VEHICLE FORENSICS. Infotainment & Telematics Systems. Berla Corporation Copyright 2015 by Berla. All Rights Reserved.

Size: px

Start display at page:

Jonathan Logan
6 years ago
Views:

1 VEHICLE FORENSICS Infotainment & Telematics Systems Berla Corporation 2015

2 WELCOME Company Overview Infotainment & Telematics Systems Overview of Potentially Acquirable Data ive Software/Hardware

3 ABOUT ME Lifelong car enthusiast Degree in Journalism Degree in Digital Forensics In field for about 4 years

commercial products and provide training Conduct automotive cyber

4 ABOUT BERLA Located in the Washington DC area Serving the global digital forensics/accident recon/insurance fraud communities Develop commercial products and provide training Conduct automotive cyber security research Provide research and development services for US Government

5 BERLA S HISTORY

6 FACILITY 14,000 sq ft building General/Admin offices Training room Development space Manufacturing area Hardware research lab

7 WHY? Almost every crime involves a vehicle Department of Justice statistics from 2013 reveal:

8 WHY? Almost every crime involves a digital element Integration of user s devices into connected vehicle systems Analyzing user data is essential

9 REACTIVE & PROACTIVE APPROACHES Forensics Reactive Forensically extract and examine relevant data stored within vehicle infotainment and telematics systems Focus on user data and vehicle events User data from connected devices User data from navigation input Vehicle events logged from telematics system Auto Cyber Security Proactive Conduct vulnerability assessments on vehicles from a wired and wireless perspective Focus on Attack Vectors related to the infotainment and telematics systems Firmware Updates WiFi GSM Bluetooth

10 WHY AUTO CYBER SECURITY? OEM s (Original Equipment manufacturers) didn t focus on creating a secure product because they didn t see the need Infotainment systems are the #1 complaint of consumers a working product took priority over a secure one Charlie Miller & Chris Valasek slapped the world with a wake-up call Both OEM s and consumers need to be aware of possible threats and react accordingly

11 TRAINING Vehicle Forensics & ive Certification (4 days) Automotive Cyber Security (5 days)

12 PRODUCTS - BLACKTHORN GPS Forensics Acquisition Analysis Reporting Supports GPS Devices Aviation Automotive Maritime Handheld Devices

Buick, Cadillac, Chevrolet, Chrysler, Dodge, Fiat, Ford, GMC Hummer, Jeep,

13 PRODUCTS - IVE Vehicle Forensics Infotainment & Telematics Systems Logical and Physical Acquisitions Non-Destructive Methods 4,300+ Vehicle Models BMW, Buick, Cadillac, Chevrolet, Chrysler, Dodge, Fiat, Ford, GMC Hummer, Jeep, Lincoln, Maserati, Mercury, Pontiac, Ram, SRT, Saturn, Seat, Skoda, Toyota and VW.

14 INFOTAINMENT & TELEMATICS

15 INFOTAINMENT Information + entertainment Connects the occupants to their digital world. Provides information on vehicle performance, scheduled maintenance, and current status. Generally interacts directly with occupants and is main focal point.

16 TELEMATICS Connected Cars are Wireless Network Enabled Vehicles The integration of telecommunications and information Usually Vehicle to Infrastructure (V2I) or Vehicle to Vehicle (V2V) Facilitates requests to/from infotainment system

17 VIDEO INFOTAINMENT & TELEMATICS Video by CNET Does a good job of illustrating what concepts we just discussed Note this video is a bit older. Notice what features were planned at the time of this video and which of those features have been successfully implemented

18 INFOTAINMENT & TELEMATICS TODAY

19 OFFENSIVE PERSPECTIVE

20 CONNECTED CAR MARKET

21 1600 MARKET BY MANUFACTURER: Infotainment Navigation Telematics

22 CONNECTED CAR MARKET

23 MANUFACTURER ROLL UP The major manufacturers or OEMs make technology decisions for their subsidiaries. e.g. GM dictates what infotainment and telematics systems are used in Chevrolet, Cadillac, Buick, GMC, Hummer, and Holden. These systems will have similar underlying technology but are have slight enough differences to make them unique. have slightly varying names. For example, Chevrolet, GMC, and Holden use MyLink while Buick uses IntelliLink and Cadillac uses CUE.

