Address Flags Data Checksum
  89. Persistence RCE on a skateboard, you say? ‣ Becomes:

  90. … many many beers Message Direction Meaning BTLD Remote ->

    Board Begin firmware blob BBLC Remote -> Board Fetch current firmware region BBLR Board -> Remote Carries current region S_END Either End binary dump painstakingly reversed with love
  91. Persistence RCE on a skateboard, you say? ‣ What do

    you even *do* with code execution on a skateboard? ‣ Could probably make the board dangerous to its rider ‣ Mostly wanted to be able to own my own hardware
  92. In which we make a $2k paperweight Fail :( ‣

    Sadly, our experiments here didn’t end well ‣ The board we flashed remotely proceeded to hard fail days later
  93. Further Work

  94. These jerks are alright Gr33tz and Th4nx ‣ nico, who

    showed up at the last second and helped us hax firmware, is an Arduino Uno expert ‣ merijn for lending us his evolve despite it obviously being a Bad Idea ‣ Jared Boone for helping us SDR at the 11th hour ‣ @safehex who bought the e-go at the auction ‣ Boosted ‣ Evolve ‣ Yuneec
  95. Resources ‣ github.com/mikeryan/PyBT ‣ github.com/richo/skateboard ‣ github.com/greatscottgadgets/ubertooth ‣ We’ll tweet

    the links to these slides ‣ @rich0H ‣ @mpeg4codec