infotainment & telematics systems - federal business … · · 2015-11-06• auto cyber...

© Copyright 2015 by Berla. All Rights Reserved.

VEHICLE FORENSICSInfotainment & Telematics Systems

Berla Corporation 2015


WELCOME• Company Overview

• Infotainment & Telematics Systems

• Overview of Potentially Acquirable Data

• iVe Software/Hardware


ABOUT ME• Lifelong car enthusiast

• Degree in Journalism

• Degree in Digital Forensics

• In field for about 4 years


ABOUT BERLA• Located in the Washington DC area

• Serving the global digital forensics/accident recon/insurance fraud communities

• Develop commercial products and provide training

• Conduct automotive cyber security research

• Provide research and development services for US Government


BERLA’S HISTORY


FACILITY• 14,000 sq ft building

• General/Admin offices

• Training room

• Development space

• Manufacturing area

• Hardware research lab


WHY?• Almost every crime involves a vehicle

• Department of Justice statistics from 2013 reveal:


WHY?• Almost every crime involves a digital element

• Integration of user’s devices into connected vehicle systems

• Analyzing user data is essential


REACTIVE & PROACTIVE APPROACHES• Forensics – Reactive

• Forensically extract and examine relevant data stored within vehicle infotainment and telematics systems

• Focus on user data and vehicle events

• User data from connected devices

• User data from navigation input

• Vehicle events logged from telematics system

• Auto Cyber Security – Proactive

• Conduct vulnerability assessments on vehicles from a wired and wireless perspective

• Focus on Attack Vectors related to the infotainment and telematics systems

• Firmware Updates• WiFi• GSM• Bluetooth


WHY AUTO CYBER SECURITY?• OEM’s (Original Equipment manufacturers) didn’t focus on creating

a secure product because they didn’t see the need

• Infotainment systems are the #1 complaint of consumers – a working product took priority over a secure one

• Charlie Miller & Chris Valasek slapped the world with a wake-up call

• Both OEM’s and consumers need to be aware of possible threats and react accordingly


TRAININGVehicle Forensics & iVe Certification (4 days)

AutomotiveCyber Security(5 days)


• GPS Forensics• Acquisition

• Analysis

• Reporting

• Supports 3000+ GPS Devices• Aviation

• Automotive

• Maritime

• Handheld Devices

PRODUCTS - BLACKTHORN


• Vehicle Forensics• Infotainment & Telematics Systems• Logical and Physical Acquisitions• Non-Destructive Methods• 4,300+ Vehicle Models

• BMW, Buick, Cadillac, Chevrolet, Chrysler, Dodge, Fiat, Ford, GMC Hummer, Jeep, Lincoln, Maserati, Mercury, Pontiac, Ram, SRT, Saturn, Seat, Skoda, Toyota and VW.

PRODUCTS - IVE


INFOTAINMENT & TELEMATICS


INFOTAINMENT• Information + entertainment

• Connects the occupants to their digital world.

• Provides information on vehicle performance, scheduled maintenance, and current status.

• Generally interacts directly with occupants and is main focal point.


TELEMATICS• “Connected Cars” are Wireless

Network Enabled Vehicles

• The integration of telecommunications and information

• Usually Vehicle to Infrastructure (V2I) or Vehicle to Vehicle (V2V)

• Facilitates requests to/from infotainment system


VIDEO – INFOTAINMENT & TELEMATICS• Video by CNET

• Does a good job of illustrating what concepts we just discussed

• Note – this video is a bit older. Notice what features were planned at the time of this video and which of those features have been successfully implemented


INFOTAINMENT & TELEMATICS… TODAY…


OFFENSIVE PERSPECTIVE


CONNECTED CAR MARKET


MARKET BY MANUFACTURER: 2008-2015

0

400

800

1200

1600

Infotainment Navigation Telematics


CONNECTED CAR MARKET


MANUFACTURER ROLL UP• The major manufacturers or OEMs make technology decisions for

their subsidiaries. e.g. GM dictates what infotainment and telematics systems are used in Chevrolet, Cadillac, Buick, GMC, Hummer, and Holden.

• These systems will have similar underlying technology but are have slight enough differences to make them unique. have slightly varying names. For example, Chevrolet, GMC, and Holden use MyLink while Buick uses IntelliLink and Cadillac uses CUE.