24 BEYOND 2015 Connected Cars bring together technology from smart phones, social media, web browsers, Cloud storage, , chat, and p2p sharing (just to name a few). Essentially a computer on wheels All into a single integrated-connected-highly-mobile environment

25 USER DATA

26 COMMUNICATIONS Average vehicle has close to 70 Electronic Control Units (ECUs). They communication over several closed networks mainly called the CANBus. Three primary CANBus networks High Speed Mid Speed Infotainment

27 GENERAL INFO & APP DATA Vehicle Serial Number Part Number Original VIN Number Build Number Installed Applications Weather Traffic Facebook Twitter Media Files Audio Video Images

28 DEVICE DATA Connections Bluetooth Wireless Devices Phones Calls Contacts SMS Audio Video Images Media Players USB Drives SD Cards

29 BLUETOOTH CONNECTIONS Connections Bluetooth Wireless Devices Phones Calls Contacts SMS Audio Video Images Media Players USB Drives SD Cards

30 WIRELESS CONNECTIONS Connections Bluetooth Wireless Devices Phones Calls Contacts SMS Audio Video Images Media Players USB Drives SD Cards

31 DEVICE CALL LOGS Connections Bluetooth Wireless Devices Phones Calls Contacts SMS Audio Video Images Media Players USB Drives SD Cards

32 DEVICE CONTACTS Connections Bluetooth Wireless Devices Phones Calls Contacts SMS Audio Video Images Media Players USB Drives SD Cards

33 DEVICE SMS Connections Bluetooth Wireless Devices Phones Calls Contacts SMS Audio Video Images Media Players USB Drives SD Cards

34 EVENTS Navigation Data Trackpoints Locations Saved Previous Routes Active Inactive Events Doors Opening/Closing Lights On/Off Bluetooth Devices USB devices attached GPS Time updated

35 EVENTS - DOORS Navigation Data Trackpoints Locations Saved Previous Routes Active Inactive Events Doors Opening/Closing Lights On/Off Bluetooth Devices USB devices attached GPS Time updated

36 EVENTS GEAR SHIFTS Navigation Data Trackpoints Locations Saved Previous Routes Active Inactive Events Doors Opening/Closing Lights On/Off Bluetooth Devices USB devices attached GPS Time updated

37 EVENTS - BLUETOOTH Navigation Data Trackpoints Locations Saved Previous Routes Active Inactive Events Doors Opening/Closing Lights On/Off Bluetooth Devices USB devices attached GPS Time updated

38 EVENTS - USB DEVICES Navigation Data Trackpoints Locations Saved Previous Routes Active Inactive Events Doors Opening/Closing Lights On/Off Bluetooth Devices USB devices attached GPS Time updated

39 EVENTS - WIFI CONNECTIONS Navigation Data Trackpoints Locations Saved Previous Routes Active Inactive Events Doors Opening/Closing Lights On/Off Bluetooth Devices USB devices attached GPS Time updated

40 ACCIDENT RECONSTRUCTION ive compliments CDR tool Before, during, after Did the driver send a text just before the crash? Seconds vs. days/months Different set of data Provides a more complete picture of the incident

41 ive OVERVIEW

42 IVE Toolkit for digital forensics/media exploitation consisting of hardware and software Extracts data from vehicle Infotainment & Telematics systems Logical and Physical Acquisitions Non-Destructive Methods

43 WELCOME SCREEN

44 VEHICLE LOOKUP

45 ACQUISITION SELECT VEHICLE

46 ACQUISITION SELECT TYPE

47 ACQUISITION TEST CONNECTIONS

48 ACQUISITION CASE INFO

49 ACQUISITION PROGRESS MONITOR

50 ACQUISITION - RESULTS

51 MAIN WINDOW

52 MAIN WINDOW - WORKFLOW Tree Grid Viewer

53 VIEWING DATA - SYSTEMS

54 VIEWING DATA - CONTENT

55 Introduction VEHICLE LOOKUP - WEBSITE

56 SEARCH BY SPECS Year Make Model Trim North American Vehicles

57 SEARCH BY SPECS Will display specifications of the vehicle Green check = Supported Other details of vehicle can be useful during investigation

58 SEARCH BY VIN VIN will bring up features of that exact vehicle

59 SEARCH BY VIN Notice no green check in the upper right corner Information is in database even though Audi is not yet supported Created as general reference

60 SO WHAT?

61 BENEFITS TO YOU How would having vehicle forensics capabilities benefit your organization now and in the future? Get ahead of the curve and establish your examiners as experts Discover digital evidence not available anywhere else that could make or break your cases (vehicle events, for example) Have an alternative method to get phone information should a suspect phone be locked or destroyed Be able to add user data to crash data in order to create a more accurate, robust timeline

62 BENEFITS ACROSS FIELDS Digital Forensics Accident Reconstruction Insurance Fraud Investigation

63 UPCOMING EVENTS F3 Conference, UK: Nov 3-5 ive Essentials, Austin: Nov CNOA Conference, San Fran: Nov 21-24

64 QUESTIONS Carly McGee (443)

Examining future priorities for cyber security management

Examining future priorities for cyber security management Cybersecurity Focus Day Insurance Telematics 16 Andrew Miller Chief Technical Officer Thatcham Research Owned by the major UK Motor Insurers with