>> Okay. Good afternoon, everything. Welcome to my presentation. During this 20
minute presentation, I will try to prevent you ‑ ‑ present you some of the findings I have
discovered doing research. I will I will probably not get into detail since I only have 20
minutes. But don't hesitate to see me after the talk. As you will see, I have many focuses
on analyzing the mull mead ‑ ‑ multimedia, and this paper has been prepared with my colleague
and friend. He is currently playing a game, I will also be playing that game. That doesn't
matter. [ Laughter ] But last, but not least, I'm not a native English speaker. If there is
something that you do not hear, or understand me, please do not hesitate to interrupt me and I
will speak better. So today I will start by presenting myself, explaining who I am. And I will
try to explain why I decided to do some research about the firmware of the call. I will
then present the models on which I did my research and I will try to explain how to find the
firmware of the target, because it is not always easy. How to approach the firm ‑ ‑ firmware
on the card and what are my main findings. So my name is Paul. And my twitter name, and then I
will try to update and post my findings this week. Feel free to follow me. In my life I'm a
secure engineer for a Swiss company called SCRT. We are in Geneva and specializing in
digital hacking and forensics. My main hobbies are mountain bike, race and a fan of (
Indiscernible ), this is the reason why I decided to mix two of my hobbies. I teach security
and motto sports. I tried to do some research for IT security and mountain bike, but they were
not able to find a subject. Not yet. Because as you have seen the new forks now are
electronic. So maybe someday. Yeah. [ Laughter ] And we also are the organizers of the Swiss
security event. This is now the eighth edition. March 2015 in Geneva there is a conference.
You are more than welcome to join us. As I said before, the research was done by my friend.
You also follow him on twitter. So why I have decided to do some research on hacking firmware?
For nonprofit, of course. A lot of research has been done regarding DB and so on I wanted
to find something else, as you know, the car entertainment system is the music that can
play the music, that can do the navigation, that can connect to your phone, it is also do much
more than just entertainment. Most of the car entertainment system today can also control
the lights of the car, control the looking of the car, the heating system, the axillary
heating. A lot of options are possible to control using the car entertainment system. So it
sounds interesting. Then today I have discovered that a lot of cars have built in options like
‑ ‑ television, like blue tooth, like axillary heating that are just software activated. So it
sounds interesting. The main model on which I did my research is a Volkswagen, the second
version from 2011. Well, I live in Switzerland, I said before, I'm living at 2,007‑ meter high,
so I need a car that can drive in the snow. This is an interesting car, because it is
quite modern, and I'm able to do a lot of things with that unit. And last, but not least, this is
an important detail, this is my every day car. So not a car dedicated to my research. This
is very important to understand why later on. The multimedia unit of that car is called the
RNS800PC. You can find in other cars like Audi models the Q7, I'm not sure. And find the same
unit in Bentley cars, I'm sure. You find that in several, several brands. So the first
talk was to get access to the firmware of the car. So I have to find some sources. The first
way is the hard way and it consists of dismounting the car, find the disk, and do a DV of
the disk to get access to the firmware. The disk is located behind the box so it is not easy
to find and it takes some time to get access to the disk. So I discovered that's after breaking
the car. So ‑ ‑ now, we know where to find the disk. This is not the way I have chosen
initially. You have a second option. Which is to find it on eBay. The problem is I'm not
sure the disk would be solved with the unit. I was not sure if the disk of part of the car or
was part of the unit. This is not the option I have chosen. You can try to do some social
engineering on the, on the Volkswagen dealer you are working with. But again I have
not chosen this option. For some models I have discovered that firmware of the unit is, is
upgrade every time ( Indiscernible ). I did some tests on an Audi TT of 2008. In
that case it seeps that the firmware of the unit is included in the CD that you get to
upgrade the GPS, the map of the GPS. And the final option is just to use Google. If you
Google update firmware and the exact model and unit, it is quite easy to find someone to
sell you the firmware. Probably ‑ ‑ it is mechanical trying to sell it. Anyway, that works. So
that's how I did get access to the firmware. Then you have to find a way to upload the
firmware on the car. Again there is the possibility to ‑ ‑ thank you. [ Applause ] And that's the
recall. It is made in Switzerland. So you can try to ‑ ‑ [ Applause ] Okay. So again
you can try to improve the firmware by dismounting the disk, getting access to the disk
and pushing the firmware on the disk. And another solution that is easier includes finding the
magic. Most of the car you can find a special combination of key. And you hold the key for 3
to 5 seconds and get access to menu that will allow you to upload the firmware on the car.