BEYOND 2015• Connected Cars bring together technology from smart phones,

social media, web browsers, “Cloud” storage, email, chat, and p2p sharing (just to name a few). Essentially a computer on wheels

• All into a single integrated-connected-highly-mobile environment


USER DATA


COMMUNICATIONS• Average vehicle has close to 70

Electronic Control Units (ECUs).

• They communication over several closed networks mainly called the CANBus.

• Three primary CANBus networks• High Speed• Mid Speed• Infotainment


GENERAL INFO & APP DATAVehicle

• Serial Number• Part Number• Original VIN Number• Build Number

Installed Applications• Weather• Traffic• Facebook• Twitter

Media Files• Audio• Video• Images


DEVICE DATAConnections

• Bluetooth• Wireless

Devices• Phones

• Calls• Contacts• SMS

• Audio• Video• Images

Media PlayersUSB DrivesSD Cards


BLUETOOTH CONNECTIONSConnections


Devices• Phones





WIRELESS CONNECTIONSConnections


Devices• Phones





DEVICE CALL LOGSConnections


Devices• Phones





DEVICE CONTACTSConnections


Devices• Phones





DEVICE SMSConnections


Devices• Phones





EVENTSNavigation Data

• Trackpoints• Locations

• Saved• Previous

• Routes• Active• Inactive

Events• Doors Opening/Closing• Lights On/Off• Bluetooth Devices• USB devices attached• GPS Time updated


EVENTS - DOORSNavigation Data






EVENTS – GEAR SHIFTSNavigation Data






EVENTS - BLUETOOTHNavigation Data






EVENTS - USB DEVICESNavigation Data






EVENTS - WIFI CONNECTIONSNavigation Data






ACCIDENT RECONSTRUCTION• iVe compliments CDR tool

• Before, during, after• Did the driver send a text just before the

crash?

• Seconds vs. days/months

• Different set of data

• Provides a more complete picture of the incident


iVe OVERVIEW


IVE• Toolkit for digital forensics/media

exploitation consisting of hardware and software

• Extracts data from vehicle Infotainment & Telematics systems

• Logical and Physical Acquisitions

• Non-Destructive Methods


WELCOME SCREEN


VEHICLE LOOKUP


ACQUISITION – SELECT VEHICLE


ACQUISITION – SELECT TYPE


ACQUISITION – TEST CONNECTIONS


ACQUISITION – CASE INFO


ACQUISITION – PROGRESS MONITOR


ACQUISITION - RESULTS


MAIN WINDOW


MAIN WINDOW - WORKFLOW

Tree Grid

Viewer


VIEWING DATA - SYSTEMS


VIEWING DATA - CONTENT


VEHICLE LOOKUP - WEBSITEIntroduction


SEARCH BY SPECS• Year

• Make

• Model

• Trim

• North American Vehicles 1981-2016


SEARCH BY SPECS• Will display specifications of the

vehicle

• Green check = Supported

• Other details of vehicle can be useful during investigation


SEARCH BY VIN• VIN will bring up features of that

exact vehicle


SEARCH BY VIN• Notice no green check in the

upper right corner

• Information is in database even though Audi is not yet supported

• Created as general reference


SO WHAT?


BENEFITS TO YOU• How would having vehicle forensics capabilities benefit your

organization now and in the future?

• Get ahead of the curve and establish your examiners as experts

• Discover digital evidence not available anywhere else that could make or break your cases (vehicle events, for example)

• Have an alternative method to get phone information should a suspect phone be locked or destroyed

• Be able to add user data to crash data in order to create a more accurate, robust timeline


BENEFITS ACROSS FIELDS• Digital Forensics

• Accident Reconstruction

• Insurance Fraud Investigation


UPCOMING EVENTS• F3 Conference, UK: Nov 3-5

• iVe Essentials, Austin: Nov 17-18

• CNOA Conference, San Fran: Nov 21-24


QUESTIONS Carly McGee(443) 333-9301

[email protected]

https://www.linkedin.com/company/berla-

corporation

@berlacorp

infotainment & telematics systems - federal business … · · 2015-11-06• auto cyber...

Documents