[ Laughter ] [ Applause ] >> All right. Come on. >> Okay. >> He's not from this country. We're
healthy. [ Laughter ] Cheers. [ Applause ] >> Thank you. >> How is he doing, everybody? Is he
doing good? >> So in my case, you have to press prone and set it three to five seconds to get
access to the special menu. And I every day. So one year I tried to find the right combination to
get access to the menu. By the way, if you want to reboot the unit you need your five fingers
because you have to press phone, climate, navigation and traffic button at the same time. It is
very difficult when you are driving. Once you manage to get access to the menu. As you can
see on the screen, my car is in French, so it speaks French like me. You have access to a menu
you when you can upload the firmware and see the running binaries on the car. I don't
know if you can see that. But you see a lot of vulnerabilities there and a check for each one.
These are the binaries which are running on the car. You can see here that there are some
binaries, some programs that I should not have on my car. I can see WLAN. I can see T.V., or
things like that, I do not have those options on my car. Then if you navigate through the menu
and get access to the new menu, which is called upgrade, you can choose if you want to upgrade
the firmware from the CD, the DVD or the USB plug. There is also another option to approach
the firmware and modify the firmware which consists of using the software providing by vokes
weigh ‑ ‑ Volkswagen and the connector that I do not have. Okay. Once you have the
firmware. The interesting part. You can try to analyze the firmware. In my case, it is a
mix of EOS and IOS. So we used a system by it to modify the PSS tool to create to new system
which was readable. The script is provided in my, in my ‑ ‑ in my slides so that you can
reproduce file. And we deletes files to use for the IOS part. And slightly modify it
correctly. What you can see is that it firmware of the car is used on QNS. So RNS850 is bigger
than QNS. And we can see it and super H architecture. It sounds very interesting. So it is
clearly a UNIX‑ type system. This is the same thing that we used to extract the file from
the system. So the UNIX‑ type system. We can see it here with the files, everything that you
can find on the UNIX 5 system. What is more surprising that it is leaking a lot of interesting
information that I was not expecting to find on my car. For example, you can see that some
users are hardcoded in the car. You can see the name of the guy, and there is a shell on the
car. So I decided to do some more research and it is cool, because you can find the guy who
linked these. So it seems that those guys are working for the manufacturer of the car or some
company that has been subcontracted to, to write the ‑ ‑ [ Laughter ] Maybe not
anymore. Right? To, to right the firmware. But ‑ ‑ that's ‑ ‑ there are some other things that
are interesting. I think that leaking internal IP range is good practice, isn't it? As you
can see again in the firmware of the car, you can see the internal IP‑ range of Audi and
Volkswagen and yes. The car can do some Wi‑ Fi and SSID configured inside of the
firmware. So yeah. It looks like the person who developed this firmware are not very keen on IT
security. So I did some research and I tried to modify some files on the car and at first it
worked. So I was able to push some new files on the car and one day I tried to modify
another file, which was the preconfigured and and long story short I suddenly managed to
breach my car. Yeah. A very heavy breach. I don't know exactly why. Because ‑ ‑ I have
not been able to understand how the chips are calculating. It really happened, as I said
before, when I was trying to replace a very dummy text file. So somebody something wrong
happened just at that time. I don't know. It took three months to fix the car. It was really
long. Because during that time, the car was not working as expected and at first I bring
the car to a mechanic, they said sorry we do not understand what is happening. I had to send
it to a second CRH. They were not understanding either. So I told them, okay. A friend of
mine told me ‑ ‑ [ Laughter ] That the ‑ ‑ a friend of mine told me it could be the hard
drive of the car that needs to be replaced. And they answered, sorry. Sir, but there is no hard
drive in that car? [ Laughter ] Okay. So finally it took three months and they gave me back the
car and said we had to replace the black box of the car. So yeah. Exclusions. It is a very
expensive hobby. And my friend and his family does not want me to do tests with their car
anymore. It is a shame, because my car, my wife, has a very interesting car, but ‑ ‑ she do
not want me to approach the car with laptop anymore. [ Laughter ] So initially, my goal was to
do some research on the multimedia libraries of the car. I have been abled identify
libraries that are used the MP3 videos and things like that. It could be very, very interesting
to look more in‑ depth to those libraries to run a shell on the car. So I hope it was
interesting. If you have questions, you ‑ ‑ are free to speak to us. Thanks a lot. When
the car was break, it was simple to drive. It had no GPS, it was not simple to use loading. It
was not possible to turn on the light and turn off the light when I was arriving home. It was
not possible to control the heating of the car. Yeah. It was ‑ ‑ sorry? The windows
still work ‑ ‑ windows still worked. Yes. [ Laughter ] Yeah. That's what I should have done.
Find the hard drive first.